N.Y. Public Health Law § 3006-a: Patient privacy

§ 3006-a. Patient privacy. 1. As used in this section:

(a) "Individual identifying information" means information identifying

or tending to identify a patient.

(b) "Marketing" means advertising, detailing, marketing, promotion, or

any other activity that is intended to be used to influence business

volume, sales or market share or evaluate the effectiveness of marketing

practices or marketing personnel, regardless of whether the beneficiary

of the marketing is a governmental, for-profit, or not-for-profit

entity.

2. No ambulance service, advanced life support first response service,

or employee, member or agent thereof shall disclose, sell, transfer,

exchange, provide or use any individual identifying information to any

person or entity for the purpose of marketing.

3. Notwithstanding subdivision two of this section, and subject to

otherwise applicable law, individual identifying information may be:

(a) disclosed, sold, transferred or exchanged to:

(i) the patient who is the subject of the information, or a person

authorized to make health care decisions for the patient;

(ii) a health care provider providing care or treatment to the

patient, for the purpose of such care or treatment; or a health

information system subject to regulations of the department, for the

purpose of such care or treatment;

(iii) an officer, inspector or investigator for a government health,

licensing or law enforcement agency acting under appropriate legal

authority;

(iv) a person authorized by a court order or a subpoena to receive

such information;

(v) the patient's health plan, insurer, or third party payer, or an

agent thereof, for the purpose of payment or reimbursement for health

care services, including determining compliance with the terms of

coverage or medical necessity, or utilization review;

(vi) a person or entity to whom, and for a purpose for which,

disclosure or transfer is otherwise explicitly authorized or required by

law;

(vii) a person or entity, for the purpose of conducting quality

assurance or evaluating the performance of an ambulance service,

advanced life support first response service, or any employee, member or

agent thereof;

(viii) a person or entity acting as an employee or agent of a person

or entity under any preceding paragraph of this subdivision, for the

purpose of and consistent with that paragraph; or

(ix) a government entity as provided by law; and

(b) used by such ambulance service, advanced life support first

responder service, or employee, member or agent thereof, for training,

promotion, staff recognition or recruitment purposes, consistent with

applicable law, provided the patient or a qualified person as defined by

paragraph (G) of subdivision one of section eighteen of this chapter has

provided consent to such use in a separate, stand-alone document. Such

consent shall be limited to the particular type or types of use and

specific transaction or transactions for which such consent is given.

4. Nothing in this section shall prohibit the collection, use,

transfer, or sale of patient data by zip code, geographic region, or

medical specialty for marketing purposes, providing it does not contain

individual identifying information.

5. This section shall not prevent a person from disclosing, selling,

transferring, or exchanging for value his or her own individual

identifying information, for any purpose; provided that the information

does not include individual identifying information pertaining to any

other person.

6. This section does not prohibit a not-for-profit or governmental

ambulance service or advanced life support first response service, or

agent thereof, from using a patient's name and address in order to

contact such patient or a family member at such address with requests

for donations to such service; providing that such use shall not include

disclosing any individual identifying information.

7. No person or entity to whom or which individual identifying

information is disclosed, sold, transferred or exchanged shall disclose,

sell, transfer or exchange it to any person or entity other than for the

lawful purpose for which it was disclosed, sold, transferred or

exchanged to the person or entity, and without satisfactory assurance

that the recipient will safeguard the records from being disclosed or

used for marketing purposes.

8. This section does not authorize any disclosure, sale, transfer, or

exchange of individual identifying information that is not otherwise

authorized or required by law.

9. In addition to the commissioner's authority to enforce this section

under section three thousand twelve of this article, the attorney

general shall have the authority to bring an action to enforce

compliance with this section without referral by the commissioner.