2020 New York Laws
PBH - Public Health
Article 30 - Emergency Medical Services
3006-A - Patient Privacy.

§ 3006-a. Patient privacy. 1. As used in this section:
  (a) "Individual identifying information" means information identifying
or tending to identify a patient.
  (b) "Marketing" means advertising, detailing, marketing, promotion, or
any  other  activity  that  is intended to be used to influence business
volume, sales or market share or evaluate the effectiveness of marketing
practices or marketing personnel, regardless of whether the  beneficiary
of  the  marketing  is  a  governmental,  for-profit,  or not-for-profit
entity.
  2. No ambulance service, advanced life support first response service,
or employee, member or agent thereof  shall  disclose,  sell,  transfer,
exchange,  provide  or use any individual identifying information to any
person or entity for the purpose of marketing.
  3. Notwithstanding subdivision two of this  section,  and  subject  to
otherwise applicable law, individual identifying information may be:
  (a) disclosed, sold, transferred or exchanged to:
  (i)  the  patient  who  is the subject of the information, or a person
authorized to make health care decisions for the patient;
  (ii) a health  care  provider  providing  care  or  treatment  to  the
patient,  for  the  purpose  of  such  care  or  treatment;  or a health
information system subject to regulations of  the  department,  for  the
purpose of such care or treatment;
  (iii)  an  officer, inspector or investigator for a government health,
licensing or law  enforcement  agency  acting  under  appropriate  legal
authority;
  (iv)  a  person  authorized  by a court order or a subpoena to receive
such information;
  (v) the patient's health plan, insurer, or third party  payer,  or  an
agent  thereof,  for  the purpose of payment or reimbursement for health
care services,  including  determining  compliance  with  the  terms  of
coverage or medical necessity, or utilization review;
  (vi)  a  person  or  entity  to  whom,  and  for  a purpose for which,
disclosure or transfer is otherwise explicitly authorized or required by
law;
  (vii) a person or  entity,  for  the  purpose  of  conducting  quality
assurance  or  evaluating  the  performance  of  an  ambulance  service,
advanced life support first response service, or any employee, member or
agent thereof;
  (viii) a person or entity acting as an employee or agent of  a  person
or  entity  under  any  preceding paragraph of this subdivision, for the
purpose of and consistent with that paragraph; or
  (ix) a government entity as provided by law; and
  (b) used by  such  ambulance  service,  advanced  life  support  first
responder  service,  or employee, member or agent thereof, for training,
promotion, staff recognition or recruitment  purposes,  consistent  with
applicable law, provided the patient or a qualified person as defined by
paragraph (G) of subdivision one of section eighteen of this chapter has
provided  consent  to such use in a separate, stand-alone document. Such
consent shall be limited to the particular type  or  types  of  use  and
specific transaction or transactions for which such consent is given.
  4.  Nothing  in  this  section  shall  prohibit  the  collection, use,
transfer, or sale of patient data by zip  code,  geographic  region,  or
medical  specialty for marketing purposes, providing it does not contain
individual identifying information.
  5. This section shall not prevent a person from  disclosing,  selling,
transferring,  or  exchanging  for  value  his  or  her  own  individual
identifying information, for any purpose; provided that the  information

does  not  include  individual identifying information pertaining to any
other person.
  6.  This  section  does  not prohibit a not-for-profit or governmental
ambulance service or advanced life support first  response  service,  or
agent  thereof,  from  using  a  patient's  name and address in order to
contact such patient or a family member at such  address  with  requests
for donations to such service; providing that such use shall not include
disclosing any individual identifying information.
  7.  No  person  or  entity  to  whom  or  which individual identifying
information is disclosed, sold, transferred or exchanged shall disclose,
sell, transfer or exchange it to any person or entity other than for the
lawful  purpose  for  which  it  was  disclosed,  sold,  transferred  or
exchanged  to  the  person or entity, and without satisfactory assurance
that the recipient will safeguard the records from  being  disclosed  or
used for marketing purposes.
  8.  This section does not authorize any disclosure, sale, transfer, or
exchange of individual identifying information  that  is  not  otherwise
authorized or required by law.
  9. In addition to the commissioner's authority to enforce this section
under  section  three  thousand  twelve  of  this  article, the attorney
general  shall  have  the  authority  to  bring  an  action  to  enforce
compliance with this section without referral by the commissioner.