2019 New York Laws
PBH - Public Health
Article 1 - Short Title and Definitions: General Provisions
Title 2 - General Provisions
18 - Access to Patient Information.

* § 18. Access to patient information. 1. Definitions. For the purpose
of this section:
  (a)  "Committee"  means  a  medical  access review committee appointed
pursuant to subdivision four of this section.
  (b)  "Health  care  provider"  or  "provider"  means  a  "health  care
facility"   or   a   "health  care  practitioner"  as  defined  by  this
subdivision.
  (c) "Health care facility" or "facility" means a hospital  as  defined
in  article twenty-eight of this chapter, a home care services agency as
defined in article thirty-six of this chapter, a hospice as  defined  in
article  forty  of  this  chapter,  a health maintenance organization as
defined in article forty-four of  this  chapter,  and  a  shared  health
facility as defined in article forty-seven of this chapter.
  (d)  "Health  care  practitioner"  or  "practitioner"  means  a person
licensed under article one hundred thirty-one, one hundred thirty-one-B,
one  hundred  thirty-two,  one   hundred   thirty-three,   one   hundred
thirty-six,  one hundred thirty-nine, one hundred forty-one, one hundred
forty-three,  one  hundred  forty-four,  one  hundred  fifty-three,  one
hundred  fifty-four,  one hundred fifty-six or one hundred fifty-nine of
the education law  or  a  person  certified  under  section  twenty-five
hundred sixty of this chapter.
  (e)  "Patient  information"  or  "information"  means  any information
concerning or relating to the examination, health assessment  including,
but  not  limited  to,  a health assessment for insurance and employment
purposes or treatment of an identifiable subject maintained or possessed
by a health care facility or health care practitioner who  has  provided
or is providing services for assessment of a health condition including,
but  not  limited  to,  a health assessment for insurance and employment
purposes or  has  treated  or  is  treating  such  subject,  except  (i)
information  and  clinical  records subject to the provisions of section
23.05 or 33.13 of the  mental  hygiene  law,  (ii)  personal  notes  and
observations  of a health care practitioner, provided that such personal
notes and observations  are  maintained  by  the  practitioner  and  not
disclosed  by  the practitioner to any other person after January first,
nineteen  hundred  eighty-seven,  (iii)  information  maintained  by   a
practitioner,  concerning  or  relating  to  the  prior  examination  or
treatment of a subject  received  from  another  practitioner,  provided
however,  that such information may be requested by the subject directly
from such other practitioner in accordance with the provisions  of  this
section,  and  (iv)  data  disclosed  to a practitioner in confidence by
other persons on the basis of an express condition that such data  would
never  be  disclosed to the subject or other persons, provided that such
data has never been disclosed to any other person. If at any  time  such
personal  notes  and observations or such data is disclosed, it shall be
considered  patient  information  for  purposes  of  this  section.  For
purposes of this subdivision, "disclosure to any other person" shall not
include  disclosures  made to practitioners as part of a consultation or
referral during the treatment  of  the  subject,  to  persons  reviewing
information  or  records  in  the  ordinary  course  of  ensuring that a
provider is in compliance with applicable quality of care, licensure  or
accreditation  standards, to an employee or official of a federal, state
or local agency for the sole purpose  of  conducting  an  audit  in  the
course  of  his  or  her  official duties, to the statewide planning and
research cooperative system, to other persons pursuant to a court order,
to governmental agencies, insurance companies licensed pursuant  to  the
insurance  law  and  other third parties requiring information necessary
for payments to be made to  or  on  behalf  of  patients,  to  qualified
researchers,  to  the  state board for professional medical conduct when

such board requests such information in the exercise  of  its  statutory
function, to an insurance carrier insuring, or an attorney consulted by,
a  health  care  provider,  or  to  a  health  maintenance  organization
certified  pursuant  to  article  forty-four of this chapter or licensed
pursuant to the insurance law, or to the committee or a  court  pursuant
to the provisions of this section.
  For  purposes  of  this  subdivision  treatment of a subject shall not
include  diagnostic  services,  except  mammography,  performed   by   a
practitioner   at  the  request  of  another  health  care  practitioner
provided,  however,  that  such  information,  and  mammograms,  may  be
requested by the subject directly from the practitioner at whose request
such   diagnostic  services  were  performed,  in  accordance  with  the
provisions of this section.
  (f)  "Personal  notes  and  observations"   means   a   practitioner's
speculations, impressions (other than tentative or actual diagnosis) and
reminders, provided such data is maintained by a practitioner.
  (g)  "Qualified  person"  means  any properly identified subject; or a
guardian appointed under article eighty-one of the mental  hygiene  law;
or  a  parent  of  an infant; or a guardian of an infant appointed under
article seventeen of  the  surrogate's  court  procedure  act  or  other
legally  appointed  guardian of an infant who may be entitled to request
access to a clinical record under paragraph (c) of  subdivision  two  of
this  section;  or  a  distributee  of  any deceased subject for whom no
personal representative, as defined in the estates,  powers  and  trusts
law,  has been appointed; or an attorney representing a qualified person
or the subject's estate who holds a power of attorney from the qualified
person or the subject's estate  explicitly  authorizing  the  holder  to
execute  a written request for patient information under this section. A
qualified person shall be  deemed  a  "personal  representative  of  the
individual" for purposes of the federal health insurance portability and
accountability act of 1996 and its implementing regulations.
  (h)  "Subject" means an individual concerning whom patient information
is maintained or possessed by a health care provider.
  (i) "Treating practitioner" means the health care practitioner who has
primary responsibility for the care of the  subject  within  the  health
care  facility  or  if  such practitioner is unavailable, a practitioner
designated by such facility.
  (j) "Cease to do business in this state" shall mean any case  where  a
health care provider who has engaged in an on-going practice or business
within  this  state  as a health care provider, ceases to engage in such
business, provided however, that this term shall not  include  a  health
care  practitioner  whose practice is merged, consolidated, combined, or
acquired by another health care provider and  he  or  she  continues  to
provide  services  including  medical  care,  diagnosis  or treatment to
patients  as  an  employee,  contractor,  or  owner   of   the   merged,
consolidated, combined, or acquired health care provider.
  2.  Access  by  qualified  persons.  (a)  Subject to the provisions of
subdivision three of this section,  upon  the  written  request  of  any
subject, a health care provider shall provide an opportunity, within ten
days,  for such subject to inspect any patient information concerning or
relating to  the  examination  or  treatment  of  such  subject  in  the
possession of such health care provider.
  (b)  Subject  to  the provisions of subdivision three of this section,
upon the written request of the committee for an  incompetent  appointed
pursuant  to  article  seventy-eight of the mental hygiene law, a health
care provider shall provide an opportunity, within  ten  days,  for  the
inspection  by  such committee of any patient information concerning the
incompetent subject in the possession of such health care provider.
  (c) Subject to the provisions of subdivision three of this section and
except as otherwise provided by law,  upon  the  written  request  of  a
parent  or guardian of an infant appointed pursuant to article seventeen
of the surrogate's court procedure act, or any other  legally  appointed
guardian,  a  health  care provider shall provide an opportunity, within
ten days, for such parent or guardian to inspect any patient information
maintained or possessed by such provider concerning care  and  treatment
of  the  infant  for  which  the  consent of such parent or guardian was
obtained or where care was provided  without  consent  in  an  emergency
which  was  the  result  of accidental injury or the unexpected onset of
serious illness; provided, however, that such parent or  guardian  shall
not  be  entitled  to  inspect or make copies of any patient information
concerning the care and treatment of an infant  where  the  health  care
provider  determines  that  access  to the information requested by such
parent or guardian would have a detrimental  effect  on  the  provider's
professional  relationship with the infant, or on the care and treatment
of the infant, or on the infant's relationship with his or  her  parents
or guardian.
  (d)  Subject  to  the provisions of subdivision three of this section,
upon the written request of any qualified person, a health care provider
shall furnish to such person, within a reasonable time, a  copy  of  any
patient  information requested, and original mammograms requested, which
the person is authorized to inspect pursuant to this subdivision.
  (e) The provider may impose a reasonable charge  for  all  inspections
and copies, not exceeding the costs incurred by such provider, provided,
however, that a provider may not impose a charge for copying an original
mammogram  when  the original has been furnished to any qualified person
and provided, further,  that  any  charge  for  furnishing  an  original
mammogram pursuant to this section shall not exceed the documented costs
associated  therewith.  However,  the reasonable charge for paper copies
shall not exceed seventy-five cents per page. A qualified  person  shall
not  be denied access to patient information solely because of inability
to pay. No charge may be  imposed  under  this  section  for  providing,
releasing,  or  delivering  patient  information  or  copies  of patient
information  where  requested  for  the   purpose   of   supporting   an
application,  claim  or  appeal  for  any government benefit or program,
provided  that,  where  a  provider  maintains  patient  information  in
electronic form, it shall provide the copy in either electronic or paper
form,  as  required  by  the  government  benefit  or program, or at the
patient's request.
  (f) A provider may place reasonable limitations on  the  time,  place,
and frequency of any inspections of patient information.
  (g)  In the event that a practitioner does not have space available to
permit the inspection of patient information, the practitioner  may,  in
the  alternative,  furnish a qualified person a copy of such information
within ten days.
  (h) A provider may request  the  opportunity  to  review  the  patient
information  with  the qualified person requesting such information, but
such review shall not be a prerequisite for furnishing the information.
  (i) A provider may make available for inspection either  the  original
or a copy of patient information.
  3.  Limitations  on access. (a) Upon receipt of a written request by a
qualified person to inspect or copy patient information, a  practitioner
may review the information requested. Unless the practitioner determines
pursuant  to  paragraph  (d)  of this subdivision that (i) the requested
review  of  the  information  can  reasonably  be  expected   to   cause
substantial  and  identifiable harm to the subject or others which would
outweigh the qualified person's right to access to the  information,  or

(ii)  the  material requested is personal notes and observations, or the
information requested would have a  detrimental  effect  as  defined  in
subdivision  two  of  this  section,  review of such patient information
shall be permitted or copies provided.
  (b) Upon receipt of a written request by a qualified person to inspect
patient  information maintained by a facility, the facility shall inform
the treating practitioner of the request. The treating practitioner  may
review  the  information  requested.  Unless  the  treating practitioner
determines, pursuant to paragraph  (d)  of  this  subdivision  that  the
requested  review of the information can reasonably be expected to cause
substantial and identifiable harm to the subject or others  which  would
outweigh  the  qualified  person's right of access to the information or
would have a detrimental effect as defined in subdivision  two  of  this
section, review of such patient information shall be permitted or copies
provided.
  (c)  A  subject  over  the  age of twelve years may be notified of any
request by a qualified person to  review  his/her  patient  information,
and,  if  the  subject  objects to disclosure, the provider may deny the
request. In the case of a facility, the treating practitioner  shall  be
consulted.
  (d)  The  provider may deny access to all or a part of the information
and may grant access to a prepared summary of the information if,  after
consideration of all the attendant facts and circumstances, the provider
determines  that  (i) the request to review all or a part of the patient
information  can  reasonably  be  expected  to  cause  substantial   and
identifiable  harm  to  the  subject  or others which would outweigh the
qualified person's right of access to the information, or would  have  a
detrimental  effect  as  defined  in subdivision two of this section, or
(ii) the material requested  is  personal  notes  and  observations.  In
conducting  such  review, the provider may consider, among other things,
the following factors: (i) the need for, and  the  fact  of,  continuing
care  and  treatment;  (ii)  the  extent  to  which the knowledge of the
information may be harmful to the health or safety  of  the  subject  or
others;  (iii)  the  extent  to which the information contains sensitive
material  disclosed  in  confidence  to  the  practitioner  or  treating
practitioner  by  family  members,  friends  and other persons; (iv) the
extent to which the information contains sensitive  materials  disclosed
to  the  practitioner  or the treating practitioner by the subject which
would be injurious to the subject's relationships  with  other  persons,
except  when the subject is requesting information concerning himself or
herself; and (v) in the case of a minor  making  a  request  for  access
pursuant to subdivision two of this section, the age of the subject.
  (e)  In the event of a denial of access, the qualified person shall be
informed by the provider of such denial, and whether the denial is based
on the reasonable  expectation  that  release  of  the  information  can
reasonably be expected to cause substantial and identifiable harm to the
subject or others which outweighs the qualified person's right of access
to  the information or on the reasonable expectation that release of the
information would have a detrimental effect as  defined  in  subdivision
two  of  this  section,  or on the basis that the materials sought to be
reviewed  constitute  personal  notes  and  observations,  and  of   the
qualified person's right to obtain, without cost, a review of the denial
by  the  appropriate  medical  record  access  review  committee. If the
qualified person requests such review, the provider  shall,  within  ten
days  of  receipt  of  such  request, transmit the information including
personal notes and observations as defined herein, to  the  chairman  of
the  appropriate  committee  with a statement setting forth the specific
reasons for which access was denied. After an in camera  review  of  the

materials   provided  and  after  providing  all  parties  a  reasonable
opportunity to be heard, the committee shall  promptly  make  a  written
determination  whether  the  requested  review  of  the  information can
reasonably be expected to cause substantial and identifiable harm to the
subject or others which outweighs the qualified person's right of access
to  the  information  pursuant  to  paragraph (d) of this subdivision or
whether the requested review would have a detrimental effect as  defined
in  subdivision  two  of  this  section,  or  whether all or part of the
materials  sought  to  be  reviewed  constitute   personal   notes   and
observations,  and  shall accordingly determine whether access to all or
part of such materials shall be granted. In the event that the committee
determines that the request for access shall be granted in whole  or  in
part,  the  committee  shall  notify  all parties and the provider shall
grant access pursuant to such determination.
  (f) In the event that access is denied in whole or in part because the
requested review of information can  reasonably  be  expected  to  cause
substantial  and  identifiable harm to the subject or others which would
outweigh the qualified person's right of access to the  information,  or
would  have  a  detrimental effect as defined in subdivision two of this
section, the committee shall notify the qualified person of his  or  her
right  to  seek judicial review of the provider's determination pursuant
to this section: provided however, that a determination by the committee
as to whether materials sought to be reviewed constitute personal  notes
and  observations  shall  not  be the subject of judicial review. Within
thirty days of receiving notification of such  decision,  the  qualified
person  may commence, upon notice, a special proceeding in supreme court
for a judgment requiring the provider to make available the  information
for  inspection or copying. The court upon such application and after an
in camera review of the materials provided including  the  determination
and  record  of  the  committee,  and  after  providing  all  parties an
opportunity  to  be  heard,  shall  determine  whether  there  exists  a
reasonable basis for the denial of access. The relief available pursuant
to  this  section shall be limited to a judgement requiring the provider
to make available to the qualified person the requested information  for
inspection or copying.
  (g)  Where  the  written  request  for  patient information under this
section is signed by a distributee of a  deceased  subject  for  whom  a
personal  representative has not been appointed, or from the holder of a
power of attorney from such a distributee, a copy of a certified copy of
the certificate of death of the subject shall be attached to the written
request.
  (h) Where the written  request  for  patient  information  under  this
section  is  signed  by the holder of a power of attorney, a copy of the
power of attorney shall be attached to the written  request.  A  written
request  under  this  subdivision  shall  be subject to the duration and
terms of the power of attorney.
  (i) The release of  patient  information  shall  be  subject  to:  (i)
article  twenty-seven-F  of  this  chapter  in  the case of confidential
HIV-related information; (ii) section  seventeen  of  this  article  and
sections   twenty-three   hundred  one,  twenty-three  hundred  six  and
twenty-three hundred eight of this chapter in the case of termination of
a pregnancy and treatment for  a  sexually  transmitted  disease;  (iii)
article  thirty-three  of  the  mental  hygiene  law; and (iv) any other
provisions of law creating special requirements relating to the  release
of   patient   information,   including  the  federal  health  insurance
portability  and  accountability  act  of  1996  and  its   implementing
regulations.

  4.  Medical  record  access  review committees. The commissioner shall
designate medical record access review committees to hear appeals of the
denial of access to patient information as provided in paragraph (e)  of
subdivision  three  of  this  section. The commissioner shall promulgate
rules  and  regulations  necessary  to effectuate the provisions of this
subdivision.
  5. Annual report. The commissioner shall submit an annual report on or
before December thirty-first to the governor and the  legislature.  Such
report  shall include, but not be limited to, the number of requests for
committee review of providers' denial  of  access  and  the  committees'
determinations thereon.
  6.  Disclosure  to  third persons. Whenever a health care provider, as
otherwise authorized by law, discloses patient information to  a  person
or  entity  other  than  the  subject  of  such  information or to other
qualified persons, either a copy of the subject's written  authorization
shall  be  added  to  the patient information or the name and address of
such third party and a notation of the purpose for the disclosure  shall
be indicated in the file or record of such subject's patient information
maintained  by the provider provided, however, that for disclosures made
to government agencies making payments  on  behalf  of  patients  or  to
insurance  companies  licensed  pursuant  to  the  insurance  law such a
notation shall only be entered at the time the disclosure is first made.
This subdivision shall not apply to disclosure to practitioners or other
personnel employed by  or  under  contract  with  the  facility,  or  to
government agencies for purposes of facility inspections or professional
conduct  investigations.  Any  disclosure  made pursuant to this section
shall be limited to that information necessary in light  of  the  reason
for  disclosure. Information so disclosed should be kept confidential by
the party  receiving  such  information  and  the  limitations  on  such
disclosure in this section shall apply to such party.
  7.  Applicability  of  federal law. Whenever federal law or applicable
federal regulations affecting the release of patient information  are  a
condition  for the receipt of federal aid, and are inconsistent with the
provisions of this section, the provisions of  federal  law  or  federal
regulations shall be controlling.
  8.  Challenges  to  accuracy.  A  qualified  person  may challenge the
accuracy of information maintained in the patient  information  and  may
require that a brief written statement prepared by him or her concerning
the  challenged  information  be  inserted into the patient information.
This statement shall become a permanent part of the patient  information
and  shall  be  released  whenever the information at issue is released.
This subdivision shall apply only to factual statements  and  shall  not
include a provider's observations, inferences or conclusions.
  A facility may place reasonable restrictions on the time and frequency
of any challenges to accuracy.
  9.  Waivers void. Any agreement by an individual to waive any right to
inspect, copy or seek correction of patient information as provided  for
in  this section shall be deemed to be void as against public policy and
wholly unenforceable.
  10. Nothing contained in this section shall restrict, expand or in any
way limit  the  disclosure  of  any  information  pursuant  to  articles
twenty-three,  thirty-one  and  forty-five of the civil practice law and
rules or section six hundred seventy-seven of the county law.
  11. No proceeding shall be brought  or  penalty  assessed,  except  as
provided  for  in  this  section, against a health care provider, who in
good faith, denies access to patient information.

  12.  Immunity  from  liability.  No  health  care  provider  shall  be
subjected  to  civil liability arising solely from granting or providing
access to any patient information in accordance with this section.
  13.  (a)  A  health  care provider which has in its possession patient
information and/or patient medical records and which has  determined  to
permanently  cease  to  do  business or practice in this state shall, at
least thirty days prior to such action, make  a  good  faith  effort  to
notify  each  of  the  health  care provider's current patients that the
office will be closing and to inform each such patient  of  his  or  her
right  to  request  that  his  or her patient information and/or patient
medical records be sent to a health care provider, health care  facility
or health care practitioner of the patient's choosing or, alternatively,
that such information and records be returned to the patient.
  (b)  The  provisions  of  this subdivision shall not affect any rights
afforded pursuant to section seventeen of this title.
  (c) Nothing in this subdivision shall affect the period of time that a
health care provider is lawfully required to retain a patient's  medical
information and medical records.
  (d)  The  provisions of this subdivision shall only apply with respect
to a patient whose chart includes  written  permission  to  receive  the
notification described in paragraph (a) of this subdivision.
  * NB There are 2 § 18's