N.Y. Public Health Law § 4410: Health maintenance organizations; professional services

§ 4410. Health maintenance organizations; professional services. 1.

The provision of comprehensive health services directly or indirectly,

by a health maintenance organization through its comprehensive health

services plan shall not be considered the practice of the profession of

medicine by such organization or plan. However, each member, employee or

agent of such organization or plan shall be fully and personally liable

and accountable for any negligent or wrongful act or misconduct

committed by him or any person under his direct supervision and control

while rendering professional services on behalf of such organization or

plan.

2. Unless the patient waives the right of confidentiality, a health

maintenance organization or its comprehensive health services plan shall

not be allowed to disclose any information which was acquired by such

organization or plan in the course of the rendering to a patient of

professional services by a person authorized to practice medicine,

registered professional nursing, licensed practical nursing, or

dentistry, and which was necessary to acquire to enable such person to

act in that capacity, except as may be otherwise required by law. A

non-participating provider shall provide an enrollee's organization with

such patient information as is reasonably required by the organization

to administer its plan. In making such disclosure a provider shall

comply with the provisions of subdivision six of section eighteen of

this chapter concerning the disclosure of patient information to third

parties provided, however, that with respect to a protected individual

as defined in subdivision six of section twenty-seven hundred eighty of

this chapter, disclosure shall be made only pursuant to an enrollee's

written authorization and shall otherwise be consistent with the

requirements of such section and rules and regulations promulgated

pursuant thereto.

3. Notwithstanding the provisions of this section, the provisions of

section four hundred twenty-two of the social services law shall apply

to any information or reports submitted by a health maintenance

organization to the statewide central register of child abuse and

maltreatment reports.

4. (a) The commissioner shall have access to patient-specific medical

information, including encounter data, maintained by a health

maintenance organization or other organization certified pursuant to

this article for the purposes of quality assurance and oversight,

subject to any other limitations of federal and state law regarding

disclosure thereof to third parties and subject to the provisions of

this subdivision. The provisions of sections thirty-one hundred one, and

forty-five hundred four, forty-five hundred seven and forty-five hundred

eight of the civil practice law and rules, subdivision three of this

section and section 33.13 of the mental hygiene law, shall not bar

disclosure by the health maintenance organization to the commissioner

for such purposes.

(b) The commissioner may only obtain enrollee information subject to

the establishment of protocols that will ensure that such

patient-specific information is not disclosed to third parties other

than to entities serving as agents of the state for the purposes of

quality assurance and oversight. Such protocols shall be developed in

consultation with representatives of health maintenance organizations,

health care provider organizations and consumer organizations and shall,

where possible, include the development of a unique confidential

identifier to be used in connection with patient-specific data. These

protocols shall address issues relating to the collection, maintenance,

and disclosure of such patient-specific information. Such protocols

shall be promulgated as regulations, provided however, that protocols or

regulations in use prior to the effective date of this subdivision shall

remain in effect until the regulations developed hereunder are

promulgated.

(c) In addition to any other sanction or penalty as provided by law,

any employee of the department who willfully violates this regulation or

any other rule or procedure pertaining to the disclosure of any material

collected pursuant to this subdivision shall be deemed to have committed

an act of misconduct and shall be disciplined in accordance with the

provisions of the civil service law.