N.Y. Public Health Law § 2181: COVID-19 contact tracing; confidentiality

§ 2181. COVID-19 contact tracing; confidentiality. 1. (a) All contact

tracing information shall be kept confidential by any contact tracer,

contact tracing entity, or designated non-governmental entity and may

not be disclosed except as necessary to carry out contact tracing or a

permitted purpose. A designated non-governmental entity may only act in

relation to contact tracing information as explicitly authorized by this

title.

(b) Where a contact tracer or contact tracing entity discloses contact

tracing information for a permitted purpose, the contact tracer or

contact tracing entity shall make a record of the disclosure, including

to whom it was made and when it was made, which shall be part of the

contact tracing information.

(c) Nothing in this title prohibits otherwise lawful voluntary

reporting, at the discretion of the contact tracer, reasonably and in

good faith: (i) to the statewide central registry under title six of

article six of the social services law, adult protective services under

titles one and two of article nine-B of the social services law, or the

justice center for the protection of people with special needs under

article eleven of the social services law; or (ii) to a governmental or

non-governmental emergency reporting system (such as a "911," domestic

violence or suicide prevention system) to prevent imminent risk of

injury to any person.

(d) This title does not limit disclosure to or by, or possession or

use by, the case individual or contact individual who is the subject of

the information.

2. (a) An individual may waive the confidentiality provided for by

this section, only by a written, informed and voluntary waiver, in plain

language and in a language understandable to the individual making the

waiver, and not part of any other document. The waiver shall state the

scope and limit of the waiver. No contact tracer, contact tracing entity

or governmental or non-governmental entity may seek or act in reliance

on a waiver to distribute, sell, or otherwise disclose identifiable or

de-identified data to any individual or entity. Provided however,

nothing in this subdivision shall prohibit distribution or disclosure

that is otherwise explicitly authorized by this section. If an

individual lacks the capacity to make a waiver, an individual authorized

to consent to health care for the individual, or the individual's legal

representative, may make the waiver. However, a waiver of

confidentiality is not required to be written if it is solely for the

purpose of arranging or providing support for the individual who is the

subject of the contact tracing information, provided the consent is

informed and voluntary.

(b) A waiver of confidentiality under this section shall only apply

for the purpose of arranging or providing support if the individual who

is the subject of the contact tracing information (or, if the individual

lacks the capacity to provide informed consent, an individual authorized

to consent to health care for the individual, or the individual's legal

representative) provides voluntary informed consent to the arranging or

providing of the support.

3. A disclosure of contact tracing information authorized under this

section shall be limited in scope as to the identity of any individual,

the information to be disclosed, and the party to which disclosure may

be made, and as necessary to achieve the purpose of the disclosure under

this section, and shall not authorize re-disclosure except as explicitly

authorized by the terms of the waiver under this section. However, this

section does not bar disclosure of contact tracing information

pertaining to and identifying a case individual or contact individual by

the individual who is identified.

4. (a) This section does not bar otherwise-lawful disclosure,

possession or use of de-identified contact tracing information,

including aggregate contact tracing information. Disclosure, possession

or use under this subdivision shall only be for a public health or

public health research or evaluation purpose as determined by the

commissioner (or the commissioner of the New York city department of

health and mental hygiene in the case of contact tracing information

collected by or under authority of the New York city department of

health and mental hygiene or the New York city health and hospitals

corporation), and shall not authorize re-disclosure or other use.

(b) A person or entity may only disclose, possess or use de-identified

contact tracing information if the person or entity, and the person or

entity to which it is disclosed, maintains technical safeguards and

policies and procedures that prevent re-identification, whether

intentional or unintentional, of any individual, as may be required by

the commissioner (or the New York city commissioner of health and mental

hygiene in the case of contact tracing information collected by or under

authority of the New York city department of health and mental hygiene

or the New York city health and hospitals corporation). The commissioner

(or the New York city commissioner as the case may be) shall require

safeguards, policies and procedures under this paragraph as the

commissioner deems practicable.

(c) Disclosure, possession and use of de-identified contact tracing

information under this subdivision shall be only pursuant to approval by

the commissioner (or the New York city commissioner of health and mental

hygiene in the case of contact tracing information collected by or under

authority of the New York city department of health and mental hygiene

or the New York city health and hospitals corporation) specifying the

purpose, nature and scope of the disclosure, possession and use and

measures to ensure that it will comply with this section and the terms

of the approval.

5. No law enforcement agent or entity or immigration authority shall

be a contact tracer or contact tracing entity or engage in contact

tracing. This subdivision does not bar an individual who is associated

with a law enforcement entity or immigration authority from acting only

as a case individual or contact individual. This subdivision does not

prevent a law enforcement agent or entity from assisting in a permitted

use under paragraph (b) of subdivision eleven of section twenty-one

hundred eighty of this title.

6. No contact tracer, contact tracing entity or designated

non-governmental entity may provide contact tracing information to a law

enforcement agent, entity or immigration authority, or any individual or

entity other than the contact tracing entity from which it received the

information, except as explicitly authorized by this title. Without

consent under subdivision two of this section, contact tracing

information and any evidence derived therefrom shall not be subject to

or provided in response to any legal process or be admissible for any

purpose in any judicial or administrative action or proceeding. However,

this subdivision does not restrict providing information, relating to a

specified case individual or contact individual, where and only to the

extent necessary for a permitted purpose.

7. (a) Contact tracing entities shall establish appropriate

administrative, technical and physical safeguards, policies and

procedures that ensure the security of contact tracing information under

the entity's jurisdiction. The safeguards, policies and procedures must

ensure contact tracing information is encrypted and protected at least

as much as or more than other confidential information under the

entity's jurisdiction. All storage of contact tracing information shall

meet the requirements of this title. The commissioner (or the New York

city commissioner of health and mental hygiene in the case of contact

tracing information collected by or under authority of the New York city

department of health and mental hygiene or the New York city health and

hospitals corporation) shall make regulations as reasonably necessary to

require that contact tracing information possessed, used or under the

control of a contact tracer or contact tracing entity shall be subject

to technical safeguards, policies and procedures for storage,

transmission, use and protection of the information. The regulations

shall prevent possession, use or disclosure of the contact tracing

information not permitted by this title, and shall be at least as or

more protective than the safeguards, policies and procedures the

commissioner (or the New York city commissioner as the case may be)

provides for other confidential information.

(b) This paragraph applies to a contact tracer or contact tracing

entity that is a non-governmental individual or entity employed by or

under contract with a governmental entity, or an agent thereof. Within

sixty days of collecting or receiving the contact tracing information,

the entity shall (i) remove information from its possession or control

and deliver it to the appropriate governmental contact tracing entity or

a designated non-governmental entity specified by the governmental

contact tracing entity, retaining no copy of it; (ii) expunge the

information from its possession or control; or (iii) de-identify the

information. However, the expungement or de-identification of

particular contact tracing information may be postponed for up to

fifteen days after the initial sixty day period while the contact tracer

or contact tracing entity is actively engaged in contact tracing using

that information, provided that the case individual or contact

individual to whom it pertains gives voluntary informed consent. The

disclosure, possession and use of the de-identified contact tracing

information shall be subject to subdivision four of this section.