Current through Register Vol. 46, No. 39, September 25, 2024
(a)
Access to an individual's clinical records, including HIV information, shall be
limited to those staff with treatment responsibility for that individual. No
flags on charts, lists on walls, or similar public displays shall be used to
indicate individuals with HIV infection.
(b) No person who obtains confidential
HIV-related information in the course of providing any health or social service
or pursuant to a release of confidential HIV-related information may disclose
or be compelled to disclose such information, except to the following:
(1) the protected individual or, when the
protected individual lacks capacity to consent, a person authorized pursuant to
law to consent to health care for the individual;
(2) any person to whom disclosure is
authorized pursuant to a release of confidential HIV-related
information;
(3) an agent or
employee of a health facility or health care provider if:
(i) the agent or employee is authorized to
access medical records;
(ii) the
health facility or health care provider itself is authorized to obtain the
HIV-related information; and
(iii)
the agent or employee provides health care to the protected individual, or
maintains or processes medical records for billing or reimbursement;
(4) a health care provider or
health facility when knowledge of the HIV-related information is necessary to
provide appropriate care or treatment to the protected individual or a child of
the individual;
(5) a health
facility or health care provider, in relation to the procurement, processing,
distributing or use of a human body or a human body part, including organs,
tissues, eyes, bones, arteries, blood, semen, or other body fluids, for use in
medical education, research, therapy, or for transplantation to
individuals;
(6) health facility
staff committees, or accreditation or oversight review organizations authorized
to access medical records, provided that such committees or organizations may
disclose confidential HIV-related information only:
(i) back to the facility or provider of a
health or social service;
(ii) to
carry out the monitoring, evaluation, or service review for which it was
obtained; or
(iii) to a Federal,
State or local government agency for the purposes of supervising, monitoring or
administering such facility;
(7) a Federal, State, county or local health
officer when such disclosure is mandated by Federal or State law;
(8) authorized agencies as defined by Social
Services Law, section
371 and corporations incorporated or
organized to receive children for adoption or foster care, in connection with
foster care or adoption of a child. Such agency shall be authorized to
redisclose such information only pursuant to the provisions of article 27-F of
the Public Health Law or in accordance with the provisions of section 373-A of the Social Services
Law;
(9) third-party reimbursers or
their agents to the extent necessary to reimburse health care providers,
including health facilities, for health services, provided that, where
necessary, an otherwise appropriate authorization for such disclosure has been
secured by the provider;
(10) an
insurance institution, for other than the purpose set forth in paragraph (9) of
this subdivision, provided the insurance institution secures a dated and
written authorization which indicates that health care providers, health
facilities, insurance institutions, and other persons are authorized to
disclose information about the protected individual, the nature of the
information to be disclosed, the purposes for which the information is to be
disclosed, and which is signed by:
(i) the
protected individual;
(ii) if the
protected individual lacks the capacity to consent, such other person
authorized pursuant to law to consent for such individual; or
(iii) if the protected individual is
deceased, the beneficiary or claimant for benefits under an insurance policy, a
health services plan, or an employee welfare benefit plan as authorized in
article 27-F of the Public Health Law;
(11) any person to whom disclosure is ordered
by a court of competent jurisdiction pursuant to section 2785 of the Public Health Law;
(12) an employee or agency of the Division of
Parole, Division of Probation and Correctional Alternatives, or Commission of
Correction, in accordance with regulations promulgated by those agencies;
and
(13) a medical director of a
local correctional facility in accordance with regulations promulgated by the
facility operator. Redisclosure by the medical director is prohibited except as
permitted under Public Health Law, article 27-F and its implementing
regulations.
(c) No
confidential HIV-related information shall be disclosed pursuant to a general
release. Disclosure is permitted for HIV-related information pursuant to a
specific release form which has been developed or approved by the Department of
Health. The release must be signed by the protected individual, or if the
protected individual lacks capacity to consent, by a person authorized pursuant
to law to consent to health care for the individual.
(1) All written disclosures of confidential
HIV-related information must be accompanied by a statement prohibiting
redisclosure. The statement shall include the following language or
substantially similar language: "This information has been disclosed to you
from confidential records which are protected by State law. State law prohibits
you from making any further disclosure of this information without the specific
written consent of the person to whom it pertains, or as otherwise permitted by
law. Any unauthorized further disclosure in violation of State law may result
in a fine or jail sentence or both. A general authorization for the release of
medical or other information is not sufficient authorization for further
disclosure."
(2) If oral
disclosures are necessary, they must be accompanied or followed as soon as
possible, but no later than 10 days, by the statement required in paragraph (1)
of this subdivision. All disclosures, oral or written, shall be recorded in the
individual's record.
(3) The
statement required by paragraphs (1) and (2) of this subdivision is not
required for release to the protected person or to his or her legal
representative, for releases made by a physician or public health officer to a
contact, or for releases made by a physician to a person authorized pursuant to
law to consent to the health care of the protected person when the person has
been counseled and the disclosure is medically necessary pursuant to Public
Health Law, section
2782(4)(e).
(d) At time of discharge from a
program operated or certified by the Office of Mental Health, a physician may
disclose an individual's HIV status to an appropriate person at the program
operated or certified by the Office of Mental Health which is assuming
responsibility for the individual, after conducting a specific evaluation of
the individual. Such evaluation shall include the individual's condition, the
risk of HIV transmission, the individual's wishes regarding disclosure, and the
risks of discrimination against the individual. The evaluation must be
discussed with the individual. This evaluation and discussion shall be
documented. If a decision is made not to disclose the individual's HIV status,
the information contained within the evaluation and the fact that the
evaluation was made shall not be disclosed.
