2013 New York Consolidated Laws
PBH - Public Health
Article 27-F - (2780 - 2787) HIV AND AIDS RELATED INFORMATION
2782 - Confidentiality and disclosure.

 
    §  2782.  Confidentiality  and  disclosure.  1.  No person who obtains
  confidential HIV related information in  the  course  of  providing  any
  health  or  social  service or pursuant to a release of confidential HIV
  related information may  disclose  or  be  compelled  to  disclose  such
  information, except to the following:
    (a)  the  protected individual or, when the protected individual lacks
  capacity to consent, a person authorized pursuant to law to  consent  to
  health care for the individual;
    (b)  any person to whom disclosure is authorized pursuant to a release
  of confidential HIV related information;
    (c) an agent or employee of a health facility or health care  provider
  if (1) the agent or employee is permitted to access medical records, (2)
  the  health  facility  or  health  care provider itself is authorized to
  obtain the HIV related  information,  and  (3)  the  agent  or  employee
  provides  health  care  to  the  protected  individual,  or maintains or
  processes medical records for billing or reimbursement;
    (d) a health care provider or health facility when  knowledge  of  the
  HIV  related  information  is  necessary  to provide appropriate care or
  treatment to the protected individual, a  child  of  the  individual,  a
  contact of the protected individual or a person authorized to consent to
  health care for such a contact;
    (e)  a  health  facility  or  health care provider, in relation to the
  procurement, processing, distributing or use of a human body or a  human
  body  part,  including  organs,  tissues,  eyes, bones, arteries, blood,
  semen, or other body fluids, for use  in  medical  education,  research,
  therapy, or for transplantation to individuals;
    (f)  health  facility  staff  committees or accreditation or oversight
  review organizations authorized to access medical records; provided that
  such committees or organizations  may  only  disclose  confidential  HIV
  related information: (1) back to the facility or provider of a health or
  social  service; (2) to carry out the monitoring, evaluation, or service
  review for which it was obtained; or (3) to a federal,  state  or  local
  government  agency  for  the  purposes  of and subject to the conditions
  provided in subdivision six of this section;
    (g) a federal,  state,  county  or  local  health  officer  when  such
  disclosure is mandated by federal or state law;
    (h) an authorized agency in connection with foster care or adoption of
  a  child. Such agency shall be authorized to redisclose such information
  only pursuant to this article or in accordance with  the  provisions  of
  subdivision eight of section three hundred seventy-two and section three
  hundred seventy-three-a of the social services law;
    (i) third party reimbursers or their agents to the extent necessary to
  reimburse  health  care  providers  for  health services; provided that,
  where  necessary,  an  otherwise  appropriate  authorization  for   such
  disclosure has been secured by the provider;
    (j)  an insurance institution, for other than the purpose set forth in
  paragraph (i) of this subdivision, provided  the  insurance  institution
  secures  a  dated  and  written authorization that indicates that health
  care providers, health facilities,  insurance  institutions,  and  other
  persons  are  authorized  to  disclose  information  about the protected
  individual, the nature of the information to be disclosed, the  purposes
  for which the information is to be disclosed and which is signed by: (1)
  the  protected  individual;  (2)  if  the protected individual lacks the
  capacity to consent, such other person authorized  pursuant  to  law  to
  consent  for  such  individual;  or  (3)  if the protected individual is
  deceased, the beneficiary or claimant for benefits  under  an  insurance
  policy,  a  health services plan, or an employee welfare benefit plan as
  defined in 29 U.S.C. 1002(1), covering such protected individual;

    (k) any person to whom disclosure is ordered by a court  of  competent
  jurisdiction  pursuant  to  section  twenty-seven hundred eighty-five of
  this article;
    (l)  an  employee  or  agent  of  the  department  of  corrections and
  community supervision, in accordance with paragraph (a)  of  subdivision
  two  of  section twenty-seven hundred eighty-six of this article, to the
  extent the employee or agent is authorized to access records  containing
  such  information  in  order  to  carry  out the department's functions,
  powers and duties with respect to the protected individual, pursuant  to
  section two hundred fifty-nine-a of the executive law;
    (m)  an  employee or agent of the office of probation and correctional
  alternatives or any  local  probation  department,  in  accordance  with
  paragraph  (a)  of  subdivision  two  of  section  twenty-seven  hundred
  eighty-six of this article, to the  extent  the  employee  or  agent  is
  authorized  to  access  records  containing such information in order to
  carry out the office's or department's functions, powers and duties with
  respect to the protected individual, pursuant  to  articles  twelve  and
  twelve-A of the executive law;
    (n)  a medical director of a local correctional facility as defined in
  section forty of the correction law, in accordance with paragraph (a) of
  subdivision two of  section  twenty-seven  hundred  eighty-six  of  this
  article,  to  the  extent  the  medical director is authorized to access
  records containing such information in order to carry  out  his  or  her
  functions,  powers  and duties with respect to the protected individual;
  or
    (o)  an  employee  or  agent  of  the  commission  of  correction,  in
  accordance with paragraph (a) of subdivision two of section twenty-seven
  hundred  eighty-six of this article, to the extent the employee or agent
  is authorized to access records containing such information in order  to
  carry  out the commission's functions, powers and duties with respect to
  the protected individual, pursuant to article three  of  the  correction
  law.
    (p)  an attorney appointed to represent a minor pursuant to the social
  services law or the family court act, with respect to  confidential  HIV
  related  information  relating  to  the  minor  and  for  the purpose of
  representing the minor. If the minor has the capacity  to  consent,  the
  minor's attorney may not redisclose confidential HIV related information
  without  the minor's permission. If the minor lacks capacity to consent,
  the minor's attorney may redisclose confidential HIV related information
  for the sole purpose of representing the minor. This paragraph shall not
  limit the ability of the minor's attorney to seek relief  under  section
  twenty-seven hundred eighty-five of this chapter.
    (q)  an executor or an administrator of an estate shall have access to
  the confidential HIV information of  a  deceased  person  as  needed  to
  fulfill   his   or   her   responsibilities/duties  as  an  executor  or
  administrator.
    2. A state, county or local health officer may  disclose  confidential
  HIV related information when:
    (a)  disclosure  is  specifically authorized or required by federal or
  state law; or
    (b) disclosure is made pursuant  to  a  release  of  confidential  HIV
  related information; or
    (c)  disclosure  is  requested  by a physician pursuant to subdivision
  four of this section; or
    (d) disclosure is authorized by court order pursuant to the provisions
  of section twenty-seven hundred eighty-five of this article.
    3. No person to whom confidential HIV  related  information  has  been
  disclosed  pursuant  to  this  article shall disclose the information to

  another person except as authorized by this article, provided,  however,
  that the provisions of this subdivision shall not apply:
    (a) to the protected individual; or
    (b)  to  a natural person who is authorized pursuant to law to consent
  to health care for the protected individual; or
    (c) to a protected individual's foster parent as  defined  in  section
  three  hundred  seventy-one  of  the  social services law and subject to
  regulations promulgated pursuant to paragraph (a) of subdivision two  of
  section twenty-seven hundred eighty-six of this article, for the purpose
  of providing care, treatment or supervision of the protected individual;
  or
    (d)  a  prospective  adoptive  parent  as  specified  in section three
  hundred seventy-three-a of  the  social  services  law  and  subject  to
  regulations  promulgated pursuant to paragraph (a) of subdivision two of
  section twenty-seven hundred eighty-six of  this  article  with  whom  a
  child who is the protected individual has been placed for adoption; or
    (e)  to a relative or other person legally responsible to whom a child
  who is the protected individual is to be placed or  discharged  pursuant
  to section ten hundred seventeen or ten hundred fifty-five of the family
  court  act  and subject to regulations promulgated pursuant to paragraph
  (a) of subdivision two of section  twenty-seven  hundred  eighty-six  of
  this   article,   for  the  purpose  of  providing  care,  treatment  or
  supervision of the protected individual.
    4. (a) A physician may disclose confidential HIV  related  information
  under the following conditions:
    (1)  disclosure  is  made to a contact, to a public health officer for
  the purpose of making the disclosure to said  contact  and  pursuant  to
  section twenty-one hundred thirty of this chapter; or
    (2)  the  physician  believes  disclosure is medically appropriate and
  there is a significant risk of infection to the contact; and
    (3) the physician has counseled the protected individual regarding the
  need to notify the contact; and
    (4) the physician has informed the protected individual of his or  her
  intent   to   make   such  disclosure  to  a  contact,  the  physician's
  responsibility to report the  infected  individual's  case  pursuant  to
  section  twenty-one  hundred  thirty  of  this chapter and has given the
  protected individual the opportunity  to  express  a  preference  as  to
  whether  disclosure  should  be  made  by the physician directly or to a
  public health officer  for  the  purpose  of  said  disclosure.  If  the
  protected  individual  expresses a preference for disclosure by a public
  health officer, the physician shall honor such preference.
    (5) If a physician chooses to make a  notification  pursuant  to  this
  section,  he or she shall report to the municipal health commissioner of
  district health officer on his or her efforts to notify the contacts  of
  the  protected individual. Such report shall be in a manner and on forms
  prescribed by the commissioner and shall include  the  identity  of  the
  protected  individual  and  any  contacts  as  well as information as to
  whether the contacts were successfully notified.
    (6) Within a reasonable time of receiving a report that a physician or
  his or her designated agent did not notify  or  verify  notification  of
  contacts  provided  by the protected individual, the health commissioner
  or district health officer of the municipality  from  which  the  report
  originates  shall  take  reasonable measures to notify such contacts and
  otherwise comply with the provisions of this chapter.
    (b) When making such disclosures to  the  contact,  the  physician  or
  public  health officer shall provide or make referrals for the provision
  of the appropriate medical advice and counseling  for  coping  with  the
  emotional  consequences  of  learning  the  information and for changing

  behavior to prevent transmission or contraction of  HIV  infection.  The
  physician  or  public  health officer shall not disclose the identity of
  the protected individual  or  the  identity  of  any  other  contact.  A
  physician  or  public  health  officer making a notification pursuant to
  this subdivision shall make such  disclosure  in  person,  except  where
  circumstances reasonably prevent doing so.
    (c)  A  physician or public health officer shall have no obligation to
  identify or locate any contact except  as  provided  pursuant  to  title
  three of article twenty-one of this chapter.
    (d)  A  physician  may,  upon  the  consent  of  a parent or guardian,
  disclose confidential HIV related information to  a  state,  county,  or
  local health officer for the purpose of reviewing the medical history of
  a child to determine the fitness of the child to attend school.
    (e)  A  physician  may  disclose  confidential HIV related information
  pertaining  to  a  protected  individual  to  a  person  (known  to  the
  physician)  authorized  pursuant  to law to consent to health care for a
  protected individual when the physician reasonably  believes  that:  (1)
  disclosure  is  medically  necessary in order to provide timely care and
  treatment for  the  protected  individual;  and  (2)  after  appropriate
  counseling  as to the need for such disclosure, the protected individual
  will not inform a person authorized by law to consent  to  health  care;
  provided, however, that the physician shall not make such disclosure if,
  in the judgment of the physician: (A) the disclosure would not be in the
  best  interest  of  the  protected  individual;  or  (B)  the  protected
  individual is authorized pursuant to law to consent  to  such  care  and
  treatment.  Any  decision or action by a physician under this paragraph,
  and the basis therefor, shall be recorded in the protected  individual's
  medical record.
    5.  (a) Whenever disclosure of confidential HIV related information is
  made  pursuant  to this article, except for disclosures made pursuant to
  paragraphs (a), (d) and (i)  of  subdivision  one  of  this  section  or
  paragraph  (a)  or  (e)  of  subdivision  four  of  this  section,  such
  disclosure shall be accompanied or followed by a  statement  in  writing
  which  includes  the  following or substantially similar language: "This
  information has been disclosed to you from  confidential  records  which
  are  protected  by  state  law.  State law prohibits you from making any
  further disclosure of this  information  without  the  specific  written
  consent  of the person to whom it pertains, or as otherwise permitted by
  law. Any unauthorized further disclosure in violation of state  law  may
  result  in  a fine or jail sentence or both. A general authorization for
  the  release  of  medical  or  other  information  is   NOT   sufficient
  authorization  for  further  disclosure."  An  oral  disclosure shall be
  accompanied or followed by such a notice within ten days.
    (b)  Except  for  disclosures  made  pursuant  to  paragraph  (c)   of
  subdivision  one of this section, or to persons reviewing information or
  records in the ordinary course of ensuring that a health facility is  in
  compliance  with  applicable  quality  of  care  standards  or any other
  authorized program evaluation, program monitoring or service review,  or
  to  governmental  agents requiring information necessary for payments to
  be made on behalf of patients or clients  pursuant  to  contract  or  in
  accordance to law, a notation of all such disclosures shall be placed in
  the  medical  record of a protected individual, who shall be informed of
  such disclosures upon request; provided, however, that  for  disclosures
  made  to  insurance institutions such a notation need only be entered at
  the time the disclosure is first made.
    6. (a) The provisions of this subdivision shall apply where a provider
  of a  health  or  social  service  possesses  confidential  HIV  related
  information  relating  to individuals who are recipients of the service,

  and a federal, state or local government agency supervises  or  monitors
  the  provider  or  administers  the  program  under which the service is
  provided.
    (b)  Confidential  HIV  related information relating to a recipient of
  such service may be disclosed in accordance with regulations promulgated
  pursuant to paragraph (a) of subdivision  two  of  section  twenty-seven
  hundred eighty-six of this article to an authorized employee or agent of
  such  provider  or government agency, when reasonably necessary for such
  supervision, monitoring, administration, or provision of  such  service.
  The  term  "authorized  employee  or agent", as used in this subdivision
  shall only include any employee or agent  who  would,  in  the  ordinary
  course  of business of the provider or government agency, have access to
  records relating to the care of, treatment of, or provision of a  health
  or social service to the protected individual.
    7.  Nothing  in  this  section  shall  limit  a  person's  or agency's
  responsibility or authority to report, investigate, or redisclose, child
  protective and adult protective services information in accordance  with
  title six of article six and titles one and two of article nine-B of the
  social services law, or to provide or monitor the provision of child and
  adult protective or preventive services.
    8.  Confidential  HIV  related  information  shall  be recorded in the
  medical record of the  protected  individual.  The  provisions  of  this
  section  shall  not  prohibit  the listing of acquired immune deficiency
  syndrome, HIV related illness or  HIV  infection  in  a  certificate  of
  death,  autopsy report or related documents prepared pursuant to article
  forty-one of this chapter or other applicable laws, ordinances, rules or
  regulations relating to the documentation of cause of death,  nor  shall
  this  section  be  construed  to  modify  any laws, ordinances, rules or
  regulations relative to access to death certificates, autopsy reports or
  such other related documents. Under no circumstances shall  confidential
  HIV  related  information  be disclosable pursuant to article six of the
  public officers law. Notwithstanding  the  foregoing,  confidential  HIV
  information   obtained  pursuant  to  section  390.15  of  the  criminal
  procedure law or section 347.1 of the family court act by  either  court
  order  or  consent  of the protected individual shall not be recorded in
  the medical record of the protected individual unless he or she consents
  to the recording of such information in a written  statement  containing
  the  relevant  information  specified  in subdivision two of section two
  thousand seven hundred eighty-one of this article.
    9. Confidential HIV related information shall be  disclosed  upon  the
  request  of  the  health care worker HIV/HBV advisory panel, established
  pursuant to article twenty-seven-DD of this chapter, to the panel or its
  designee only when reasonably necessary for the evaluation of  a  worker
  who has voluntarily sought the panel's review.