2019 New York Laws
PBH - Public Health
Article 28 - Hospitals
2805-M - Confidentiality.

§ 2805-m. Confidentiality. 1. The information required to be collected
and  maintained  pursuant  to  sections  twenty-eight hundred five-j and
twenty-eight hundred five-k of this  article,  reports  required  to  be
submitted  pursuant  to  section  twenty-eight  hundred  five-l  of this
article and any incident reporting requirements imposed upon  diagnostic
and  treatment  centers pursuant to the provisions of this chapter shall
be kept confidential and shall not be released except to the  department
or  pursuant  to subdivision four of section twenty-eight hundred five-k
of this article.
  2. Notwithstanding any other provisions of law, none of  the  records,
documentation  or  committee  actions  or  records  required pursuant to
sections twenty-eight hundred five-j and twenty-eight hundred five-k  of
this  article,  the  reports  required  pursuant to section twenty-eight
hundred five-l of this article nor any incident  reporting  requirements
imposed upon diagnostic and treatment centers pursuant to the provisions
of  this chapter shall be subject to disclosure under article six of the
public officers law or article thirty-one of the civil practice law  and
rules,  except  as  hereinafter  provided  or  as  provided by any other
provision of law. No person in attendance  at  a  meeting  of  any  such
committee  shall  be  required to testify as to what transpired thereat.
The prohibition relating to discovery of testimony shall  not  apply  to
the statements made by any person in attendance at such a meeting who is
a  party  to  an  action  or  proceeding the subject matter of which was
reviewed at such meeting.
  3. There shall be no monetary liability on the part of, and  no  cause
of  action  for  damages  shall  arise against, any person, partnership,
corporation,  firm,  society,  or  other  entity  on  account   of   the
communication of information in the possession of such person or entity,
or  on  account  of  any  recommendation  or  evaluation,  regarding the
qualifications, fitness, or  professional  conduct  or  practices  of  a
physician,  to  any governmental agency, medical or specialists society,
or  hospital  as  required  by  sections  twenty-eight  hundred  five-j,
twenty-eight  hundred  five-k  and  twenty-eight  hundred five-l of this
article or any incident reporting requirements imposed  upon  diagnostic
and  treatment  centers  pursuant to the provisions of this chapter. The
foregoing  shall  not  apply  to  information  which   is   untrue   and
communicated with malicious intent.
  4. (a) Hospital sepsis data submitted to the department, shall for the
initial  phase  of  data  collection  be considered a "pilot phase", the
purpose of which is to ensure the completeness and accuracy of reporting
by hospitals.
  (b) For data reported during the  pilot  phase,  hospital  identifiers
shall be encrypted by the department in any and all public databases and
reports.  The  department shall provide each hospital with an encryption
key for that hospital only to permit access to its own performance  data
for  internal  quality  improvement  purposes.  Hospital specific public
reporting of sepsis data including, but not  limited  to  risk  adjusted
sepsis  mortality  rates, may require up to, but no more than, two years
of "pilot phase" collection depending on the  validity  and  reliability
outcomes of the data collected.
  (c)  As  described  in the regulations pertaining to the submission of
data  on  sepsis  to  the  department,  consultation  with   appropriate
national,  hospital  and  expert stakeholders will assist in determining
the appropriate public release of hospital performance.
  (d) The department shall issue regular reports as needed to  hospitals
assessing  the accuracy of the data submitted during the pilot phase and
provide guidance for improving the accuracy of data reporting.
  (e) After the pilot phase is completed, all data submitted under  this
section  and  compiled in the database established herein and all public
reports derived therefrom shall include hospital identifiers.
  (f) Clinical performance data, including but not limited to individual
hospital  mortality  rates  adjusted  for  potential differences in risk
factors and comparisons with state (or national, if available) averages,
shall be developed and posted on the department's web site.