2023 New York Laws › PBH - Public Health › Article 27-F - HIV and AIDS Related Information › 2782 - Confidentiality and Disclosure.

§  2782.  Confidentiality  and  disclosure.  1.  No person who obtains
confidential HIV related information in  the  course  of  providing  any
health  or  social  service or pursuant to a release of confidential HIV
related information may  disclose  or  be  compelled  to  disclose  such
information, except to the following:
(a)  the  protected individual or, when the protected individual lacks
capacity to consent, a person authorized pursuant to law to  consent  to
health care for the individual;
(b)  any person to whom disclosure is authorized pursuant to a release
of confidential HIV related information;
(c) an agent or employee of a health facility or health care  provider
if (1) the agent or employee is permitted to access medical records, (2)
the  health  facility  or  health  care provider itself is authorized to
obtain the HIV related  information,  and  (3)  the  agent  or  employee
provides  health  care  to  the  protected  individual,  or maintains or
processes medical records for billing or reimbursement;
(d) a health care provider or health facility when  knowledge  of  the
HIV  related  information  is  necessary  to provide appropriate care or
treatment to the protected individual, a  child  of  the  individual,  a
contact of the protected individual or a person authorized to consent to
health care for such a contact;
(e)  a  health  facility  or  health care provider, in relation to the
procurement, processing, distributing or use of a human body or a  human
body  part,  including  organs,  tissues,  eyes, bones, arteries, blood,
semen, or other body fluids, for use  in  medical  education,  research,
therapy, or for transplantation to individuals;
(f)  health  facility  staff  committees or accreditation or oversight
review organizations authorized to access medical records; provided that
such committees or organizations  may  only  disclose  confidential  HIV
related information: (1) back to the facility or provider of a health or
social  service; (2) to carry out the monitoring, evaluation, or service
review for which it was obtained; or (3) to a federal,  state  or  local
government  agency  for  the  purposes  of and subject to the conditions
provided in subdivision six of this section;
(g) a federal,  state,  county  or  local  health  officer  when  such
disclosure is mandated by federal or state law;
(h) an authorized agency in connection with foster care or adoption of
a  child. Such agency shall be authorized to redisclose such information
only pursuant to this article or in accordance with  the  provisions  of
subdivision eight of section three hundred seventy-two and section three
hundred seventy-three-a of the social services law;
(i) third party reimbursers or their agents to the extent necessary to
reimburse  health  care  providers  for  health services; provided that,
where  necessary,  an  otherwise  appropriate  authorization  for   such
disclosure has been secured by the provider;
(j)  an insurance institution, for other than the purpose set forth in
paragraph (i) of this subdivision, provided  the  insurance  institution
secures  a  dated  and  written authorization that indicates that health
care providers, health facilities,  insurance  institutions,  and  other
persons  are  authorized  to  disclose  information  about the protected
individual, the nature of the information to be disclosed, the  purposes
for which the information is to be disclosed and which is signed by: (1)
the  protected  individual;  (2)  if  the protected individual lacks the
capacity to consent, such other person authorized  pursuant  to  law  to
consent  for  such  individual;  or  (3)  if the protected individual is
deceased, the beneficiary or claimant for benefits  under  an  insurance
policy,  a  health services plan, or an employee welfare benefit plan as
defined in 29 U.S.C. 1002(1), covering such protected individual;
(k) any person to whom disclosure is ordered by a court  of  competent
jurisdiction  pursuant  to  section  twenty-seven hundred eighty-five of
this article;
(l)  an  employee  or  agent  of  the  department  of  corrections and
community supervision, in accordance with paragraph (a)  of  subdivision
two  of  section twenty-seven hundred eighty-six of this article, to the
extent the employee or agent is authorized to access records  containing
such  information  in  order  to  carry  out the department's functions,
powers and duties with respect to the protected individual, pursuant  to
section two hundred fifty-nine-a of the executive law;
(m)  an  employee or agent of the office of probation and correctional
alternatives or any  local  probation  department,  in  accordance  with
paragraph  (a)  of  subdivision  two  of  section  twenty-seven  hundred
eighty-six of this article, to the  extent  the  employee  or  agent  is
authorized  to  access  records  containing such information in order to
carry out the office's or department's functions, powers and duties with
respect to the protected individual, pursuant  to  articles  twelve  and
twelve-A of the executive law;
(n)  a medical director of a local correctional facility as defined in
section forty of the correction law, in accordance with paragraph (a) of
subdivision two of  section  twenty-seven  hundred  eighty-six  of  this
article,  to  the  extent  the  medical director is authorized to access
records containing such information in order to carry  out  his  or  her
functions, powers and duties with respect to the protected individual;
(o)  an  employee  or  agent  of  the  commission  of  correction,  in
accordance with paragraph (a) of subdivision two of section twenty-seven
hundred eighty-six of this article, to the extent the employee or  agent
is  authorized to access records containing such information in order to
carry out the commission's functions, powers and duties with respect  to
the  protected  individual,  pursuant to article three of the correction
law;
(p) an attorney appointed to represent a minor pursuant to the  social
services  law  or the family court act, with respect to confidential HIV
related information relating  to  the  minor  and  for  the  purpose  of
representing  the  minor.  If the minor has the capacity to consent, the
minor's attorney may not redisclose confidential HIV related information
without the minor's permission. If the minor lacks capacity to  consent,
the minor's attorney may redisclose confidential HIV related information
for the sole purpose of representing the minor. This paragraph shall not
limit  the  ability of the minor's attorney to seek relief under section
twenty-seven hundred eighty-five of this chapter.
(q) an executor or an administrator of an estate shall have access  to
the  confidential  HIV  information  of  a  deceased person as needed to
fulfill  his  or  her  responsibilities/duties   as   an   executor   or
administrator.
(r)  qualified  researchers  for  medical  research  purposes upon the
approval of a research protocol by a  human  research  review  committee
established  and  approved under the provisions of article twenty-four-A
of this chapter or by an  institutional  review  board  established  and
approved  under  the provisions of 45 CFR part 46 or 42 USC 300 V-1, for
the  purpose  of  reviewing  and  monitoring  research  involving  human
subjects,  provided  that  in  no  event  shall any qualified researcher
disclose information tending to identify the subjects of the research.
(s) an employee or agent of the board of correction of the city of New
York, in accordance with paragraph (a) of  subdivision  two  of  section
twenty-seven  hundred  eighty-six  of  this  article,  to the extent the
employee or agent  is  authorized  to  access  records  containing  such
information  in  order  to  carry  out the board's functions, powers and

duties with respect to the protected individual, pursuant to the charter
of the city of New York.
2.  A  state, county or local health officer may disclose confidential
HIV related information when:
(a) disclosure is specifically authorized or required  by  federal  or
state law; or
(b)  disclosure  is  made  pursuant  to  a release of confidential HIV
related information; or
(c) disclosure is requested by a  physician  pursuant  to  subdivision
four of this section; or
(d) disclosure is authorized by court order pursuant to the provisions
of section twenty-seven hundred eighty-five of this article.
3.  No  person  to  whom confidential HIV related information has been
disclosed pursuant to this article shall  disclose  the  information  to
another  person except as authorized by this article, provided, however,
that the provisions of this subdivision shall not apply:
(a) to the protected individual; or
(b) to a natural person who is authorized pursuant to law  to  consent
to health care for the protected individual; or
(c)  to  a  protected individual's foster parent as defined in section
three hundred seventy-one of the social  services  law  and  subject  to
regulations  promulgated pursuant to paragraph (a) of subdivision two of
section twenty-seven hundred eighty-six of this article, for the purpose
of providing care, treatment or supervision of the protected individual;
or
(d) a prospective  adoptive  parent  as  specified  in  section  three
hundred  seventy-three-a  of  the  social  services  law  and subject to
regulations promulgated pursuant to paragraph (a) of subdivision two  of
section  twenty-seven  hundred  eighty-six  of  this article with whom a
child who is the protected individual has been placed for adoption; or
(e) to a relative or other person legally responsible to whom a  child
who  is  the protected individual is to be placed or discharged pursuant
to section ten hundred seventeen or ten hundred fifty-five of the family
court act and subject to regulations promulgated pursuant  to  paragraph
(a)  of  subdivision  two  of section twenty-seven hundred eighty-six of
this  article,  for  the  purpose  of  providing  care,   treatment   or
supervision of the protected individual.
4.  (a)  A physician may disclose confidential HIV related information
under the following conditions:
(1) disclosure is made to a contact, to a public  health  officer  for
the  purpose  of  making  the disclosure to said contact and pursuant to
section twenty-one hundred thirty of this chapter; or
(2) the physician believes disclosure  is  medically  appropriate  and
there is a significant risk of infection to the contact; and
(3) the physician has counseled the protected individual regarding the
need to notify the contact; and
(4)  the physician has informed the protected individual of his or her
intent  to  make  such  disclosure  to  a   contact,   the   physician's
responsibility  to  report  the  infected  individual's case pursuant to
section twenty-one hundred thirty of this  chapter  and  has  given  the
protected  individual  the  opportunity  to  express  a preference as to
whether disclosure should be made by the  physician  directly  or  to  a
public  health  officer  for  the  purpose  of  said  disclosure. If the
protected individual expresses a preference for disclosure by  a  public
health officer, the physician shall honor such preference.
(5)  If  a  physician  chooses to make a notification pursuant to this
section, he or she shall report to the municipal health commissioner  of
district  health officer on his or her efforts to notify the contacts of

the protected individual. Such report shall be in a manner and on  forms
prescribed  by  the  commissioner  and shall include the identity of the
protected individual and any contacts  as  well  as  information  as  to
whether the contacts were successfully notified.
(6) Within a reasonable time of receiving a report that a physician or
his  or  her  designated  agent did not notify or verify notification of
contacts provided by the protected individual, the  health  commissioner
or  district  health  officer  of the municipality from which the report
originates shall take reasonable measures to notify  such  contacts  and
otherwise comply with the provisions of this chapter.
(b)  When  making  such  disclosures  to the contact, the physician or
public health officer shall provide or make referrals for the  provision
of  the  appropriate  medical  advice and counseling for coping with the
emotional consequences of learning  the  information  and  for  changing
behavior  to  prevent  transmission or contraction of HIV infection. The
physician or public health officer shall not disclose  the  identity  of
the  protected  individual  or  the  identity  of  any  other contact. A
physician or public health officer making  a  notification  pursuant  to
this  subdivision  shall  make  such  disclosure in person, except where
circumstances reasonably prevent doing so.
(c) A physician or public health officer shall have no  obligation  to
identify  or  locate  any  contact  except as provided pursuant to title
three of article twenty-one of this chapter.
(d) A physician may,  upon  the  consent  of  a  parent  or  guardian,
disclose  confidential  HIV  related  information to a state, county, or
local health officer for the purpose of reviewing the medical history of
a child to determine the fitness of the child to attend school.
(e) A physician may  disclose  confidential  HIV  related  information
pertaining  to  a  protected  individual  to  a  person  (known  to  the
physician) authorized pursuant to law to consent to health  care  for  a
protected  individual  when  the physician reasonably believes that: (1)
disclosure is medically necessary in order to provide  timely  care  and
treatment  for  the  protected  individual;  and  (2)  after appropriate
counseling as to the need for such disclosure, the protected  individual
will  not  inform  a person authorized by law to consent to health care;
provided, however, that the physician shall not make such disclosure if,
in the judgment of the physician: (A) the disclosure would not be in the
best  interest  of  the  protected  individual;  or  (B)  the  protected
individual  is  authorized  pursuant  to law to consent to such care and
treatment. Any decision or action by a physician under  this  paragraph,
and  the basis therefor, shall be recorded in the protected individual's
medical record.
5.  (a) Whenever disclosure of confidential HIV related information is
made pursuant to this article, except for disclosures made  pursuant  to
paragraphs  (a),  (d)  and  (i)  of  subdivision  one of this section or
paragraph  (a)  or  (e)  of  subdivision  four  of  this  section,  such
disclosure  shall  be  accompanied or followed by a statement in writing
which includes the following or substantially  similar  language:  "This
information  has  been  disclosed to you from confidential records which
are protected by state law. State law  prohibits  you  from  making  any
further  disclosure  of  this  information  without the specific written
consent of the person to whom it pertains, or as otherwise permitted  by
law.  Any  unauthorized further disclosure in violation of state law may
result in a fine or jail sentence or both. A general  authorization  for
the   release   of  medical  or  other  information  is  NOT  sufficient
authorization for further  disclosure."  An  oral  disclosure  shall  be
accompanied or followed by such a notice within ten days.
(b)   Except  for  disclosures  made  pursuant  to  paragraph  (c)  of
subdivision one of this section, or to persons reviewing information  or
records  in the ordinary course of ensuring that a health facility is in
compliance with applicable  quality  of  care  standards  or  any  other
authorized  program evaluation, program monitoring or service review, or
to governmental agents requiring information necessary for  payments  to
be  made  on  behalf  of  patients or clients pursuant to contract or in
accordance to law, a notation of all such disclosures shall be placed in
the medical record of a protected individual, who shall be  informed  of
such  disclosures  upon request; provided, however, that for disclosures
made to insurance institutions such a notation need only be  entered  at
the time the disclosure is first made.
6. (a) The provisions of this subdivision shall apply where a provider
of  a  health  or  social  service  possesses  confidential  HIV related
information relating to individuals who are recipients of  the  service,
and  a  federal, state or local government agency supervises or monitors
the provider or administers the  program  under  which  the  service  is
provided.
(b)  Confidential  HIV  related information relating to a recipient of
such service may be disclosed in accordance with regulations promulgated
pursuant to paragraph (a) of subdivision  two  of  section  twenty-seven
hundred eighty-six of this article to an authorized employee or agent of
such  provider  or government agency, when reasonably necessary for such
supervision, monitoring, administration, or provision of  such  service.
The  term  "authorized  employee  or agent", as used in this subdivision
shall only include any employee or agent  who  would,  in  the  ordinary
course  of business of the provider or government agency, have access to
records relating to the care of, treatment of, or provision of a  health
or social service to the protected individual.
7.  Nothing  in  this  section  shall  limit  a  person's  or agency's
responsibility or authority to report, investigate, or redisclose, child
protective and adult protective services information in accordance  with
title six of article six and titles one and two of article nine-B of the
social services law, or to provide or monitor the provision of child and
adult protective or preventive services.
8.  Confidential  HIV  related  information  shall  be recorded in the
medical record of the  protected  individual.  The  provisions  of  this
section  shall  not  prohibit  the listing of acquired immune deficiency
syndrome, HIV related illness or  HIV  infection  in  a  certificate  of
death,  autopsy report or related documents prepared pursuant to article
forty-one of this chapter or other applicable laws, ordinances, rules or
regulations relating to the documentation of cause of death,  nor  shall
this  section  be  construed  to  modify  any laws, ordinances, rules or
regulations relative to access to death certificates, autopsy reports or
such other related documents. Under no circumstances shall  confidential
HIV  related  information  be disclosable pursuant to article six of the
public officers law. Notwithstanding  the  foregoing,  confidential  HIV
information   obtained  pursuant  to  section  390.15  of  the  criminal
procedure law or section 347.1 of the family court act by  either  court
order  or  consent  of the protected individual shall not be recorded in
the medical record of the protected individual unless he or she consents
to the recording of such information in a written  statement  containing
the  relevant  information  specified  in subdivision two of section two
thousand seven hundred eighty-one of this article.
9. Confidential HIV related information shall be  disclosed  upon  the
request  of  the  health care worker HIV/HBV advisory panel, established
pursuant to article twenty-seven-DD of this chapter, to the panel or its

designee only when reasonably necessary for the evaluation of  a  worker
who has voluntarily sought the panel's review.