N.Y. Public Health Law § 18: Access to patient information

* § 18. Access to patient information. 1. Definitions. For the purpose

of this section:

(a) "Committee" means a medical access review committee appointed

pursuant to subdivision four of this section.

(b) "Health care provider" or "provider" means a "health care

facility" or a "health care practitioner" as defined by this

subdivision.

(c) "Health care facility" or "facility" means a hospital as defined

in article twenty-eight of this chapter, a home care services agency as

defined in article thirty-six of this chapter, a hospice as defined in

article forty of this chapter, a health maintenance organization as

defined in article forty-four of this chapter, and a shared health

facility as defined in article forty-seven of this chapter.

(d) "Health care practitioner" or "practitioner" means a person

licensed under article one hundred thirty-one, one hundred thirty-one-B,

one hundred thirty-two, one hundred thirty-three, one hundred

thirty-six, one hundred thirty-nine, one hundred forty-one, one hundred

forty-three, one hundred forty-four, one hundred fifty-three, one

hundred fifty-four, one hundred fifty-six or one hundred fifty-nine of

the education law or a person certified under section twenty-five

hundred sixty of this chapter.

(e) "Patient information" or "information" means any information

concerning or relating to the examination, health assessment including,

but not limited to, a health assessment for insurance and employment

purposes or treatment of an identifiable subject maintained or possessed

by a health care facility or health care practitioner who has provided

or is providing services for assessment of a health condition including,

but not limited to, a health assessment for insurance and employment

purposes or has treated or is treating such subject, except (i)

information and clinical records subject to the provisions of section

23.05 or 33.13 of the mental hygiene law, (ii) personal notes and

observations of a health care practitioner, provided that such personal

notes and observations are maintained by the practitioner and not

disclosed by the practitioner to any other person after January first,

nineteen hundred eighty-seven, (iii) information maintained by a

practitioner, concerning or relating to the prior examination or

treatment of a subject received from another practitioner, provided

however, that such information may be requested by the subject directly

from such other practitioner in accordance with the provisions of this

section, and (iv) data disclosed to a practitioner in confidence by

other persons on the basis of an express condition that such data would

never be disclosed to the subject or other persons, provided that such

data has never been disclosed to any other person. If at any time such

personal notes and observations or such data is disclosed, it shall be

considered patient information for purposes of this section. For

purposes of this subdivision, "disclosure to any other person" shall not

include disclosures made to practitioners as part of a consultation or

referral during the treatment of the subject, to persons reviewing

information or records in the ordinary course of ensuring that a

provider is in compliance with applicable quality of care, licensure or

accreditation standards, to an employee or official of a federal, state

or local agency for the sole purpose of conducting an audit in the

course of his or her official duties, to the statewide planning and

research cooperative system, to other persons pursuant to a court order,

to governmental agencies, insurance companies licensed pursuant to the

insurance law and other third parties requiring information necessary

for payments to be made to or on behalf of patients, to qualified

researchers, to the state board for professional medical conduct when

such board requests such information in the exercise of its statutory

function, to an insurance carrier insuring, or an attorney consulted by,

a health care provider, or to a health maintenance organization

certified pursuant to article forty-four of this chapter or licensed

pursuant to the insurance law, or to the committee or a court pursuant

to the provisions of this section.

For purposes of this subdivision treatment of a subject shall not

include diagnostic services, except mammography, performed by a

practitioner at the request of another health care practitioner

provided, however, that such information, and mammograms, may be

requested by the subject directly from the practitioner at whose request

such diagnostic services were performed, in accordance with the

provisions of this section.

(f) "Personal notes and observations" means a practitioner's

speculations, impressions (other than tentative or actual diagnosis) and

reminders, provided such data is maintained by a practitioner.

(g) "Qualified person" means any properly identified subject; or a

guardian appointed under article eighty-one of the mental hygiene law;

or a parent of an infant; or a guardian of an infant appointed under

article seventeen of the surrogate's court procedure act or other

legally appointed guardian of an infant who may be entitled to request

access to a clinical record under paragraph (c) of subdivision two of

this section; or a distributee of any deceased subject for whom no

personal representative, as defined in the estates, powers and trusts

law, has been appointed; or an attorney representing a qualified person

or the subject's estate who holds a power of attorney from the qualified

person or the subject's estate explicitly authorizing the holder to

execute a written request for patient information under this section. A

qualified person shall be deemed a "personal representative of the

individual" for purposes of the federal health insurance portability and

accountability act of 1996 and its implementing regulations.

(h) "Subject" means an individual concerning whom patient information

is maintained or possessed by a health care provider.

(i) "Treating practitioner" means the health care practitioner who has

primary responsibility for the care of the subject within the health

care facility or if such practitioner is unavailable, a practitioner

designated by such facility.

(j) "Cease to do business in this state" shall mean any case where a

health care provider who has engaged in an on-going practice or business

within this state as a health care provider, ceases to engage in such

business, provided however, that this term shall not include a health

care practitioner whose practice is merged, consolidated, combined, or

acquired by another health care provider and he or she continues to

provide services including medical care, diagnosis or treatment to

patients as an employee, contractor, or owner of the merged,

consolidated, combined, or acquired health care provider.

2. Access by qualified persons. (a) Subject to the provisions of

subdivision three of this section, upon the written request of any

subject, a health care provider shall provide an opportunity, within ten

days, for such subject to inspect any patient information concerning or

relating to the examination or treatment of such subject in the

possession of such health care provider.

(b) Subject to the provisions of subdivision three of this section,

upon the written request of the committee for an incompetent appointed

pursuant to article seventy-eight of the mental hygiene law, a health

care provider shall provide an opportunity, within ten days, for the

inspection by such committee of any patient information concerning the

incompetent subject in the possession of such health care provider.

(c) Subject to the provisions of subdivision three of this section and

except as otherwise provided by law, upon the written request of a

parent or guardian of an infant appointed pursuant to article seventeen

of the surrogate's court procedure act, or any other legally appointed

guardian, a health care provider shall provide an opportunity, within

ten days, for such parent or guardian to inspect any patient information

maintained or possessed by such provider concerning care and treatment

of the infant for which the consent of such parent or guardian was

obtained or where care was provided without consent in an emergency

which was the result of accidental injury or the unexpected onset of

serious illness; provided, however, that such parent or guardian shall

not be entitled to inspect or make copies of any patient information

concerning the care and treatment of an infant where the health care

provider determines that access to the information requested by such

parent or guardian would have a detrimental effect on the provider's

professional relationship with the infant, or on the care and treatment

of the infant, or on the infant's relationship with his or her parents

or guardian.

(d) Subject to the provisions of subdivision three of this section,

upon the written request of any qualified person, a health care provider

shall furnish to such person, within a reasonable time, a copy of any

patient information requested, and original mammograms requested, which

the person is authorized to inspect pursuant to this subdivision. A

qualified person may request a physical copy of any patient information

requested pursuant to this section.

(e) The provider may impose a reasonable charge for all inspections

and copies, not exceeding the costs incurred by such provider, provided,

however, that a provider may not impose a charge for copying an original

mammogram when the original has been furnished to any qualified person

and provided, further, that any charge for furnishing an original

mammogram pursuant to this section shall not exceed the documented costs

associated therewith. However, the reasonable charge for paper copies

shall not exceed seventy-five cents per page. A qualified person shall

not be denied access to patient information solely because of inability

to pay. No charge may be imposed under this section for providing,

releasing, or delivering patient information or copies of patient

information where requested for the purpose of supporting an

application, claim or appeal for any government benefit or program,

provided that, where a provider maintains patient information in

electronic form, it shall provide the copy in either electronic or paper

form, as required by the government benefit or program, or at the

patient's request.

(f) A provider may place reasonable limitations on the time, place,

and frequency of any inspections of patient information.

(g) In the event that a practitioner does not have space available to

permit the inspection of patient information, the practitioner may, in

the alternative, furnish a qualified person a copy of such information

within ten days.

(h) A provider may request the opportunity to review the patient

information with the qualified person requesting such information, but

such review shall not be a prerequisite for furnishing the information.

(i) A provider may make available for inspection either the original

or a copy of patient information.

3. Limitations on access. (a) Upon receipt of a written request by a

qualified person to inspect or copy patient information, a practitioner

may review the information requested. Unless the practitioner determines

pursuant to paragraph (d) of this subdivision that (i) the requested

review of the information can reasonably be expected to cause

substantial and identifiable harm to the subject or others which would

outweigh the qualified person's right to access to the information, or

(ii) the material requested is personal notes and observations, or the

information requested would have a detrimental effect as defined in

subdivision two of this section, review of such patient information

shall be permitted or copies provided.

(b) Upon receipt of a written request by a qualified person to inspect

patient information maintained by a facility, the facility shall inform

the treating practitioner of the request. The treating practitioner may

review the information requested. Unless the treating practitioner

determines, pursuant to paragraph (d) of this subdivision that the

requested review of the information can reasonably be expected to cause

substantial and identifiable harm to the subject or others which would

outweigh the qualified person's right of access to the information or

would have a detrimental effect as defined in subdivision two of this

section, review of such patient information shall be permitted or copies

provided.

(c) A subject over the age of twelve years may be notified of any

request by a qualified person to review his/her patient information,

and, if the subject objects to disclosure, the provider may deny the

request. In the case of a facility, the treating practitioner shall be

consulted.

(d) The provider may deny access to all or a part of the information

and may grant access to a prepared summary of the information if, after

consideration of all the attendant facts and circumstances, the provider

determines that (i) the request to review all or a part of the patient

information can reasonably be expected to cause substantial and

identifiable harm to the subject or others which would outweigh the

qualified person's right of access to the information, or would have a

detrimental effect as defined in subdivision two of this section, or

(ii) the material requested is personal notes and observations. In

conducting such review, the provider may consider, among other things,

the following factors: (i) the need for, and the fact of, continuing

care and treatment; (ii) the extent to which the knowledge of the

information may be harmful to the health or safety of the subject or

others; (iii) the extent to which the information contains sensitive

material disclosed in confidence to the practitioner or treating

practitioner by family members, friends and other persons; (iv) the

extent to which the information contains sensitive materials disclosed

to the practitioner or the treating practitioner by the subject which

would be injurious to the subject's relationships with other persons,

except when the subject is requesting information concerning himself or

herself; and (v) in the case of a minor making a request for access

pursuant to subdivision two of this section, the age of the subject.

(e) In the event of a denial of access, the qualified person shall be

informed by the provider of such denial, and whether the denial is based

on the reasonable expectation that release of the information can

reasonably be expected to cause substantial and identifiable harm to the

subject or others which outweighs the qualified person's right of access

to the information or on the reasonable expectation that release of the

information would have a detrimental effect as defined in subdivision

two of this section, or on the basis that the materials sought to be

reviewed constitute personal notes and observations, and of the

qualified person's right to obtain, without cost, a review of the denial

by the appropriate medical record access review committee. If the

qualified person requests such review, the provider shall, within ten

days of receipt of such request, transmit the information including

personal notes and observations as defined herein, to the chairman of

the appropriate committee with a statement setting forth the specific

reasons for which access was denied. After an in camera review of the

materials provided and after providing all parties a reasonable

opportunity to be heard, the committee shall promptly make a written

determination whether the requested review of the information can

reasonably be expected to cause substantial and identifiable harm to the

subject or others which outweighs the qualified person's right of access

to the information pursuant to paragraph (d) of this subdivision or

whether the requested review would have a detrimental effect as defined

in subdivision two of this section, or whether all or part of the

materials sought to be reviewed constitute personal notes and

observations, and shall accordingly determine whether access to all or

part of such materials shall be granted. In the event that the committee

determines that the request for access shall be granted in whole or in

part, the committee shall notify all parties and the provider shall

grant access pursuant to such determination.

(f) In the event that access is denied in whole or in part because the

requested review of information can reasonably be expected to cause

substantial and identifiable harm to the subject or others which would

outweigh the qualified person's right of access to the information, or

would have a detrimental effect as defined in subdivision two of this

section, the committee shall notify the qualified person of his or her

right to seek judicial review of the provider's determination pursuant

to this section: provided however, that a determination by the committee

as to whether materials sought to be reviewed constitute personal notes

and observations shall not be the subject of judicial review. Within

thirty days of receiving notification of such decision, the qualified

person may commence, upon notice, a special proceeding in supreme court

for a judgment requiring the provider to make available the information

for inspection or copying. The court upon such application and after an

in camera review of the materials provided including the determination

and record of the committee, and after providing all parties an

opportunity to be heard, shall determine whether there exists a

reasonable basis for the denial of access. The relief available pursuant

to this section shall be limited to a judgement requiring the provider

to make available to the qualified person the requested information for

inspection or copying.

(g) Where the written request for patient information under this

section is signed by a distributee of a deceased subject for whom a

personal representative has not been appointed, or from the holder of a

power of attorney from such a distributee, a copy of a certified copy of

the certificate of death of the subject shall be attached to the written

request.

(h) Where the written request for patient information under this

section is signed by the holder of a power of attorney, a copy of the

power of attorney shall be attached to the written request. A written

request under this subdivision shall be subject to the duration and

terms of the power of attorney.

(i) The release of patient information shall be subject to: (i)

article twenty-seven-F of this chapter in the case of confidential

HIV-related information; (ii) section seventeen of this article and

sections twenty-three hundred one, twenty-three hundred six and

twenty-three hundred eight of this chapter in the case of termination of

a pregnancy and treatment for a sexually transmitted disease; (iii)

article thirty-three of the mental hygiene law; and (iv) any other

provisions of law creating special requirements relating to the release

of patient information, including the federal health insurance

portability and accountability act of 1996 and its implementing

regulations.

4. Medical record access review committees. The commissioner shall

designate medical record access review committees to hear appeals of the

denial of access to patient information as provided in paragraph (e) of

subdivision three of this section. The commissioner shall promulgate

rules and regulations necessary to effectuate the provisions of this

subdivision.

5. Annual report. The commissioner shall submit an annual report on or

before December thirty-first to the governor and the legislature. Such

report shall include, but not be limited to, the number of requests for

committee review of providers' denial of access and the committees'

determinations thereon.

6. Disclosure to third persons. Whenever a health care provider, as

otherwise authorized by law, discloses patient information to a person

or entity other than the subject of such information or to other

qualified persons, either a copy of the subject's written authorization

shall be added to the patient information or the name and address of

such third party and a notation of the purpose for the disclosure shall

be indicated in the file or record of such subject's patient information

maintained by the provider provided, however, that for disclosures made

to government agencies making payments on behalf of patients or to

insurance companies licensed pursuant to the insurance law such a

notation shall only be entered at the time the disclosure is first made.

This subdivision shall not apply to disclosure to practitioners or other

personnel employed by or under contract with the facility, or to

government agencies for purposes of facility inspections or professional

conduct investigations. Any disclosure made pursuant to this section

shall be limited to that information necessary in light of the reason

for disclosure. Information so disclosed should be kept confidential by

the party receiving such information and the limitations on such

disclosure in this section shall apply to such party.

7. Applicability of federal law. Whenever federal law or applicable

federal regulations affecting the release of patient information are a

condition for the receipt of federal aid, and are inconsistent with the

provisions of this section, the provisions of federal law or federal

regulations shall be controlling.

8. Challenges to accuracy. A qualified person may challenge the

accuracy of information maintained in the patient information and may

require that a brief written statement prepared by him or her concerning

the challenged information be inserted into the patient information.

This statement shall become a permanent part of the patient information

and shall be released whenever the information at issue is released.

This subdivision shall apply only to factual statements and shall not

include a provider's observations, inferences or conclusions.

A facility may place reasonable restrictions on the time and frequency

of any challenges to accuracy.

9. Waivers void. Any agreement by an individual to waive any right to

inspect, copy or seek correction of patient information as provided for

in this section shall be deemed to be void as against public policy and

wholly unenforceable.

10. Nothing contained in this section shall restrict, expand or in any

way limit the disclosure of any information pursuant to articles

twenty-three, thirty-one and forty-five of the civil practice law and

rules or section six hundred seventy-seven of the county law.

11. No proceeding shall be brought or penalty assessed, except as

provided for in this section, against a health care provider, who in

good faith, denies access to patient information.

12. Immunity from liability. No health care provider shall be

subjected to civil liability arising solely from granting or providing

access to any patient information in accordance with this section.

13. (a) A health care provider which has in its possession patient

information and/or patient medical records and which has determined to

permanently cease to do business or practice in this state shall, at

least thirty days prior to such action, make a good faith effort to

notify each of the health care provider's current patients that the

office will be closing and to inform each such patient of his or her

right to request that his or her patient information and/or patient

medical records be sent to a health care provider, health care facility

or health care practitioner of the patient's choosing or, alternatively,

that such information and records be returned to the patient.

(b) The provisions of this subdivision shall not affect any rights

afforded pursuant to section seventeen of this title.

(c) Nothing in this subdivision shall affect the period of time that a

health care provider is lawfully required to retain a patient's medical

information and medical records.

(d) The provisions of this subdivision shall only apply with respect

to a patient whose chart includes written permission to receive the

notification described in paragraph (a) of this subdivision.

* NB There are 2 § 18's