NY Pub Health L § 18 (2021)
2021 New York Laws PBH - Public Health Article 1 - Short Title and Definitions: General Provisions Title 2 - General Provisions 18 - Access to Patient Information.

* § 18. Access to patient information. 1. Definitions. For the purpose of this section:  (a)  "Committee"  means  a  medical  access review committee appointed pursuant to subdivision four of this section.  (b)  "Health  care  provider"  or  "provider"  means  a  "health  care facility"   or   a   "health  care  practitioner"  as  defined  by  this subdivision.  (c) "Health care facility" or "facility" means a hospital  as  defined in  article twenty-eight of this chapter, a home care services agency as defined in article thirty-six of this chapter, a hospice as  defined  in article  forty  of  this  chapter,  a health maintenance organization as defined in article forty-four of  this  chapter,  and  a  shared  health facility as defined in article forty-seven of this chapter.  (d)  "Health  care  practitioner"  or  "practitioner"  means  a person licensed under article one hundred thirty-one, one hundred thirty-one-B, one  hundred  thirty-two,  one   hundred   thirty-three,   one   hundred thirty-six,  one hundred thirty-nine, one hundred forty-one, one hundred forty-three,  one  hundred  forty-four,  one  hundred  fifty-three,  one hundred  fifty-four,  one hundred fifty-six or one hundred fifty-nine of the education law  or  a  person  certified  under  section  twenty-five hundred sixty of this chapter.  (e)  "Patient  information"  or  "information"  means  any information concerning or relating to the examination, health assessment  including, but  not  limited  to,  a health assessment for insurance and employment purposes or treatment of an identifiable subject maintained or possessed by a health care facility or health care practitioner who  has  provided or is providing services for assessment of a health condition including, but  not  limited  to,  a health assessment for insurance and employment purposes or  has  treated  or  is  treating  such  subject,  except  (i) information  and  clinical  records subject to the provisions of section 23.05 or 33.13 of the  mental  hygiene  law,  (ii)  personal  notes  and observations  of a health care practitioner, provided that such personal notes and observations  are  maintained  by  the  practitioner  and  not disclosed  by  the practitioner to any other person after January first, nineteen  hundred  eighty-seven,  (iii)  information  maintained  by   a practitioner,  concerning  or  relating  to  the  prior  examination  or treatment of a subject  received  from  another  practitioner,  provided however,  that such information may be requested by the subject directly from such other practitioner in accordance with the provisions  of  this section,  and  (iv)  data  disclosed  to a practitioner in confidence by other persons on the basis of an express condition that such data  would never  be  disclosed to the subject or other persons, provided that such data has never been disclosed to any other person. If at any  time  such personal  notes  and observations or such data is disclosed, it shall be considered  patient  information  for  purposes  of  this  section.  For purposes of this subdivision, "disclosure to any other person" shall not include  disclosures  made to practitioners as part of a consultation or referral during the treatment  of  the  subject,  to  persons  reviewing information  or  records  in  the  ordinary  course  of  ensuring that a provider is in compliance with applicable quality of care, licensure  or accreditation  standards, to an employee or official of a federal, state or local agency for the sole purpose  of  conducting  an  audit  in  the course  of  his  or  her  official duties, to the statewide planning and research cooperative system, to other persons pursuant to a court order, to governmental agencies, insurance companies licensed pursuant  to  the insurance  law  and  other third parties requiring information necessary for payments to be made to  or  on  behalf  of  patients,  to  qualified researchers,  to  the  state board for professional medical conduct when  such board requests such information in the exercise  of  its  statutory function, to an insurance carrier insuring, or an attorney consulted by, a  health  care  provider,  or  to  a  health  maintenance  organization certified  pursuant  to  article  forty-four of this chapter or licensed pursuant to the insurance law, or to the committee or a  court  pursuant to the provisions of this section.   For  purposes  of  this  subdivision  treatment of a subject shall not include  diagnostic  services,  except  mammography,  performed   by   a practitioner   at  the  request  of  another  health  care  practitioner provided,  however,  that  such  information,  and  mammograms,  may  be requested by the subject directly from the practitioner at whose request such   diagnostic  services  were  performed,  in  accordance  with  the provisions of this section.  (f)  "Personal  notes  and  observations"   means   a   practitioner's speculations, impressions (other than tentative or actual diagnosis) and reminders, provided such data is maintained by a practitioner.  (g)  "Qualified  person"  means  any properly identified subject; or a guardian appointed under article eighty-one of the mental  hygiene  law; or  a  parent  of  an infant; or a guardian of an infant appointed under article seventeen of  the  surrogate's  court  procedure  act  or  other legally  appointed  guardian of an infant who may be entitled to request access to a clinical record under paragraph (c) of  subdivision  two  of this  section;  or  a  distributee  of  any deceased subject for whom no personal representative, as defined in the estates,  powers  and  trusts law,  has been appointed; or an attorney representing a qualified person or the subject's estate who holds a power of attorney from the qualified person or the subject's estate  explicitly  authorizing  the  holder  to execute  a written request for patient information under this section. A qualified person shall be  deemed  a  "personal  representative  of  the individual" for purposes of the federal health insurance portability and accountability act of 1996 and its implementing regulations.  (h)  "Subject" means an individual concerning whom patient information is maintained or possessed by a health care provider.  (i) "Treating practitioner" means the health care practitioner who has primary responsibility for the care of the  subject  within  the  health care  facility  or  if  such practitioner is unavailable, a practitioner designated by such facility.  (j) "Cease to do business in this state" shall mean any case  where  a health care provider who has engaged in an on-going practice or business within  this  state  as a health care provider, ceases to engage in such business, provided however, that this term shall not  include  a  health care  practitioner  whose practice is merged, consolidated, combined, or acquired by another health care provider and  he  or  she  continues  to provide  services  including  medical  care,  diagnosis  or treatment to patients  as  an  employee,  contractor,  or  owner   of   the   merged, consolidated, combined, or acquired health care provider.   2.  Access  by  qualified  persons.  (a)  Subject to the provisions of subdivision three of this section,  upon  the  written  request  of  any subject, a health care provider shall provide an opportunity, within ten days,  for such subject to inspect any patient information concerning or relating to  the  examination  or  treatment  of  such  subject  in  the possession of such health care provider.  (b)  Subject  to  the provisions of subdivision three of this section, upon the written request of the committee for an  incompetent  appointed pursuant  to  article  seventy-eight of the mental hygiene law, a health care provider shall provide an opportunity, within  ten  days,  for  the inspection  by  such committee of any patient information concerning the incompetent subject in the possession of such health care provider.  (c) Subject to the provisions of subdivision three of this section and except as otherwise provided by law,  upon  the  written  request  of  a parent  or guardian of an infant appointed pursuant to article seventeen of the surrogate's court procedure act, or any other  legally  appointed guardian,  a  health  care provider shall provide an opportunity, within ten days, for such parent or guardian to inspect any patient information maintained or possessed by such provider concerning care  and  treatment of  the  infant  for  which  the  consent of such parent or guardian was obtained or where care was provided  without  consent  in  an  emergency which  was  the  result  of accidental injury or the unexpected onset of serious illness; provided, however, that such parent or  guardian  shall not  be  entitled  to  inspect or make copies of any patient information concerning the care and treatment of an infant  where  the  health  care provider  determines  that  access  to the information requested by such parent or guardian would have a detrimental  effect  on  the  provider's professional  relationship with the infant, or on the care and treatment of the infant, or on the infant's relationship with his or  her  parents or guardian.  (d)  Subject  to  the provisions of subdivision three of this section, upon the written request of any qualified person, a health care provider shall furnish to such person, within a reasonable time, a  copy  of  any patient  information requested, and original mammograms requested, which the person is authorized to inspect pursuant to this subdivision.  (e) The provider may impose a reasonable charge  for  all  inspections and copies, not exceeding the costs incurred by such provider, provided, however, that a provider may not impose a charge for copying an original mammogram  when  the original has been furnished to any qualified person and provided, further,  that  any  charge  for  furnishing  an  original mammogram pursuant to this section shall not exceed the documented costs associated  therewith.  However,  the reasonable charge for paper copies shall not exceed seventy-five cents per page. A qualified  person  shall not  be denied access to patient information solely because of inability to pay. No charge may be  imposed  under  this  section  for  providing, releasing,  or  delivering  patient  information  or  copies  of patient information  where  requested  for  the   purpose   of   supporting   an application,  claim  or  appeal  for  any government benefit or program, provided  that,  where  a  provider  maintains  patient  information  in electronic form, it shall provide the copy in either electronic or paper form,  as  required  by  the  government  benefit  or program, or at the patient's request.  (f) A provider may place reasonable limitations on  the  time,  place, and frequency of any inspections of patient information.  (g)  In the event that a practitioner does not have space available to permit the inspection of patient information, the practitioner  may,  in the  alternative,  furnish a qualified person a copy of such information within ten days.  (h) A provider may request  the  opportunity  to  review  the  patient information  with  the qualified person requesting such information, but such review shall not be a prerequisite for furnishing the information.  (i) A provider may make available for inspection either  the  original or a copy of patient information.   3.  Limitations  on access. (a) Upon receipt of a written request by a qualified person to inspect or copy patient information, a  practitioner may review the information requested. Unless the practitioner determines pursuant  to  paragraph  (d)  of this subdivision that (i) the requested review  of  the  information  can  reasonably  be  expected   to   cause substantial  and  identifiable harm to the subject or others which would outweigh the qualified person's right to access to the  information,  or  (ii)  the  material requested is personal notes and observations, or the information requested would have a  detrimental  effect  as  defined  in subdivision  two  of  this  section,  review of such patient information shall be permitted or copies provided.  (b) Upon receipt of a written request by a qualified person to inspect patient  information maintained by a facility, the facility shall inform the treating practitioner of the request. The treating practitioner  may review  the  information  requested.  Unless  the  treating practitioner determines, pursuant to paragraph  (d)  of  this  subdivision  that  the requested  review of the information can reasonably be expected to cause substantial and identifiable harm to the subject or others  which  would outweigh  the  qualified  person's right of access to the information or would have a detrimental effect as defined in subdivision  two  of  this section, review of such patient information shall be permitted or copies provided.  (c)  A  subject  over  the  age of twelve years may be notified of any request by a qualified person to  review  his/her  patient  information, and,  if  the  subject  objects to disclosure, the provider may deny the request. In the case of a facility, the treating practitioner  shall  be consulted.  (d)  The  provider may deny access to all or a part of the information and may grant access to a prepared summary of the information if,  after consideration of all the attendant facts and circumstances, the provider determines  that  (i) the request to review all or a part of the patient information  can  reasonably  be  expected  to  cause  substantial   and identifiable  harm  to  the  subject  or others which would outweigh the qualified person's right of access to the information, or would  have  a detrimental  effect  as  defined  in subdivision two of this section, or (ii) the material requested  is  personal  notes  and  observations.  In conducting  such  review, the provider may consider, among other things, the following factors: (i) the need for, and  the  fact  of,  continuing care  and  treatment;  (ii)  the  extent  to  which the knowledge of the information may be harmful to the health or safety  of  the  subject  or others;  (iii)  the  extent  to which the information contains sensitive material  disclosed  in  confidence  to  the  practitioner  or  treating practitioner  by  family  members,  friends  and other persons; (iv) the extent to which the information contains sensitive  materials  disclosed to  the  practitioner  or the treating practitioner by the subject which would be injurious to the subject's relationships  with  other  persons, except  when the subject is requesting information concerning himself or herself; and (v) in the case of a minor  making  a  request  for  access pursuant to subdivision two of this section, the age of the subject.  (e)  In the event of a denial of access, the qualified person shall be informed by the provider of such denial, and whether the denial is based on the reasonable  expectation  that  release  of  the  information  can reasonably be expected to cause substantial and identifiable harm to the subject or others which outweighs the qualified person's right of access to  the information or on the reasonable expectation that release of the information would have a detrimental effect as  defined  in  subdivision two  of  this  section,  or on the basis that the materials sought to be reviewed  constitute  personal  notes  and  observations,  and  of   the qualified person's right to obtain, without cost, a review of the denial by  the  appropriate  medical  record  access  review  committee. If the qualified person requests such review, the provider  shall,  within  ten days  of  receipt  of  such  request, transmit the information including personal notes and observations as defined herein, to  the  chairman  of the  appropriate  committee  with a statement setting forth the specific reasons for which access was denied. After an in camera  review  of  the  materials   provided  and  after  providing  all  parties  a  reasonable opportunity to be heard, the committee shall  promptly  make  a  written determination  whether  the  requested  review  of  the  information can reasonably be expected to cause substantial and identifiable harm to the subject or others which outweighs the qualified person's right of access to  the  information  pursuant  to  paragraph (d) of this subdivision or whether the requested review would have a detrimental effect as  defined in  subdivision  two  of  this  section,  or  whether all or part of the materials  sought  to  be  reviewed  constitute   personal   notes   and observations,  and  shall accordingly determine whether access to all or part of such materials shall be granted. In the event that the committee determines that the request for access shall be granted in whole  or  in part,  the  committee  shall  notify  all parties and the provider shall grant access pursuant to such determination.  (f) In the event that access is denied in whole or in part because the requested review of information can  reasonably  be  expected  to  cause substantial  and  identifiable harm to the subject or others which would outweigh the qualified person's right of access to the  information,  or would  have  a  detrimental effect as defined in subdivision two of this section, the committee shall notify the qualified person of his  or  her right  to  seek judicial review of the provider's determination pursuant to this section: provided however, that a determination by the committee as to whether materials sought to be reviewed constitute personal  notes and  observations  shall  not  be the subject of judicial review. Within thirty days of receiving notification of such  decision,  the  qualified person  may commence, upon notice, a special proceeding in supreme court for a judgment requiring the provider to make available the  information for  inspection or copying. The court upon such application and after an in camera review of the materials provided including  the  determination and  record  of  the  committee,  and  after  providing  all  parties an opportunity  to  be  heard,  shall  determine  whether  there  exists  a reasonable basis for the denial of access. The relief available pursuant to  this  section shall be limited to a judgement requiring the provider to make available to the qualified person the requested information  for inspection or copying.  (g)  Where  the  written  request  for  patient information under this section is signed by a distributee of a  deceased  subject  for  whom  a personal  representative has not been appointed, or from the holder of a power of attorney from such a distributee, a copy of a certified copy of the certificate of death of the subject shall be attached to the written request.  (h) Where the written  request  for  patient  information  under  this section  is  signed  by the holder of a power of attorney, a copy of the power of attorney shall be attached to the written  request.  A  written request  under  this  subdivision  shall  be subject to the duration and terms of the power of attorney.  (i) The release of  patient  information  shall  be  subject  to:  (i) article  twenty-seven-F  of  this  chapter  in  the case of confidential HIV-related information; (ii) section  seventeen  of  this  article  and sections   twenty-three   hundred  one,  twenty-three  hundred  six  and twenty-three hundred eight of this chapter in the case of termination of a pregnancy and treatment for  a  sexually  transmitted  disease;  (iii) article  thirty-three  of  the  mental  hygiene  law; and (iv) any other provisions of law creating special requirements relating to the  release of   patient   information,   including  the  federal  health  insurance portability  and  accountability  act  of  1996  and  its   implementing regulations.    4.  Medical  record  access  review committees. The commissioner shall designate medical record access review committees to hear appeals of the denial of access to patient information as provided in paragraph (e)  of subdivision  three  of  this  section. The commissioner shall promulgate rules  and  regulations  necessary  to effectuate the provisions of this subdivision.   5. Annual report. The commissioner shall submit an annual report on or before December thirty-first to the governor and the  legislature.  Such report  shall include, but not be limited to, the number of requests for committee review of providers' denial  of  access  and  the  committees' determinations thereon.   6.  Disclosure  to  third persons. Whenever a health care provider, as otherwise authorized by law, discloses patient information to  a  person or  entity  other  than  the  subject  of  such  information or to other qualified persons, either a copy of the subject's written  authorization shall  be  added  to  the patient information or the name and address of such third party and a notation of the purpose for the disclosure  shall be indicated in the file or record of such subject's patient information maintained  by the provider provided, however, that for disclosures made to government agencies making payments  on  behalf  of  patients  or  to insurance  companies  licensed  pursuant  to  the  insurance  law such a notation shall only be entered at the time the disclosure is first made. This subdivision shall not apply to disclosure to practitioners or other personnel employed by  or  under  contract  with  the  facility,  or  to government agencies for purposes of facility inspections or professional conduct  investigations.  Any  disclosure  made pursuant to this section shall be limited to that information necessary in light  of  the  reason for  disclosure. Information so disclosed should be kept confidential by the party  receiving  such  information  and  the  limitations  on  such disclosure in this section shall apply to such party.   7.  Applicability  of  federal law. Whenever federal law or applicable federal regulations affecting the release of patient information  are  a condition  for the receipt of federal aid, and are inconsistent with the provisions of this section, the provisions of  federal  law  or  federal regulations shall be controlling.   8.  Challenges  to  accuracy.  A  qualified  person  may challenge the accuracy of information maintained in the patient  information  and  may require that a brief written statement prepared by him or her concerning the  challenged  information  be  inserted into the patient information. This statement shall become a permanent part of the patient  information and  shall  be  released  whenever the information at issue is released. This subdivision shall apply only to factual statements  and  shall  not include a provider's observations, inferences or conclusions.   A facility may place reasonable restrictions on the time and frequency of any challenges to accuracy.   9.  Waivers void. Any agreement by an individual to waive any right to inspect, copy or seek correction of patient information as provided  for in  this section shall be deemed to be void as against public policy and wholly unenforceable.   10. Nothing contained in this section shall restrict, expand or in any way limit  the  disclosure  of  any  information  pursuant  to  articles twenty-three,  thirty-one  and  forty-five of the civil practice law and rules or section six hundred seventy-seven of the county law.   11. No proceeding shall be brought  or  penalty  assessed,  except  as provided  for  in  this  section, against a health care provider, who in good faith, denies access to patient information.    12.  Immunity  from  liability.  No  health  care  provider  shall  be subjected  to  civil liability arising solely from granting or providing access to any patient information in accordance with this section.   13.  (a)  A  health  care provider which has in its possession patient information and/or patient medical records and which has  determined  to permanently  cease  to  do  business or practice in this state shall, at least thirty days prior to such action, make  a  good  faith  effort  to notify  each  of  the  health  care provider's current patients that the office will be closing and to inform each such patient  of  his  or  her right  to  request  that  his  or her patient information and/or patient medical records be sent to a health care provider, health care  facility or health care practitioner of the patient's choosing or, alternatively, that such information and records be returned to the patient.  (b)  The  provisions  of  this subdivision shall not affect any rights afforded pursuant to section seventeen of this title.  (c) Nothing in this subdivision shall affect the period of time that a health care provider is lawfully required to retain a patient's  medical information and medical records.  (d)  The  provisions of this subdivision shall only apply with respect to a patient whose chart includes  written  permission  to  receive  the notification described in paragraph (a) of this subdivision.   * NB There are 2 § 18's