2006 New York Code - Health Maintenance Organizations; Professional Services.

 
    §  4410.  Health  maintenance organizations; professional services. 1.
  The provision of comprehensive health services directly  or  indirectly,
  by  a  health  maintenance organization through its comprehensive health
  services plan shall not be considered the practice of the profession  of
  medicine by such organization or plan. However, each member, employee or
  agent  of such organization or plan shall be fully and personally liable
  and  accountable  for  any  negligent  or  wrongful  act  or  misconduct
  committed  by him or any person under his direct supervision and control
  while rendering professional services on behalf of such organization  or
  plan.
    2.  Unless  the  patient waives the right of confidentiality, a health
  maintenance organization or its comprehensive health services plan shall
  not be allowed to disclose any information which was  acquired  by  such
  organization  or  plan  in  the  course of the rendering to a patient of
  professional services by  a  person  authorized  to  practice  medicine,
  registered   professional   nursing,   licensed  practical  nursing,  or
  dentistry, and which was necessary to acquire to enable such  person  to
  act  in  that  capacity,  except  as may be otherwise required by law. A
  non-participating provider shall provide an enrollee's organization with
  such patient information as is reasonably required by  the  organization
  to  administer  its  plan.  In  making  such disclosure a provider shall
  comply with the provisions of subdivision six  of  section  eighteen  of
  this  chapter  concerning the disclosure of patient information to third
  parties provided, however, that with respect to a  protected  individual
  as  defined in subdivision six of section twenty-seven hundred eighty of
  this chapter, disclosure shall be made only pursuant  to  an  enrollee's
  written  authorization  and  shall  otherwise  be  consistent  with  the
  requirements of such  section  and  rules  and  regulations  promulgated
  pursuant thereto.
    3.  Notwithstanding  the provisions of this section, the provisions of
  section four hundred twenty-two of the social services law  shall  apply
  to  any  information  or  reports  submitted  by  a  health  maintenance
  organization to the  statewide  central  register  of  child  abuse  and
  maltreatment reports.
    4.  (a) The commissioner shall have access to patient-specific medical
  information,  including  encounter  data,   maintained   by   a   health
  maintenance  organization  or  other  organization certified pursuant to
  this article for  the  purposes  of  quality  assurance  and  oversight,
  subject  to  any  other  limitations  of federal and state law regarding
  disclosure thereof to third parties and subject  to  the  provisions  of
  this subdivision. The provisions of sections thirty-one hundred one, and
  forty-five hundred four, forty-five hundred seven and forty-five hundred
  eight  of  the  civil  practice law and rules, subdivision three of this
  section and section 33.13 of the  mental  hygiene  law,  shall  not  bar
  disclosure  by  the  health maintenance organization to the commissioner
  for such purposes.
    (b) The commissioner may only obtain enrollee information  subject  to
  the   establishment   of   protocols   that   will   ensure   that  such
  patient-specific information is not disclosed  to  third  parties  other
  than  to  entities  serving  as  agents of the state for the purposes of
  quality assurance and oversight. Such protocols shall  be  developed  in
  consultation  with  representatives of health maintenance organizations,
  health care provider organizations and consumer organizations and shall,
  where  possible,  include  the  development  of  a  unique  confidential
  identifier  to  be  used in connection with patient-specific data. These
  protocols shall address issues relating to the collection,  maintenance,
  and  disclosure  of  such  patient-specific  information. Such protocols
  shall be promulgated as regulations, provided however, that protocols or
  regulations in use prior to the effective date of this subdivision shall
  remain  in  effect  until  the  regulations  developed   hereunder   are
  promulgated.
    (c)  In  addition to any other sanction or penalty as provided by law,
  any employee of the department who willfully violates this regulation or
  any other rule or procedure pertaining to the disclosure of any material
  collected pursuant to this subdivision shall be deemed to have committed
  an act of misconduct and shall be disciplined  in  accordance  with  the
  provisions of the civil service law.