2023 New York Laws › PBH - Public Health › Article 21 - Control of Acute Communicable Diseases › Title 6 - Poliomyelitis and Other Diseases › 2169 - Vaccine Confidentiality.

§  2169.  Vaccine  confidentiality. 1. As used in this section, unless
context requires otherwise:
(a) The term "consent" shall mean informed, affirmative, and voluntary
authorization.
(b) The term "de-identified" shall mean that  the  information  cannot
identify  or  be  made  to  identify  or be associated with a particular
individual,  directly  or  indirectly,  and  is  subject  to   technical
safeguards  and  policies and procedures that prevent re-identification,
whether intentionally or unintentionally, of any individual.
(c) The term "disclosure" shall mean release, transfer, provision  of,
access  to,  or divulging in any other manner of information outside the
entity holding the information.
(d) The  term  "immigration  authority"  means  any  entity,  officer,
employee,  or  government  employee  or  agent  thereof  charged with or
engaged in enforcement of the federal Immigration and  Nationality  Act,
including  the United States Immigration and Customs Enforcement, United
States Department of Homeland Security, or  United  States  Customs  and
Border  Protection,  or  agent,  contractor, or employee thereof, or any
successor legislation or entity.
(e) The term "law enforcement agent or entity" means any  governmental
entity  or  public  servant,  or  agent, contractor or employee thereof,
authorized to investigate, prosecute, or make an arrest for  a  criminal
or  civil  offense,  or engaged in any such activity, but shall not mean
the department, the commissioner, a health district, a county department
of health, a county health commissioner, a  local  board  of  health,  a
local health officer, the department of health and mental hygiene of the
city  of  New  York, or the commissioner of the department of health and
mental hygiene of the city of New York.
(f) The term "personal information" shall  mean  information  obtained
from  or about an individual, in connection with their registering for a
vaccination,  that  directly  or  indirectly  identifies,  relates   to,
describes,  is  capable of being associated with, or could reasonably be
linked to  a  particular  individual,  household,  or  personal  device.
Information  is  reasonably  linkable  to  an  individual, household, or
personal device if it can be used on its  own  or  in  combination  with
other reasonably available information, when such information is held by
the  vaccine  navigator,  to  identify  an  individual,  household, or a
personal device.
(g) The term "service attendant to the delivery of immunization" shall
mean facilitating an immunization appointment, sending  reminders  about
immunization, arranging transportation to or from a vaccine provider, or
reporting  to the department, the New York City department of health and
mental hygiene, or other  local  health  agency  on  whose  behalf  such
vaccine navigator is performing such services.
(h)  The  term "use" shall mean, with respect to personal information,
the  sharing,  employment,  application,  utilization,  examination   or
analysis  of  such  information  within  an  entity  that maintains such
information.
(i) The term "vaccine navigator" shall mean any person  that  collects
personal  information  from  an  individual  in  order  to register that
individual for immunization or to  help  that  individual  register  for
immunization,  provided the department, a local public health agency, or
a person that administers vaccines or their designees  are  not  vaccine
navigators.
2. (a) Except as provided in paragraph (d) of this subdivision, absent
consent  from  the individual seeking immunization, or if the individual
lacks  the  capacity  to  make  health  care  decisions,  an  individual
authorized  to  consent  to  health  care  for  the  individual  or  the

individual's legal representative, a vaccine navigator  shall  not  use,
disclose,  or  maintain  personal  information  except  as  necessary to
provide services attendant to the delivery of immunization.
(b)  A vaccine navigator may request consent from an individual, or if
the individual lacks the capacity to  make  health  care  decisions,  an
individual  authorized  to  consent to health care for the individual or
the individual's legal representative, to use, disclose, or maintain the
individual's personal  information  for  purposes  other  than  services
attendant to the delivery of immunization provided that:
(i)  a  vaccine  navigator  shall  not  refuse  to  provide  a service
attendant to the delivery of immunization for an individual who does not
provide such consent;
(ii) a vaccine navigator shall not relate the price or quality of  any
service  attendant  to  the  delivery  of  immunization  to  the privacy
protections afforded the individual, including by providing  a  discount
or  other  incentive  in  exchange  for such consent, provided that this
paragraph does not prohibit the offering of incentives to individuals to
get vaccinated; provided that such incentives shall not  be  conditioned
on   an   individual's  consent  to  additional  uses,  disclosures,  or
maintenance of their personal information except as necessary to provide
the incentive; and
(iii) a  vaccine  navigator  shall  clearly  delineate  what  personal
information  is  adequate,  relevant, and necessary to provide a service
attendant to the delivery of immunization by clearly  and  conspicuously
indicating  in  any  solicitation  for  the  information  that all other
requests for personal information are optional.
(c) Except as provided in paragraph (d) of this subdivision:
(i) No vaccine navigator may provide personal information or otherwise
make personal information accessible, directly or indirectly, to  a  law
enforcement agent or entity or immigration authority;
(ii)   No  vaccine  navigator  may  provide  personal  information  or
otherwise make personal information accessible, directly or  indirectly,
to  any  other  individual or entity, except as explicitly authorized by
this title; and
(iii) Without consent under this subdivision, personal information and
any evidence derived therefrom shall not be subject to  or  provided  in
response  to  any  legal process or be admissible for any purpose in any
judicial or administrative  action  or  proceeding  unless  provided  in
response  pursuant  to warrants, court-ordered subpoenas, administrative
subpoenas, or grand jury subpoenas.
(d) (i)  This  section  does  not  bar  otherwise  lawful  disclosure,
possession or use of information pertaining to services attendant to the
delivery  of  immunization,  including  aggregate  information,  that is
de-identified. Disclosure, possession or  use  under  this  subparagraph
shall only be for a public health or public health research purposes.
(ii)  A  vaccine  navigator  may  only  possess  or  use de-identified
information  pertaining  to  services  attendant  to  the  delivery   of
immunization if the vaccine navigator maintains technical safeguards and
policies   and   procedures   that  prevent  re-identification,  whether
intentional or unintentional, of any individual, as may be  required  by
the commissioner (or the New York city commissioner of health and mental
hygiene,  in  the case of information collected by or under authority of
the  New  York  city  department  of  health  and  mental  hygiene.  The
commissioner  (or  the  New  York  city commissioner as the case may be)
shall require safeguards, policies and procedures under  this  paragraph
as the commissioner deems practicable.
(iii)  Disclosure,  possession  and  use  of de-identified information
under this subdivision  shall  be  only  pursuant  to  approval  by  the

commissioner  (or  the  New  York city commissioner of health and mental
hygiene in the case of information collected by or  under  authority  of
the  New  York  city department of health and mental hygiene) specifying
the  purpose, nature and scope of the disclosure, possession and use and
measures to ensure that it will comply with this section and  the  terms
of the approval.
(e)  A  vaccine  navigator  that  maintains personal information shall
establish   appropriate   administrative,   technical,   and    physical
safeguards,  policies,  and  procedures that ensure the security of that
personal information. The safeguards, policies, and procedures  must  be
appropriate  to  the  volume  and  nature  of  the  personal information
maintained and the size, revenue,  and  sophistication  of  the  vaccine
navigator  and  must  ensure  that personal information is encrypted and
protected  at  least  as  much  as  or  more  than  other   confidential
information  in the vaccine navigator's possession. The commissioner or,
in the city of New York, the commissioner of the  department  of  health
and  mental  hygiene  may  make  regulations  as reasonably necessary to
require that personal information possessed, used, or under the  control
of  a  vaccine  navigator  shall  be  subject  to  technical safeguards,
policies, and procedures for storage, transmission, use, and  protection
of the information. The regulations must take into account the different
sizes,  revenues and sophistications of different vaccine navigators, as
well as the volume and nature of the personal information they maintain.
(f) Nothing in this section shall limit a vaccine navigator that has a
pre-existing  service  provider-client,  provider-patient,  or  familial
relationship  or  a  friendship  with an individual from processing that
individual's personal information as previously agreed to in the  course
of the pre-existing relationship.
3.  Vaccine providers. A vaccine provider shall not delay or condition
the provision of any service attendant to the delivery  of  immunization
by  inviting  or requiring an individual seeking vaccination to complete
an application for a customer discount card or account or share personal
information that will be stored outside of a record protected under  the
federal Health Insurance Portability and Accountability Act of 1996, its
implementing  regulations,  or  section  eighteen  of  this  chapter for
purposes other than services attendant to the delivery of  immunization,
or  by engaging in any other activity unrelated to the provision of such
a service that the commissioner designates by regulation.