N.Y. Public Health Law § 2782: Confidentiality and disclosure

§ 2782. Confidentiality and disclosure. 1. No person who obtains

confidential HIV related information in the course of providing any

health or social service or pursuant to a release of confidential HIV

related information may disclose or be compelled to disclose such

information, except to the following:

(a) the protected individual or, when the protected individual lacks

capacity to consent, a person authorized pursuant to law to consent to

health care for the individual;

(b) any person to whom disclosure is authorized pursuant to a release

of confidential HIV related information;

(c) an agent or employee of a health facility or health care provider

if (1) the agent or employee is permitted to access medical records, (2)

the health facility or health care provider itself is authorized to

obtain the HIV related information, and (3) the agent or employee

provides health care to the protected individual, or maintains or

processes medical records for billing or reimbursement;

(d) a health care provider or health facility when knowledge of the

HIV related information is necessary to provide appropriate care or

treatment to the protected individual, a child of the individual, a

contact of the protected individual or a person authorized to consent to

health care for such a contact;

(e) a health facility or health care provider, in relation to the

procurement, processing, distributing or use of a human body or a human

body part, including organs, tissues, eyes, bones, arteries, blood,

semen, or other body fluids, for use in medical education, research,

therapy, or for transplantation to individuals;

(f) health facility staff committees or accreditation or oversight

review organizations authorized to access medical records; provided that

such committees or organizations may only disclose confidential HIV

related information: (1) back to the facility or provider of a health or

social service; (2) to carry out the monitoring, evaluation, or service

review for which it was obtained; or (3) to a federal, state or local

government agency for the purposes of and subject to the conditions

provided in subdivision six of this section;

(g) a federal, state, county or local health officer when such

disclosure is mandated by federal or state law;

(h) an authorized agency in connection with foster care or adoption of

a child. Such agency shall be authorized to redisclose such information

only pursuant to this article or in accordance with the provisions of

subdivision eight of section three hundred seventy-two and section three

hundred seventy-three-a of the social services law;

(i) third party reimbursers or their agents to the extent necessary to

reimburse health care providers for health services; provided that,

where necessary, an otherwise appropriate authorization for such

disclosure has been secured by the provider;

(j) an insurance institution, for other than the purpose set forth in

paragraph (i) of this subdivision, provided the insurance institution

secures a dated and written authorization that indicates that health

care providers, health facilities, insurance institutions, and other

persons are authorized to disclose information about the protected

individual, the nature of the information to be disclosed, the purposes

for which the information is to be disclosed and which is signed by: (1)

the protected individual; (2) if the protected individual lacks the

capacity to consent, such other person authorized pursuant to law to

consent for such individual; or (3) if the protected individual is

deceased, the beneficiary or claimant for benefits under an insurance

policy, a health services plan, or an employee welfare benefit plan as

defined in 29 U.S.C. 1002(1), covering such protected individual;

(k) any person to whom disclosure is ordered by a court of competent

jurisdiction pursuant to section twenty-seven hundred eighty-five of

this article;

(l) an employee or agent of the department of corrections and

community supervision, in accordance with paragraph (a) of subdivision

two of section twenty-seven hundred eighty-six of this article, to the

extent the employee or agent is authorized to access records containing

such information in order to carry out the department's functions,

powers and duties with respect to the protected individual, pursuant to

section two hundred fifty-nine-a of the executive law;

(m) an employee or agent of the office of probation and correctional

alternatives or any local probation department, in accordance with

paragraph (a) of subdivision two of section twenty-seven hundred

eighty-six of this article, to the extent the employee or agent is

authorized to access records containing such information in order to

carry out the office's or department's functions, powers and duties with

respect to the protected individual, pursuant to articles twelve and

twelve-A of the executive law;

(n) a medical director of a local correctional facility as defined in

section forty of the correction law, in accordance with paragraph (a) of

subdivision two of section twenty-seven hundred eighty-six of this

article, to the extent the medical director is authorized to access

records containing such information in order to carry out his or her

functions, powers and duties with respect to the protected individual;

(o) an employee or agent of the commission of correction, in

accordance with paragraph (a) of subdivision two of section twenty-seven

hundred eighty-six of this article, to the extent the employee or agent

is authorized to access records containing such information in order to

carry out the commission's functions, powers and duties with respect to

the protected individual, pursuant to article three of the correction

law;

(p) an attorney appointed to represent a minor pursuant to the social

services law or the family court act, with respect to confidential HIV

related information relating to the minor and for the purpose of

representing the minor. If the minor has the capacity to consent, the

minor's attorney may not redisclose confidential HIV related information

without the minor's permission. If the minor lacks capacity to consent,

the minor's attorney may redisclose confidential HIV related information

for the sole purpose of representing the minor. This paragraph shall not

limit the ability of the minor's attorney to seek relief under section

twenty-seven hundred eighty-five of this chapter.

(q) an executor or an administrator of an estate shall have access to

the confidential HIV information of a deceased person as needed to

fulfill his or her responsibilities/duties as an executor or

administrator.

(r) qualified researchers for medical research purposes upon the

approval of a research protocol by a human research review committee

established and approved under the provisions of article twenty-four-A

of this chapter or by an institutional review board established and

approved under the provisions of 45 CFR part 46 or 42 USC 300 V-1, for

the purpose of reviewing and monitoring research involving human

subjects, provided that in no event shall any qualified researcher

disclose information tending to identify the subjects of the research.

(s) an employee or agent of the board of correction of the city of New

York, in accordance with paragraph (a) of subdivision two of section

twenty-seven hundred eighty-six of this article, to the extent the

employee or agent is authorized to access records containing such

information in order to carry out the board's functions, powers and

duties with respect to the protected individual, pursuant to the charter

of the city of New York.

2. A state, county or local health officer may disclose confidential

HIV related information when:

(a) disclosure is specifically authorized or required by federal or

state law; or

(b) disclosure is made pursuant to a release of confidential HIV

related information; or

(c) disclosure is requested by a physician pursuant to subdivision

four of this section; or

(d) disclosure is authorized by court order pursuant to the provisions

of section twenty-seven hundred eighty-five of this article.

3. No person to whom confidential HIV related information has been

disclosed pursuant to this article shall disclose the information to

another person except as authorized by this article, provided, however,

that the provisions of this subdivision shall not apply:

(a) to the protected individual; or

(b) to a natural person who is authorized pursuant to law to consent

to health care for the protected individual; or

(c) to a protected individual's foster parent as defined in section

three hundred seventy-one of the social services law and subject to

regulations promulgated pursuant to paragraph (a) of subdivision two of

section twenty-seven hundred eighty-six of this article, for the purpose

of providing care, treatment or supervision of the protected individual;

or

(d) a prospective adoptive parent as specified in section three

hundred seventy-three-a of the social services law and subject to

regulations promulgated pursuant to paragraph (a) of subdivision two of

section twenty-seven hundred eighty-six of this article with whom a

child who is the protected individual has been placed for adoption; or

(e) to a relative or other person legally responsible to whom a child

who is the protected individual is to be placed or discharged pursuant

to section ten hundred seventeen or ten hundred fifty-five of the family

court act and subject to regulations promulgated pursuant to paragraph

(a) of subdivision two of section twenty-seven hundred eighty-six of

this article, for the purpose of providing care, treatment or

supervision of the protected individual.

4. (a) A physician may disclose confidential HIV related information

under the following conditions:

(1) disclosure is made to a contact, to a public health officer for

the purpose of making the disclosure to said contact and pursuant to

section twenty-one hundred thirty of this chapter; or

(2) the physician believes disclosure is medically appropriate and

there is a significant risk of infection to the contact; and

(3) the physician has counseled the protected individual regarding the

need to notify the contact; and

(4) the physician has informed the protected individual of his or her

intent to make such disclosure to a contact, the physician's

responsibility to report the infected individual's case pursuant to

section twenty-one hundred thirty of this chapter and has given the

protected individual the opportunity to express a preference as to

whether disclosure should be made by the physician directly or to a

public health officer for the purpose of said disclosure. If the

protected individual expresses a preference for disclosure by a public

health officer, the physician shall honor such preference.

(5) If a physician chooses to make a notification pursuant to this

section, he or she shall report to the municipal health commissioner of

district health officer on his or her efforts to notify the contacts of

the protected individual. Such report shall be in a manner and on forms

prescribed by the commissioner and shall include the identity of the

protected individual and any contacts as well as information as to

whether the contacts were successfully notified.

(6) Within a reasonable time of receiving a report that a physician or

his or her designated agent did not notify or verify notification of

contacts provided by the protected individual, the health commissioner

or district health officer of the municipality from which the report

originates shall take reasonable measures to notify such contacts and

otherwise comply with the provisions of this chapter.

(b) When making such disclosures to the contact, the physician or

public health officer shall provide or make referrals for the provision

of the appropriate medical advice and counseling for coping with the

emotional consequences of learning the information and for changing

behavior to prevent transmission or contraction of HIV infection. The

physician or public health officer shall not disclose the identity of

the protected individual or the identity of any other contact. A

physician or public health officer making a notification pursuant to

this subdivision shall make such disclosure in person, except where

circumstances reasonably prevent doing so.

(c) A physician or public health officer shall have no obligation to

identify or locate any contact except as provided pursuant to title

three of article twenty-one of this chapter.

(d) A physician may, upon the consent of a parent or guardian,

disclose confidential HIV related information to a state, county, or

local health officer for the purpose of reviewing the medical history of

a child to determine the fitness of the child to attend school.

(e) A physician may disclose confidential HIV related information

pertaining to a protected individual to a person (known to the

physician) authorized pursuant to law to consent to health care for a

protected individual when the physician reasonably believes that: (1)

disclosure is medically necessary in order to provide timely care and

treatment for the protected individual; and (2) after appropriate

counseling as to the need for such disclosure, the protected individual

will not inform a person authorized by law to consent to health care;

provided, however, that the physician shall not make such disclosure if,

in the judgment of the physician: (A) the disclosure would not be in the

best interest of the protected individual; or (B) the protected

individual is authorized pursuant to law to consent to such care and

treatment. Any decision or action by a physician under this paragraph,

and the basis therefor, shall be recorded in the protected individual's

medical record.

5. (a) Whenever disclosure of confidential HIV related information is

made pursuant to this article, except for disclosures made pursuant to

paragraphs (a), (d) and (i) of subdivision one of this section or

paragraph (a) or (e) of subdivision four of this section, such

disclosure shall be accompanied or followed by a statement in writing

which includes the following or substantially similar language: "This

information has been disclosed to you from confidential records which

are protected by state law. State law prohibits you from making any

further disclosure of this information without the specific written

consent of the person to whom it pertains, or as otherwise permitted by

law. Any unauthorized further disclosure in violation of state law may

result in a fine or jail sentence or both. A general authorization for

the release of medical or other information is NOT sufficient

authorization for further disclosure." An oral disclosure shall be

accompanied or followed by such a notice within ten days.

(b) Except for disclosures made pursuant to paragraph (c) of

subdivision one of this section, or to persons reviewing information or

records in the ordinary course of ensuring that a health facility is in

compliance with applicable quality of care standards or any other

authorized program evaluation, program monitoring or service review, or

to governmental agents requiring information necessary for payments to

be made on behalf of patients or clients pursuant to contract or in

accordance to law, a notation of all such disclosures shall be placed in

the medical record of a protected individual, who shall be informed of

such disclosures upon request; provided, however, that for disclosures

made to insurance institutions such a notation need only be entered at

the time the disclosure is first made.

6. (a) The provisions of this subdivision shall apply where a provider

of a health or social service possesses confidential HIV related

information relating to individuals who are recipients of the service,

and a federal, state or local government agency supervises or monitors

the provider or administers the program under which the service is

provided.

(b) Confidential HIV related information relating to a recipient of

such service may be disclosed in accordance with regulations promulgated

pursuant to paragraph (a) of subdivision two of section twenty-seven

hundred eighty-six of this article to an authorized employee or agent of

such provider or government agency, when reasonably necessary for such

supervision, monitoring, administration, or provision of such service.

The term "authorized employee or agent", as used in this subdivision

shall only include any employee or agent who would, in the ordinary

course of business of the provider or government agency, have access to

records relating to the care of, treatment of, or provision of a health

or social service to the protected individual.

7. Nothing in this section shall limit a person's or agency's

responsibility or authority to report, investigate, or redisclose, child

protective and adult protective services information in accordance with

title six of article six and titles one and two of article nine-B of the

social services law, or to provide or monitor the provision of child and

adult protective or preventive services.

8. Confidential HIV related information shall be recorded in the

medical record of the protected individual. The provisions of this

section shall not prohibit the listing of acquired immune deficiency

syndrome, HIV related illness or HIV infection in a certificate of

death, autopsy report or related documents prepared pursuant to article

forty-one of this chapter or other applicable laws, ordinances, rules or

regulations relating to the documentation of cause of death, nor shall

this section be construed to modify any laws, ordinances, rules or

regulations relative to access to death certificates, autopsy reports or

such other related documents. Under no circumstances shall confidential

HIV related information be disclosable pursuant to article six of the

public officers law. Notwithstanding the foregoing, confidential HIV

information obtained pursuant to section 390.15 of the criminal

procedure law or section 347.1 of the family court act by either court

order or consent of the protected individual shall not be recorded in

the medical record of the protected individual unless he or she consents

to the recording of such information in a written statement containing

the relevant information specified in subdivision two of section two

thousand seven hundred eighty-one of this article.

9. Confidential HIV related information shall be disclosed upon the

request of the health care worker HIV/HBV advisory panel, established

pursuant to article twenty-seven-DD of this chapter, to the panel or its

designee only when reasonably necessary for the evaluation of a worker

who has voluntarily sought the panel's review.