N.Y. Social Services Law § 111-v: Confidentiality, integrity, and security of information

§ 111-v. Confidentiality, integrity, and security of information. 1.

The department, in consultation with appropriate agencies including but

not limited to the New York state office for the prevention of domestic

violence, shall by regulation prescribe and implement safeguards on the

confidentiality, integrity, accuracy, access, and the use of all

confidential information and other data handled or maintained, including

data obtained pursuant to section one hundred eleven-o of this article

and including such information and data maintained in the automated

child support enforcement system. Such information and data shall be

maintained in a confidential manner designed to protect the privacy

rights of the parties and shall not be disclosed except for the purpose

of, and to the extent necessary to, establish paternity, or establish,

modify or enforce an order of support.

2. These safeguards shall include provisions for the following:

(a) Policies restricting access to and sharing of information and

data, including:

(1) safeguards against unauthorized use or disclosure of information

relating to procedures or actions to establish paternity or to establish

or enforce support;

(2) prohibitions against the release of information on the whereabouts

of one party to another party against whom an order of protection with

respect to the former party has been entered; and

(3) prohibitions against the release of information on the whereabouts

of one party to another party if the department has reason to believe

that the release of the information may result in the physical or

emotional harm to the former party.

(b) Systems controls to ensure strict adherence to policies.

(c) Monitoring of access to and use of the automated system to prevent

unauthorized access or use.

(d) Training in security procedures for all staff with access, and

provisions of information regarding these requirements and penalties.

(e) Administrative penalties for unauthorized access, disclosure, or

use of confidential data.

3. If any person discloses confidential information in violation of

this section, any individual who incurs damages due to the disclosure

may recover such damages in a civil action.

4. Any person who willfully releases or permits the release of any

confidential information obtained pursuant to this title to persons or

agencies not authorized by this title or regulations promulgated

thereunder to receive it shall be guilty of a class A misdemeanor.

5. The safeguards established pursuant to this section shall apply to

staff of the department, local social services districts, and any

contractor.