2023 New York Laws › PBH - Public Health › Article 21 - Control of Acute Communicable Diseases › Title 8 - Novel Coronavirus, Covid-19 › 2181 - Covid-19 Contact Tracing; Confidentiality.

§  2181. COVID-19 contact tracing; confidentiality. 1. (a) All contact
tracing information shall be kept confidential by  any  contact  tracer,
contact  tracing  entity,  or designated non-governmental entity and may
not be disclosed except as necessary to carry out contact tracing  or  a
permitted  purpose. A designated non-governmental entity may only act in
relation to contact tracing information as explicitly authorized by this
title.
(b) Where a contact tracer or contact tracing entity discloses contact
tracing information for a  permitted  purpose,  the  contact  tracer  or
contact  tracing entity shall make a record of the disclosure, including
to whom it was made and when it was made, which shall  be  part  of  the
contact tracing information.
(c)  Nothing  in  this  title  prohibits  otherwise  lawful  voluntary
reporting, at the discretion of the contact tracer,  reasonably  and  in
good  faith:  (i)  to  the statewide central registry under title six of
article six of the social services law, adult protective services  under
titles  one and two of article nine-B of the social services law, or the
justice center for the protection of people  with  special  needs  under
article  eleven of the social services law; or (ii) to a governmental or
non-governmental emergency reporting system (such as a  "911,"  domestic
violence  or  suicide  prevention  system)  to  prevent imminent risk of
injury to any person.
(d) This title does not limit disclosure to or by,  or  possession  or
use  by, the case individual or contact individual who is the subject of
the information.
2. (a) An individual may waive the  confidentiality  provided  for  by
this section, only by a written, informed and voluntary waiver, in plain
language  and  in a language understandable to the individual making the
waiver, and not part of any other document. The waiver shall  state  the
scope and limit of the waiver. No contact tracer, contact tracing entity
or  governmental  or non-governmental entity may seek or act in reliance
on a waiver to distribute, sell, or otherwise disclose  identifiable  or
de-identified  data  to  any  individual  or  entity.  Provided however,
nothing in this subdivision shall prohibit  distribution  or  disclosure
that   is  otherwise  explicitly  authorized  by  this  section.  If  an
individual lacks the capacity to make a waiver, an individual authorized
to consent to health care for the individual, or the individual's  legal
representative,   may   make   the   waiver.   However,   a   waiver  of
confidentiality is not required to be written if it is  solely  for  the
purpose  of arranging or providing support for the individual who is the
subject of the contact tracing  information,  provided  the  consent  is
informed and voluntary.
(b)  A  waiver  of confidentiality under this section shall only apply
for the purpose of arranging or providing support if the individual  who
is the subject of the contact tracing information (or, if the individual
lacks the capacity to provide informed consent, an individual authorized
to  consent to health care for the individual, or the individual's legal
representative) provides voluntary informed consent to the arranging  or
providing of the support.
3.  A  disclosure of contact tracing information authorized under this
section shall be limited in scope as to the identity of any  individual,
the  information  to be disclosed, and the party to which disclosure may
be made, and as necessary to achieve the purpose of the disclosure under
this section, and shall not authorize re-disclosure except as explicitly
authorized by the terms of the waiver under this section. However,  this
section   does   not  bar  disclosure  of  contact  tracing  information
pertaining to and identifying a case individual or contact individual by
the individual who is identified.
4.  (a)  This  section  does  not  bar  otherwise-lawful   disclosure,
possession   or   use  of  de-identified  contact  tracing  information,
including aggregate contact tracing information. Disclosure,  possession
or  use  under  this  subdivision  shall  only be for a public health or
public  health  research  or  evaluation  purpose  as  determined by the
commissioner (or the commissioner of the New  York  city  department  of
health  and  mental  hygiene  in the case of contact tracing information
collected by or under authority of  the  New  York  city  department  of
health  and  mental  hygiene  or  the New York city health and hospitals
corporation), and shall not authorize re-disclosure or other use.
(b) A person or entity may only disclose, possess or use de-identified
contact tracing information if the person or entity, and the  person  or
entity  to  which  it  is  disclosed, maintains technical safeguards and
policies  and  procedures  that   prevent   re-identification,   whether
intentional  or  unintentional, of any individual, as may be required by
the commissioner (or the New York city commissioner of health and mental
hygiene in the case of contact tracing information collected by or under
authority of the New York city department of health and  mental  hygiene
or the New York city health and hospitals corporation). The commissioner
(or  the  New  York  city commissioner as the case may be) shall require
safeguards,  policies  and  procedures  under  this  paragraph  as   the
commissioner deems practicable.
(c)  Disclosure,  possession  and use of de-identified contact tracing
information under this subdivision shall be only pursuant to approval by
the commissioner (or the New York city commissioner of health and mental
hygiene in the case of contact tracing information collected by or under
authority of the New York city department of health and  mental  hygiene
or  the  New  York city health and hospitals corporation) specifying the
purpose, nature and scope of the  disclosure,  possession  and  use  and
measures  to  ensure that it will comply with this section and the terms
of the approval.
5. No law enforcement agent or entity or immigration  authority  shall
be  a  contact  tracer  or  contact  tracing entity or engage in contact
tracing.  This subdivision does not bar an individual who is  associated
with  a law enforcement entity or immigration authority from acting only
as a case individual or contact individual. This  subdivision  does  not
prevent  a law enforcement agent or entity from assisting in a permitted
use under paragraph (b) of  subdivision  eleven  of  section  twenty-one
hundred eighty of this title.
6.   No   contact   tracer,   contact  tracing  entity  or  designated
non-governmental entity may provide contact tracing information to a law
enforcement agent, entity or immigration authority, or any individual or
entity other than the contact tracing entity from which it received  the
information,  except  as  explicitly  authorized  by this title. Without
consent  under  subdivision  two  of  this  section,   contact   tracing
information  and  any evidence derived therefrom shall not be subject to
or provided in response to any legal process or be  admissible  for  any
purpose in any judicial or administrative action or proceeding. However,
this  subdivision does not restrict providing information, relating to a
specified case individual or contact individual, where and only  to  the
extent necessary for a permitted purpose.
7.   (a)   Contact   tracing   entities  shall  establish  appropriate
administrative,  technical  and  physical   safeguards,   policies   and
procedures that ensure the security of contact tracing information under
the  entity's jurisdiction. The safeguards, policies and procedures must
ensure contact tracing information is encrypted and protected  at  least
as  much  as  or  more  than  other  confidential  information under the
entity's jurisdiction. All storage of contact tracing information  shall

meet  the  requirements of this title. The commissioner (or the New York
city commissioner of health and mental hygiene in the  case  of  contact
tracing information collected by or under authority of the New York city
department  of health and mental hygiene or the New York city health and
hospitals corporation) shall make regulations as reasonably necessary to
require that contact tracing information possessed, used  or  under  the
control  of  a contact tracer or contact tracing entity shall be subject
to  technical  safeguards,  policies   and   procedures   for   storage,
transmission,  use  and  protection  of the information. The regulations
shall prevent possession, use  or  disclosure  of  the  contact  tracing
information  not  permitted  by  this title, and shall be at least as or
more  protective  than  the  safeguards,  policies  and  procedures  the
commissioner  (or  the  New  York  city commissioner as the case may be)
provides for other confidential information.
(b) This paragraph applies to a  contact  tracer  or  contact  tracing
entity  that  is  a non-governmental individual or entity employed by or
under contract with a governmental entity, or an agent  thereof.  Within
sixty  days  of collecting or receiving the contact tracing information,
the entity shall (i) remove information from its possession  or  control
and deliver it to the appropriate governmental contact tracing entity or
a  designated  non-governmental  entity  specified  by  the governmental
contact tracing entity, retaining  no  copy  of  it;  (ii)  expunge  the
information  from  its  possession  or control; or (iii) de-identify the
information.    However,  the  expungement   or   de-identification   of
particular  contact  tracing  information  may  be  postponed  for up to
fifteen days after the initial sixty day period while the contact tracer
or contact tracing entity is actively engaged in contact  tracing  using
that   information,   provided  that  the  case  individual  or  contact
individual to whom it pertains gives  voluntary  informed  consent.  The
disclosure,  possession  and  use  of  the de-identified contact tracing
information shall be subject to subdivision four of this section.