NY Pub Health L § 2181 (2021)
2021 New York Laws PBH - Public Health Article 21 - Control of Acute Communicable Diseases Title 8 - Novel Coronavirus, Covid-19 2181 - Covid-19 Contact Tracing; Confidentiality.

§  2181. COVID-19 contact tracing; confidentiality. 1. (a) All contact tracing information shall be kept confidential by  any  contact  tracer, contact  tracing  entity,  or designated non-governmental entity and may not be disclosed except as necessary to carry out contact tracing  or  a permitted  purpose. A designated non-governmental entity may only act in relation to contact tracing information as explicitly authorized by this title.  (b) Where a contact tracer or contact tracing entity discloses contact tracing information for a  permitted  purpose,  the  contact  tracer  or contact  tracing entity shall make a record of the disclosure, including to whom it was made and when it was made, which shall  be  part  of  the contact tracing information.  (c)  Nothing  in  this  title  prohibits  otherwise  lawful  voluntary reporting, at the discretion of the contact tracer,  reasonably  and  in good  faith:  (i)  to  the statewide central registry under title six of article six of the social services law, adult protective services  under titles  one and two of article nine-B of the social services law, or the justice center for the protection of people  with  special  needs  under article  eleven of the social services law; or (ii) to a governmental or non-governmental emergency reporting system (such as a  "911,"  domestic violence  or  suicide  prevention  system)  to  prevent imminent risk of injury to any person.  (d) This title does not limit disclosure to or by,  or  possession  or use  by, the case individual or contact individual who is the subject of the information.   2. (a) An individual may waive the  confidentiality  provided  for  by this section, only by a written, informed and voluntary waiver, in plain language  and  in a language understandable to the individual making the waiver, and not part of any other document. The waiver shall  state  the scope and limit of the waiver. No contact tracer, contact tracing entity or  governmental  or non-governmental entity may seek or act in reliance on a waiver to distribute, sell, or otherwise disclose  identifiable  or de-identified  data  to  any  individual  or  entity.  Provided however, nothing in this subdivision shall prohibit  distribution  or  disclosure that   is  otherwise  explicitly  authorized  by  this  section.  If  an individual lacks the capacity to make a waiver, an individual authorized to consent to health care for the individual, or the individual's  legal representative,   may   make   the   waiver.   However,   a   waiver  of confidentiality is not required to be written if it is  solely  for  the purpose  of arranging or providing support for the individual who is the subject of the contact tracing  information,  provided  the  consent  is informed and voluntary.  (b)  A  waiver  of confidentiality under this section shall only apply for the purpose of arranging or providing support if the individual  who is the subject of the contact tracing information (or, if the individual lacks the capacity to provide informed consent, an individual authorized to  consent to health care for the individual, or the individual's legal representative) provides voluntary informed consent to the arranging  or providing of the support.   3.  A  disclosure of contact tracing information authorized under this section shall be limited in scope as to the identity of any  individual, the  information  to be disclosed, and the party to which disclosure may be made, and as necessary to achieve the purpose of the disclosure under this section, and shall not authorize re-disclosure except as explicitly authorized by the terms of the waiver under this section. However,  this section   does   not  bar  disclosure  of  contact  tracing  information pertaining to and identifying a case individual or contact individual by the individual who is identified.    4.  (a)  This  section  does  not  bar  otherwise-lawful   disclosure, possession   or   use  of  de-identified  contact  tracing  information, including aggregate contact tracing information. Disclosure,  possession or  use  under  this  subdivision  shall  only be for a public health or public  health  research  or  evaluation  purpose  as  determined by the commissioner (or the commissioner of the New  York  city  department  of health  and  mental  hygiene  in the case of contact tracing information collected by or under authority of  the  New  York  city  department  of health  and  mental  hygiene  or  the New York city health and hospitals corporation), and shall not authorize re-disclosure or other use.  (b) A person or entity may only disclose, possess or use de-identified contact tracing information if the person or entity, and the  person  or entity  to  which  it  is  disclosed, maintains technical safeguards and policies  and  procedures  that   prevent   re-identification,   whether intentional  or  unintentional, of any individual, as may be required by the commissioner (or the New York city commissioner of health and mental hygiene in the case of contact tracing information collected by or under authority of the New York city department of health and  mental  hygiene or the New York city health and hospitals corporation). The commissioner (or  the  New  York  city commissioner as the case may be) shall require safeguards,  policies  and  procedures  under  this  paragraph  as   the commissioner deems practicable.  (c)  Disclosure,  possession  and use of de-identified contact tracing information under this subdivision shall be only pursuant to approval by the commissioner (or the New York city commissioner of health and mental hygiene in the case of contact tracing information collected by or under authority of the New York city department of health and  mental  hygiene or  the  New  York city health and hospitals corporation) specifying the purpose, nature and scope of the  disclosure,  possession  and  use  and measures  to  ensure that it will comply with this section and the terms of the approval.   5. No law enforcement agent or entity or immigration  authority  shall be  a  contact  tracer  or  contact  tracing entity or engage in contact tracing.  This subdivision does not bar an individual who is  associated with  a law enforcement entity or immigration authority from acting only as a case individual or contact individual. This  subdivision  does  not prevent  a law enforcement agent or entity from assisting in a permitted use under paragraph (b) of  subdivision  eleven  of  section  twenty-one hundred eighty of this title.   6.   No   contact   tracer,   contact  tracing  entity  or  designated non-governmental entity may provide contact tracing information to a law enforcement agent, entity or immigration authority, or any individual or entity other than the contact tracing entity from which it received  the information,  except  as  explicitly  authorized  by this title. Without consent  under  subdivision  two  of  this  section,   contact   tracing information  and  any evidence derived therefrom shall not be subject to or provided in response to any legal process or be  admissible  for  any purpose in any judicial or administrative action or proceeding. However, this  subdivision does not restrict providing information, relating to a specified case individual or contact individual, where and only  to  the extent necessary for a permitted purpose.   7.   (a)   Contact   tracing   entities  shall  establish  appropriate administrative,  technical  and  physical   safeguards,   policies   and procedures that ensure the security of contact tracing information under the  entity's jurisdiction. The safeguards, policies and procedures must ensure contact tracing information is encrypted and protected  at  least as  much  as  or  more  than  other  confidential  information under the entity's jurisdiction. All storage of contact tracing information  shall  meet  the  requirements of this title. The commissioner (or the New York city commissioner of health and mental hygiene in the  case  of  contact tracing information collected by or under authority of the New York city department  of health and mental hygiene or the New York city health and hospitals corporation) shall make regulations as reasonably necessary to require that contact tracing information possessed, used  or  under  the control  of  a contact tracer or contact tracing entity shall be subject to  technical  safeguards,  policies   and   procedures   for   storage, transmission,  use  and  protection  of the information. The regulations shall prevent possession, use  or  disclosure  of  the  contact  tracing information  not  permitted  by  this title, and shall be at least as or more  protective  than  the  safeguards,  policies  and  procedures  the commissioner  (or  the  New  York  city commissioner as the case may be) provides for other confidential information.  (b) This paragraph applies to a  contact  tracer  or  contact  tracing entity  that  is  a non-governmental individual or entity employed by or under contract with a governmental entity, or an agent  thereof.  Within sixty  days  of collecting or receiving the contact tracing information, the entity shall (i) remove information from its possession  or  control and deliver it to the appropriate governmental contact tracing entity or a  designated  non-governmental  entity  specified  by  the governmental contact tracing entity, retaining  no  copy  of  it;  (ii)  expunge  the information  from  its  possession  or control; or (iii) de-identify the information.    However,  the  expungement   or   de-identification   of particular  contact  tracing  information  may  be  postponed  for up to fifteen days after the initial sixty day period while the contact tracer or contact tracing entity is actively engaged in contact  tracing  using that   information,   provided  that  the  case  individual  or  contact individual to whom it pertains gives  voluntary  informed  consent.  The disclosure,  possession  and  use  of  the de-identified contact tracing information shall be subject to subdivision four of this section.