NY Pub Health L § 2782 (2021)
2021 New York Laws PBH - Public Health Article 27-F - HIV and AIDS Related Information 2782 - Confidentiality and Disclosure.

§  2782.  Confidentiality  and  disclosure.  1.  No person who obtains confidential HIV related information in  the  course  of  providing  any health  or  social  service or pursuant to a release of confidential HIV related information may  disclose  or  be  compelled  to  disclose  such information, except to the following:  (a)  the  protected individual or, when the protected individual lacks capacity to consent, a person authorized pursuant to law to  consent  to health care for the individual;  (b)  any person to whom disclosure is authorized pursuant to a release of confidential HIV related information;  (c) an agent or employee of a health facility or health care  provider if (1) the agent or employee is permitted to access medical records, (2) the  health  facility  or  health  care provider itself is authorized to obtain the HIV related  information,  and  (3)  the  agent  or  employee provides  health  care  to  the  protected  individual,  or maintains or processes medical records for billing or reimbursement;  (d) a health care provider or health facility when  knowledge  of  the HIV  related  information  is  necessary  to provide appropriate care or treatment to the protected individual, a  child  of  the  individual,  a contact of the protected individual or a person authorized to consent to health care for such a contact;  (e)  a  health  facility  or  health care provider, in relation to the procurement, processing, distributing or use of a human body or a  human body  part,  including  organs,  tissues,  eyes, bones, arteries, blood, semen, or other body fluids, for use  in  medical  education,  research, therapy, or for transplantation to individuals;  (f)  health  facility  staff  committees or accreditation or oversight review organizations authorized to access medical records; provided that such committees or organizations  may  only  disclose  confidential  HIV related information: (1) back to the facility or provider of a health or social  service; (2) to carry out the monitoring, evaluation, or service review for which it was obtained; or (3) to a federal,  state  or  local government  agency  for  the  purposes  of and subject to the conditions provided in subdivision six of this section;  (g) a federal,  state,  county  or  local  health  officer  when  such disclosure is mandated by federal or state law;  (h) an authorized agency in connection with foster care or adoption of a  child. Such agency shall be authorized to redisclose such information only pursuant to this article or in accordance with  the  provisions  of subdivision eight of section three hundred seventy-two and section three hundred seventy-three-a of the social services law;  (i) third party reimbursers or their agents to the extent necessary to reimburse  health  care  providers  for  health services; provided that, where  necessary,  an  otherwise  appropriate  authorization  for   such disclosure has been secured by the provider;  (j)  an insurance institution, for other than the purpose set forth in paragraph (i) of this subdivision, provided  the  insurance  institution secures  a  dated  and  written authorization that indicates that health care providers, health facilities,  insurance  institutions,  and  other persons  are  authorized  to  disclose  information  about the protected individual, the nature of the information to be disclosed, the  purposes for which the information is to be disclosed and which is signed by: (1) the  protected  individual;  (2)  if  the protected individual lacks the capacity to consent, such other person authorized  pursuant  to  law  to consent  for  such  individual;  or  (3)  if the protected individual is deceased, the beneficiary or claimant for benefits  under  an  insurance policy,  a  health services plan, or an employee welfare benefit plan as defined in 29 U.S.C. 1002(1), covering such protected individual;  (k) any person to whom disclosure is ordered by a court  of  competent jurisdiction  pursuant  to  section  twenty-seven hundred eighty-five of this article;  (l)  an  employee  or  agent  of  the  department  of  corrections and community supervision, in accordance with paragraph (a)  of  subdivision two  of  section twenty-seven hundred eighty-six of this article, to the extent the employee or agent is authorized to access records  containing such  information  in  order  to  carry  out the department's functions, powers and duties with respect to the protected individual, pursuant  to section two hundred fifty-nine-a of the executive law;  (m)  an  employee or agent of the office of probation and correctional alternatives or any  local  probation  department,  in  accordance  with paragraph  (a)  of  subdivision  two  of  section  twenty-seven  hundred eighty-six of this article, to the  extent  the  employee  or  agent  is authorized  to  access  records  containing such information in order to carry out the office's or department's functions, powers and duties with respect to the protected individual, pursuant  to  articles  twelve  and twelve-A of the executive law;  (n)  a medical director of a local correctional facility as defined in section forty of the correction law, in accordance with paragraph (a) of subdivision two of  section  twenty-seven  hundred  eighty-six  of  this article,  to  the  extent  the  medical director is authorized to access records containing such information in order to carry  out  his  or  her functions, powers and duties with respect to the protected individual;  (o)  an  employee  or  agent  of  the  commission  of  correction,  in accordance with paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, to the extent the employee or  agent is  authorized to access records containing such information in order to carry out the commission's functions, powers and duties with respect  to the  protected  individual,  pursuant to article three of the correction law;  (p) an attorney appointed to represent a minor pursuant to the  social services  law  or the family court act, with respect to confidential HIV related information relating  to  the  minor  and  for  the  purpose  of representing  the  minor.  If the minor has the capacity to consent, the minor's attorney may not redisclose confidential HIV related information without the minor's permission. If the minor lacks capacity to  consent, the minor's attorney may redisclose confidential HIV related information for the sole purpose of representing the minor. This paragraph shall not limit  the  ability of the minor's attorney to seek relief under section twenty-seven hundred eighty-five of this chapter.  (q) an executor or an administrator of an estate shall have access  to the  confidential  HIV  information  of  a  deceased person as needed to fulfill  his  or  her  responsibilities/duties   as   an   executor   or administrator.  (r)  qualified  researchers  for  medical  research  purposes upon the approval of a research protocol by a  human  research  review  committee established  and  approved under the provisions of article twenty-four-A of this chapter or by an  institutional  review  board  established  and approved  under  the provisions of 45 CFR part 46 or 42 USC 300 V-1, for the  purpose  of  reviewing  and  monitoring  research  involving  human subjects,  provided  that  in  no  event  shall any qualified researcher disclose information tending to identify the subjects of the research.  (s) an employee or agent of the board of correction of the city of New York, in accordance with paragraph (a) of  subdivision  two  of  section twenty-seven  hundred  eighty-six  of  this  article,  to the extent the employee or agent  is  authorized  to  access  records  containing  such information  in  order  to  carry  out the board's functions, powers and  duties with respect to the protected individual, pursuant to the charter of the city of New York.   2.  A  state, county or local health officer may disclose confidential HIV related information when:  (a) disclosure is specifically authorized or required  by  federal  or state law; or  (b)  disclosure  is  made  pursuant  to  a release of confidential HIV related information; or  (c) disclosure is requested by a  physician  pursuant  to  subdivision four of this section; or  (d) disclosure is authorized by court order pursuant to the provisions of section twenty-seven hundred eighty-five of this article.   3.  No  person  to  whom confidential HIV related information has been disclosed pursuant to this article shall  disclose  the  information  to another  person except as authorized by this article, provided, however, that the provisions of this subdivision shall not apply:  (a) to the protected individual; or  (b) to a natural person who is authorized pursuant to law  to  consent to health care for the protected individual; or  (c)  to  a  protected individual's foster parent as defined in section three hundred seventy-one of the social  services  law  and  subject  to regulations  promulgated pursuant to paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, for the purpose of providing care, treatment or supervision of the protected individual; or  (d) a prospective  adoptive  parent  as  specified  in  section  three hundred  seventy-three-a  of  the  social  services  law  and subject to regulations promulgated pursuant to paragraph (a) of subdivision two  of section  twenty-seven  hundred  eighty-six  of  this article with whom a child who is the protected individual has been placed for adoption; or  (e) to a relative or other person legally responsible to whom a  child who  is  the protected individual is to be placed or discharged pursuant to section ten hundred seventeen or ten hundred fifty-five of the family court act and subject to regulations promulgated pursuant  to  paragraph (a)  of  subdivision  two  of section twenty-seven hundred eighty-six of this  article,  for  the  purpose  of  providing  care,   treatment   or supervision of the protected individual.   4.  (a)  A physician may disclose confidential HIV related information under the following conditions:  (1) disclosure is made to a contact, to a public  health  officer  for the  purpose  of  making  the disclosure to said contact and pursuant to section twenty-one hundred thirty of this chapter; or  (2) the physician believes disclosure  is  medically  appropriate  and there is a significant risk of infection to the contact; and  (3) the physician has counseled the protected individual regarding the need to notify the contact; and  (4)  the physician has informed the protected individual of his or her intent  to  make  such  disclosure  to  a   contact,   the   physician's responsibility  to  report  the  infected  individual's case pursuant to section twenty-one hundred thirty of this  chapter  and  has  given  the protected  individual  the  opportunity  to  express  a preference as to whether disclosure should be made by the  physician  directly  or  to  a public  health  officer  for  the  purpose  of  said  disclosure. If the protected individual expresses a preference for disclosure by  a  public health officer, the physician shall honor such preference.  (5)  If  a  physician  chooses to make a notification pursuant to this section, he or she shall report to the municipal health commissioner  of district  health officer on his or her efforts to notify the contacts of  the protected individual. Such report shall be in a manner and on  forms prescribed  by  the  commissioner  and shall include the identity of the protected individual and any contacts  as  well  as  information  as  to whether the contacts were successfully notified.  (6) Within a reasonable time of receiving a report that a physician or his  or  her  designated  agent did not notify or verify notification of contacts provided by the protected individual, the  health  commissioner or  district  health  officer  of the municipality from which the report originates shall take reasonable measures to notify  such  contacts  and otherwise comply with the provisions of this chapter.  (b)  When  making  such  disclosures  to the contact, the physician or public health officer shall provide or make referrals for the  provision of  the  appropriate  medical  advice and counseling for coping with the emotional consequences of learning  the  information  and  for  changing behavior  to  prevent  transmission or contraction of HIV infection. The physician or public health officer shall not disclose  the  identity  of the  protected  individual  or  the  identity  of  any  other contact. A physician or public health officer making  a  notification  pursuant  to this  subdivision  shall  make  such  disclosure in person, except where circumstances reasonably prevent doing so.  (c) A physician or public health officer shall have no  obligation  to identify  or  locate  any  contact  except as provided pursuant to title three of article twenty-one of this chapter.  (d) A physician may,  upon  the  consent  of  a  parent  or  guardian, disclose  confidential  HIV  related  information to a state, county, or local health officer for the purpose of reviewing the medical history of a child to determine the fitness of the child to attend school.  (e) A physician may  disclose  confidential  HIV  related  information pertaining  to  a  protected  individual  to  a  person  (known  to  the physician) authorized pursuant to law to consent to health  care  for  a protected  individual  when  the physician reasonably believes that: (1) disclosure is medically necessary in order to provide  timely  care  and treatment  for  the  protected  individual;  and  (2)  after appropriate counseling as to the need for such disclosure, the protected  individual will  not  inform  a person authorized by law to consent to health care; provided, however, that the physician shall not make such disclosure if, in the judgment of the physician: (A) the disclosure would not be in the best  interest  of  the  protected  individual;  or  (B)  the  protected individual  is  authorized  pursuant  to law to consent to such care and treatment. Any decision or action by a physician under  this  paragraph, and  the basis therefor, shall be recorded in the protected individual's medical record.   5.  (a) Whenever disclosure of confidential HIV related information is made pursuant to this article, except for disclosures made  pursuant  to paragraphs  (a),  (d)  and  (i)  of  subdivision  one of this section or paragraph  (a)  or  (e)  of  subdivision  four  of  this  section,  such disclosure  shall  be  accompanied or followed by a statement in writing which includes the following or substantially  similar  language:  "This information  has  been  disclosed to you from confidential records which are protected by state law. State law  prohibits  you  from  making  any further  disclosure  of  this  information  without the specific written consent of the person to whom it pertains, or as otherwise permitted  by law.  Any  unauthorized further disclosure in violation of state law may result in a fine or jail sentence or both. A general  authorization  for the   release   of  medical  or  other  information  is  NOT  sufficient authorization for further  disclosure."  An  oral  disclosure  shall  be accompanied or followed by such a notice within ten days.  (b)   Except  for  disclosures  made  pursuant  to  paragraph  (c)  of subdivision one of this section, or to persons reviewing information  or records  in the ordinary course of ensuring that a health facility is in compliance with applicable  quality  of  care  standards  or  any  other authorized  program evaluation, program monitoring or service review, or to governmental agents requiring information necessary for  payments  to be  made  on  behalf  of  patients or clients pursuant to contract or in accordance to law, a notation of all such disclosures shall be placed in the medical record of a protected individual, who shall be  informed  of such  disclosures  upon request; provided, however, that for disclosures made to insurance institutions such a notation need only be  entered  at the time the disclosure is first made.   6. (a) The provisions of this subdivision shall apply where a provider of  a  health  or  social  service  possesses  confidential  HIV related information relating to individuals who are recipients of  the  service, and  a  federal, state or local government agency supervises or monitors the provider or administers the  program  under  which  the  service  is provided.  (b)  Confidential  HIV  related information relating to a recipient of such service may be disclosed in accordance with regulations promulgated pursuant to paragraph (a) of subdivision  two  of  section  twenty-seven hundred eighty-six of this article to an authorized employee or agent of such  provider  or government agency, when reasonably necessary for such supervision, monitoring, administration, or provision of  such  service. The  term  "authorized  employee  or agent", as used in this subdivision shall only include any employee or agent  who  would,  in  the  ordinary course  of business of the provider or government agency, have access to records relating to the care of, treatment of, or provision of a  health or social service to the protected individual.   7.  Nothing  in  this  section  shall  limit  a  person's  or agency's responsibility or authority to report, investigate, or redisclose, child protective and adult protective services information in accordance  with title six of article six and titles one and two of article nine-B of the social services law, or to provide or monitor the provision of child and adult protective or preventive services.   8.  Confidential  HIV  related  information  shall  be recorded in the medical record of the  protected  individual.  The  provisions  of  this section  shall  not  prohibit  the listing of acquired immune deficiency syndrome, HIV related illness or  HIV  infection  in  a  certificate  of death,  autopsy report or related documents prepared pursuant to article forty-one of this chapter or other applicable laws, ordinances, rules or regulations relating to the documentation of cause of death,  nor  shall this  section  be  construed  to  modify  any laws, ordinances, rules or regulations relative to access to death certificates, autopsy reports or such other related documents. Under no circumstances shall  confidential HIV  related  information  be disclosable pursuant to article six of the public officers law. Notwithstanding  the  foregoing,  confidential  HIV information   obtained  pursuant  to  section  390.15  of  the  criminal procedure law or section 347.1 of the family court act by  either  court order  or  consent  of the protected individual shall not be recorded in the medical record of the protected individual unless he or she consents to the recording of such information in a written  statement  containing the  relevant  information  specified  in subdivision two of section two thousand seven hundred eighty-one of this article.   9. Confidential HIV related information shall be  disclosed  upon  the request  of  the  health care worker HIV/HBV advisory panel, established pursuant to article twenty-seven-DD of this chapter, to the panel or its  designee only when reasonably necessary for the evaluation of  a  worker who has voluntarily sought the panel's review.