N.Y. Public Health Law § 3371: Confidentiality of certain records, reports, and information

§ 3371. Confidentiality of certain records, reports, and information.

1. No person, who has knowledge by virtue of his or her office of the

identity of a particular patient or research subject, a manufacturing

process, a trade secret or a formula shall disclose such knowledge, or

any report or record thereof, except:

(a) to another person employed by the department, for purposes of

executing provisions of this article;

(b) pursuant to judicial subpoena or court order in a criminal

investigation or proceeding;

(c) to an agency, department of government, or official board

authorized to regulate, license or otherwise supervise a person who is

authorized by this article to deal in controlled substances, or in the

course of any investigation or proceeding by or before such agency,

department or board;

(d) to the prescription monitoring program registry and to authorized

users of such registry as set forth in subdivision two of this section;

(e) to a practitioner to inform him or her that a patient may be under

treatment with a controlled substance by another practitioner for the

purposes of subdivision two of this section, and to facilitate the

department's review of individual challenges to the accuracy of

controlled substances histories pursuant to subdivision six of section

thirty-three hundred forty-three-a of this article;

(f) to a pharmacist to provide information regarding prescriptions for

controlled substances presented to the pharmacist for the purposes of

subdivision two of this section and to facilitate the department's

review of individual challenges to the accuracy of controlled substances

histories pursuant to subdivision six of section thirty-three hundred

forty-three-a of this article;

(g) to the deputy attorney general for medicaid fraud control, or his

or her designee, in furtherance of an investigation of fraud, waste or

abuse of the Medicaid program, pursuant to an agreement with the

department;

(h) to a local health department for the purpose of conducting public

health research or education: (i) pursuant to an agreement with the

commissioner; (ii) when the release of such information is deemed

appropriate by the commissioner; (iii) for use in accordance with

measures required by the commissioner to ensure that the security and

confidentiality of the data is protected; and (iv) provided that

disclosure is restricted to individuals within the local health

department who are engaged in the research or education;

(i) to a medical examiner or coroner who is an officer of or employed

by a state or local government, pursuant to his or her official duties;

and

(j) to an individual for the purpose of providing such individual with

his or her own controlled substance history or, in appropriate

circumstances, in the case of a patient who lacks capacity to make

health care decisions, a person who has legal authority to make such

decisions for the patient and who would have legal access to the

patient's health care records, if requested from the department pursuant

to subdivision six of section thirty-three hundred forty-three-a of this

article or from a treating practitioner pursuant to subparagraph (iv) of

paragraph (a) of subdivision two of this section.

* 2. The prescription monitoring program registry may be accessed,

under such terms and conditions as are established by the department for

purposes of maintaining the security and confidentiality of the

information contained in the registry, by:

(a) a practitioner, or a designee authorized by such practitioner

pursuant to paragraph (b) of subdivision two of section thirty-three

hundred forty-three-a, section thirty-three hundred sixty-one of this

article or section thirty of the cannabis law, for the purposes of: (i)

informing the practitioner that a patient may be under treatment with a

controlled substance by another practitioner; (ii) providing the

practitioner with notifications of controlled substance activity as

deemed relevant by the department, including but not limited to a

notification made available on a monthly or other periodic basis through

the registry of controlled substances activity pertaining to his or her

patient; (iii) allowing the practitioner, through consultation of the

prescription monitoring program registry, to review his or her patient's

controlled substances history as required by section thirty-three

hundred forty-three-a, section thirty-three hundred sixty-one of this

article or section thirty of the cannabis law; and (iv) providing to his

or her patient, or person authorized pursuant to paragraph (j) of

subdivision one of this section, upon request, a copy of such patient's

controlled substance history as is available to the practitioner through

the prescription monitoring program registry; or

(b) a pharmacist, pharmacy intern or other designee authorized by the

pharmacist pursuant to paragraph (b) of subdivision three of section

thirty-three hundred forty-three-a of this article, for the purposes of:

(i) consulting the prescription monitoring program registry to review

the controlled substances history of an individual for whom one or more

prescriptions for controlled substances or certifications for cannabis

is presented to the pharmacist, pursuant to section thirty-three hundred

forty-three-a of this article; and (ii) receiving from the department

such notifications of controlled substance activity as are made

available by the department; or

(c) an individual employed by a registered organization as defined in

section three of the cannabis law, for the purpose of consulting the

prescription monitoring program registry to review the controlled

substances history of an individual for whom one or more certifications

for cannabis is presented to that registered organization, pursuant to

section thirty-three hundred sixty-four of this article or section

thirty-four of the cannabis law. Unless otherwise authorized by this

article or by the cannabis law, an individual employed by a registered

organization will be provided access to the prescription monitoring

program in the sole discretion of the commissioner.

* NB Effective until July 5, 2028

* 2. The prescription monitoring program registry may be accessed,

under such terms and conditions as are established by the department for

purposes of maintaining the security and confidentiality of the

information contained in the registry, by:

(a) a practitioner, or a designee authorized by such practitioner

pursuant to paragraph (b) of subdivision two of section thirty-three

hundred forty-three-a of this article, for the purposes of: (i)

informing the practitioner that a patient may be under treatment with a

controlled substance by another practitioner; (ii) providing the

practitioner with notifications of controlled substance activity as

deemed relevant by the department, including but not limited to a

notification made available on a monthly or other periodic basis through

the registry of controlled substances activity pertaining to his or her

patient; (iii) allowing the practitioner, through consultation of the

prescription monitoring program registry, to review his or her patient's

controlled substances history as required by section thirty-three

hundred forty-three-a of this article; and (iv) providing to his or her

patient, or person authorized pursuant to paragraph (j) of subdivision

one of this section, upon request, a copy of such patient's controlled

substance history as is available to the practitioner through the

prescription monitoring program registry; or

(b) a pharmacist, pharmacy intern or other designee authorized by the

pharmacist pursuant to paragraph (b) of subdivision three of section

thirty-three hundred forty-three-a of this article, for the purposes of:

(i) consulting the prescription monitoring program registry to review

the controlled substances history of an individual for whom one or more

prescriptions for controlled substances is presented to the pharmacist,

pursuant to section thirty-three hundred forty-three-a of this article;

and (ii) receiving from the department such notifications of controlled

substance activity as are made available by the department.

* NB Effective July 5, 2028

3. Where it has reason to believe that a crime related to the

diversion of controlled substances has been committed, the department

may notify appropriate law enforcement agencies and provide relevant

information about the suspected criminal activity, including controlled

substances prescribed or dispensed, as reasonably appears to be

necessary. The department shall keep a record of the information

provided, including, but not limited to: the specific information

provided and the agency to which such information was provided,

including the name and title of the person to whom such information was

provided and an attestation from such person that he or she has

authority to receive such information.

4. In the course of any proceeding where such information is

disclosed, except when necessary to effectuate the rights of a party to

the proceeding, the court or presiding officer shall take such action as

is necessary to insure that such information, or record or report of

such information is not made public.