Current through Register Vol. 46, No. 39, September 25, 2024
(a)
No person who obtains confidential HIV-related information in the course of
providing any health or social service or pursuant to a release of confidential
HIV-related information may disclose or be compelled to disclose such
information, except to the following:
(1) the
protected individual or, when the protected individual lacks capacity to
consent, a qualified person under section 18 of the Public Health Law, a person the
protected individual has authorized to access records relating to the provision
of health care under General Obligations Law article 5, title 15, or person
authorized pursuant to law to consent to health care for the
individual;
(2) any person to whom
disclosure is authorized pursuant to a release of confidential HIV- related
information in accordance with section
63.5(a)
of this Part;
(3) an agent or
employee of a health facility or health care provider if:
(i) the agent or employee is authorized to
access medical records;
(ii) the
health facility or health care provider itself is authorized to obtain the HIV-
related information; and
(iii) the
agent or employee provides health care to the protected individual, or
maintains or processes medical records for billing or reimbursement;
(4)
(i) a health care provider or health facility
when knowledge of the HIV-related information is necessary to provide
appropriate care or treatment to the protected individual or a child of the
individual;
(ii) a health care
provider or health facility when knowledge of HIV-related information is
necessary to provide appropriate care or treatment to a contact or exposed
individual, provided the requirements in section
63.8(m)
of this Part are followed for disclosures involving exposures in risk
situations;
(iii) in circumstances
where consent for health care is necessary, disclosure may also be made to a
person authorized to consent to health care for such contact or for such
protected individual, provided that if disclosure is to a person authorized to
consent to the health care of a contact or to a contact when such contact has
been exposed to HIV under circumstances which present a risk of transmission,
the requirements in section
63.8(m)
of this Part must be followed;
(5) a health facility or health care
provider, in relation to the procurement, or use of a human body or a human
body part, including organs, tissues, blood, semen, or other body fluids, for
use in medical education, research, therapy, or for transplantation to
individuals;
(6) health facility
staff committees, or accreditation or oversight review organizations authorized
to access medical records, provided that such committees or organizations may
only disclose confidential HIV-related information:
(i) back to the facility or provider of a
health or social service;
(ii) to
carry out the monitoring, evaluation, or service review for which it was
obtained; or
(iii) to a Federal,
State or local government agency for the purposes of and subject to the
conditions provided in subdivision (e) of this section;
(7) a Federal, State, county or local health
officer when such disclosure is mandated by Federal or State law, including
reporting and contact notification processes authorized pursuant to article 21,
title III, or pursuant to article 27-F;
(8) authorized agencies as defined by Social
Services Law, section
371 and corporations incorporated or
organized to receive children for adoption or foster care, in connection with
foster care or adoption of a child. Such agency shall be authorized to
redisclose such information only pursuant to the provisions of article 27-F of
the Public Health Law or in accordance with the provisions of Social Services
Law, section
373-A and regulations promulgated
thereunder;
(9) third-party
reimbursers or their agents to the extent necessary to reimburse health care
providers, including health facilities, for health services, provided that, an
otherwise appropriate authorization for such disclosure has been
secured;
(10) an insurance
institution, for other than the purpose set forth in paragraph (9) of this
subdivision, provided the insurance institution secures a dated and written
authorization that indicates that health care providers, health facilities,
insurance institutions, and other persons are authorized to disclose
information about the protected individual, the nature of the information to be
disclosed, the purposes for which the information is to be disclosed and which
is signed by:
(i) the protected
individual;
(ii) if the protected
individual lacks the capacity to consent, such other person authorized pursuant
to law to consent for such individual; or
(iii) if the protected individual is
deceased, the beneficiary or claimant for benefits under an insurance policy, a
health services plan, or an employee welfare benefit plan as authorized in
article 27-F of the Public Health Law;
(11) to a funeral director upon taking charge
of the remains of a deceased person when such funeral director has access in
the ordinary course of business to HIV-related information on the death
certificate of the deceased individual, as authorized by Public Health Law,
section
4142;
(12) any person to whom disclosure is ordered
by a court of competent jurisdiction pursuant to Public Health Law, section
2785;
(13) an employee or agent of the Division of
Probation and Correctional Alternatives, Division of Parole, Commission of
Correction, or any local probation department, to the extent the employee or
agent is authorized to access records containing such information in order to
carry out functions, powers and duties with respect to the protected person and
in accordance with regulations promulgated pursuant to Public Health Law,
article 27-F;
(14) a medical
director of a local correctional facility in accordance with regulations
promulgated pursuant to article 27-F to the extent the medical director is
authorized to access records to carry out his/her functions relating to the
protected person. Redisclosure by the medical director is prohibited except as
permitted under Public Health Law, article 27-F, article 21, title III and
implementing regulations;
(15) an
employee or agent of the New York City Board of Corrections so that the board
may continue to access records of inmates who die while in the custody of the
New York City Department of Corrections when necessary for the board to carry
out its duties, functions, and powers with respect to the protected individual,
pursuant to the New York City charter; or
(16) a law guardian, appointed to represent a
minor pursuant to the Social Services Law or the Family Court Act, for the
purpose of representing that minor. If the minor has the capacity to consent,
the law guardian may not redisclose confidential HIV-related information
without the minor's permission. If the minor lacks capacity to consent, the law
guardian may redisclose confidential HIV-related information for the purpose of
representing the minor;
(17) an
executor or administrator of an estate of a deceased person as needed to
fulfill his or her responsibilities/duties as an executor or administrator;
or
(18) qualified researchers for
medical research purposes upon the approval of a research protocol by a human
research review committee established and approved under the provisions of
article 24 - A of the Public Health Law or by an institutional review board
established and approved under applicable provisions of federal law, for the
purpose of reviewing and monitoring research involving human subjects, provided
that in no event shall any qualified researcher disclose information tending to
identify the subjects of the research.
(b) A State, county or local health officer
may disclose confidential HIV-related information when:
(1) disclosure is specifically authorized or
required by Federal or State law including, but not limited to, Public Health
Law, article 21, title III and Public Health Law, article 27-F; or
(2) disclosure is made pursuant to a release
of confidential HIV-related information; or
(3) disclosure of information regarding a
contact is requested by a physician pursuant to section
63.8 of this
Part; or if the contact resides outside the jurisdiction of the authorized
public health official, the official shall inform the public health official in
the contact's jurisdiction in order to confidentially inform such contact;
or
(4) disclosure is authorized by
court order pursuant to the provisions of Public Health Law, section
2785.
(d) A physician or his/her agent may, upon
the consent of a parent or guardian, disclose confidential HIV- related
information to a State, county, or local health officer for the purpose of
reviewing the medical history of a child to determine the fitness of the child
to attend school.
(e) Confidential
HIV-related information of a protected person may be disclosed to authorized
employees or agents of a governmental agency pursuant to the regulations of the
governmental agency when the person providing health or social services is
regulated, supervised or monitored by the governmental agency or when the
governmental agency administers the health program or a social service program
and when such employees or agents have access to records in the ordinary course
of business and when access is reasonably necessary for regulation,
supervision, monitoring, administration or provision of services. Such
authorized employees or agents may include attorneys authorized by a government
agency when access occurs in the ordinary course of providing legal services
and is reasonably necessary for supervision, monitoring, administration or
provision of services. Such authorized employees or agents may also include
public health officers as needed for conducting epidemiological or surveillance
investigations pursuant to applicable law, rule or regulation. Such
surveillance or investigational data shall also be disclosed by the public
health officer to the State Department of Health as required by the State
Sanitary Code or this Part.
(f)
Confidential HIV-related information of a protected person may be disclosed to
authorized employees or agents of a provider of health or social services when
such provider is either regulated, supervised or monitored by a governmental
agency or when a governmental agency administers the provider's health or
social service program, and when such employees or agents have access to
records in the ordinary course of business and when access is reasonably
necessary for regulation, supervision, monitoring, administration or provision
of services. Such authorized employees or agents may include attorneys
authorized by persons providing health services when access occurs in the
ordinary course of providing legal services and is reasonably necessary for
supervision, monitoring, administration or provision of services.
(g) A physician or his/her agent may disclose
confidential HIV-related information pertaining to a protected individual to a
person, known to the physician or his/her agent, authorized pursuant to law to
consent to the health care for the protected individual when the physician
reasonably believes that:
(1) disclosure is
medically necessary in order to provide timely care and treatment for the
protected individual; and
(2) after
appropriate counseling as to the need for such disclosure the protected
individual will not inform a person authorized by law to consent to health
care; provided, however, that the physician shall not make such disclosure if,
in the judgment of the physician:
(i) the
disclosure would not be in the best interest of the protected individual;
or
(ii) the protected individual is
authorized pursuant to law to consent to such care and treatment. A physician's
decision to disclose pursuant to this paragraph, and the basis for that
decision shall be recorded in the medical record.
(h) No person to whom confidential
HIV-related information has been disclosed shall disclose the information to
another person except as authorized by law, (including, but not limited to,
disclosure authorized by PHL article 21, title III), except that this provision
shall not apply to:
(1) the protected
individual;
(2) a natural person
who is authorized pursuant to law to consent to health care for the protected
individual;
(3) a protected
individual's foster parent, subject to Department of Social Services
regulations, for the purpose of providing care, treatment or supervision to the
protected individual; or
(4) a
prospective adoptive parent, subject to Department of Social Services
regulations, with whom a child has been placed for adoption.
(i) Nothing in this section shall
limit a person's or agency's responsibility or authority to report,
investigate, or redisclose child protective and adult protective services
information in accordance with title 6 of article 6 and titles 1 and 2 of
article 9-B of the Social Services Law, or to provide or monitor the provision
of child and adult protective or preventive services.
