RI · Breach notification statute
Rhode Island data breach notification law
Summary
- Statute citation
R.I. Gen. Laws §§ 11-49.3-1 to 11-49.3-7 (Rhode Island Identity Theft Protection Act of 2015) (amended 2023)
- Last amended
- 2023 (as stated in the citation)
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
45-day
Attorney general notice
Yes Rhode Island requires notification to the Attorney General when more than 500 Rhode Island
What counts as a breach
In Rhode Island 'breach of the security of the system' means unauthorized access or acquisition of unencrypted, computerized data information that compromises the security, confidentiality, or integrity of personal information maintained by the municipal agency, state agency, or person; good-faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not use
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Rhode Island
41 reports to HHS OCR affecting 544,697 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Rhode Island.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Community Care Alliance | Healthcare Provider | 111,804 | Mar 1, 2025 | Hacking/IT Incident | Archive (closed) |
| Brightstar Global Solutions Corporation | Health Plan | 103,879 | Oct 3, 2025 | Hacking/IT Incident | Under investigation |
| Wood River Health | Healthcare Provider | 54,926 | Jul 28, 2025 | Hacking/IT Incident | Archive (closed) |
| Blackstone Valley Community Health Care | Healthcare Provider | 34,518 | Apr 22, 2024 | Hacking/IT Incident | Archive (closed) |
| Internal Medicine Associates, LLC d/b/a Gastrointestinal Medicine Associates | Healthcare Provider | 31,835 | Aug 7, 2024 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Rhode Island businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Rhode Island timing rule as: "45-day". (Source: PRC 2026 survey extract.)
Does Rhode Island require notice to the attorney general?
The PRC 2026 extract notes: "Yes Rhode Island requires notification to the Attorney General when more than 500 Rhode Island". (Source: PRC 2026 survey extract.)
Does the Rhode Island law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Rhode Island breach law.
Does the Rhode Island law cover medical information?
Yes. The PRC 2026 survey records medical information as covered by the Rhode Island breach law.
Does the Rhode Island law cover paper records?
Yes. The PRC 2026 survey records paper (non-computerised) records as covered in Rhode Island.
Is there a private right of action in Rhode Island?
No. The PRC 2026 survey does not record a private right of action under the Rhode Island breach law.
How does the Rhode Island law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Rhode Island statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Rhode Island state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws