N.Y. Comp. Codes R. & Regs. Tit. 7 § 7.5 - Confidentiality and disclosure

(a) It is the policy of the department that whenever disclosure of confidential HIV-related information is warranted as defined in subdivision (b) of this section, such disclosure, whenever possible, should be made pursuant to the consent of the protected individual, and all reasonable steps, including appropriate counseling, should be taken to obtain consent. Once consent has been obtained, Form HS-2, or any other form approved by the Department of Health, is to be used as a release form for disclosure of confidential HIV-related information. Only Form HS-2, or other Department of Health approved form, is to be used for this purpose. A general medical release is not sufficient for the purpose of disclosing confidential HIV-related information.

(b) No person who obtains confidential HIV-related information in the course of his or her employment with the department or pursuant to a release of confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:

(1) the protected individual or, when the protected individual lacks capacity to consent, a person authorized by law to consent to health care for the individual;

(2) any person to whom disclosure is authorized pursuant to a release of confidential HIV-related information in accordance with subdivision (a) of this section;

(3) a health care provider of the protected individual as defined in section 7.2(j) of this Part;

(4) Deputy Commissioner/Director of Correctional Medical Standards and employees within the Division of Health Services authorized by the Deputy Commissioner as necessary to perform their duties and to provide appropriate supervision, monitoring, administration or provision of treatment and services offered to the protected individual;

(5) Assistant Commissioner for Health Services and employees within the Division of Health Services as necessary on a need to know basis for providing appropriate supervision, monitoring, administration or provision of treatment and services offered to the protected individual;

(6) superintendent of the facility in which the protected individual is incarcerated as necessary on a need to know basis for providing appropriate supervision, monitoring, administration or provision of treatment and services offered to the protected individual, including services associated with possible parole release;

(7) attorneys for the department or with the Office of the Attorney General when access is reasonably necessary in the course of providing legal services and when reasonably necessary for supervision, monitoring, administration or provision of services;

(8) authorized employees of the facility Business Office, Deputy Superintendent for Administration, Central Office Budget and Finance, Bureau of Internal Controls, the Deputy Commissioner of Administration, and the Division of Audit and Control as necessary to ensure appropriate payment of medical services or to track expenses associated with HIV-related care;

(9) Assistant Commissioner for Population Management as necessary on a need to know basis for providing appropriate supervision, monitoring, administration or provision of treatment and services offered to the protected individual, including services associated with possible parole release;

(10) institutional parole officer from the facility medical director by use of the Health Discharge Summary Sheet;

(11) Parole Services Program Specialist by the Deputy Commissioner/Director of Correctional Medical Standards;

(12) authorized employee of the State Commission of Correction, as defined by the rules and regulations promulgated by the State Commission of Correction;

(13) a clinician of the Office of Mental Health upon the clinician's written request provided that the clinician is involved in the treatment of the individual, or if facility medical personnel believes the release of confidential HIV-related information to the clinician may be beneficial to the treatment of the individual;

(14) a medical director of a local correctional facility or the medical director of a Federal correctional facility or the medical director of the Bureau of Immigration and Naturalization Services in which the protected individual is incarcerated or is to be transferred, to the extent that such medical director is authorized to access such information with respect to a protected individual;

(15) a funeral director upon taking charge of the remains of a deceased person when such funeral director has access in the ordinary course of business to HIV-related information on the death certificate of the deceased individual, as authorized by Public Health Law, section 2785;

(16) any person not listed above, to whom disclosure is authorized pursuant to Public Health Law, section 2782.1(a) through (o) or 2785.

(c) Confidential HIV-related information of a protected person may be disclosed to authorized employees or agents of a governmental agency pursuant to the regulations of the governmental agency when the person providing health or social services is regulated, supervised or monitored by the governmental agency or when the governmental agency administers the health program or a social service program and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for regulation, supervision, monitoring, administration or provision of services. Such authorized employees or agents may include attorneys authorized by a governmental agency when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services. Such authorized employees or agents may also include public health officers as required for conducting epidemiological or surveillance investigations pursuant to the State Sanitary Code. Such surveillance or investigational data shall also be disclosed by the Public Health Officer to the State Department of Health as required by the State Sanitary Code.

(d) Confidential HIV-related information of a protected person may be disclosed to authorized employees or agents of a provider of health or social services when such provider is either regulated, supervised or monitored by a governmental agency or when a governmental agency administers the provider's health or social service program, and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for regulation, supervision, monitoring, administration or provision of services. Such authorized employees or agents may include attorneys authorized by persons providing health services when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services.

(e) A physician may disclose confidential HIV-related information pertaining to a protected individual to a person, known to the physician, authorized pursuant to law to consent to the health care for a protected individual when the physician reasonably believes that:

(1) disclosure is medically necessary in order to provide timely care and treatment for the protected individual; and

(2) after appropriate counseling as to the need for such disclosure, the protected individual will not inform a person authorized by law to consent to health care; provided, however, that the physician shall not make such disclosure if, in the judgment of the physician:

(i) the disclosure would not be in the best interest of the protected individual; or

(ii) the protected individual is authorized pursuant to law to consent to such care and treatment.

A physician's decision to disclose pursuant to this paragraph, and the basis for that decision shall be recorded in the medical record.

(f) Written disclosure must be accompanied by a written statement prohibiting further disclosure. The statement shall include the following language or substantially similar language: "This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosures of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure." Form HS-3 is to be used for this purpose.

(g) If oral disclosures are necessary, they must be accompanied or followed as soon as possible, but no later than 10 days, by the statement required by subdivision (f) of this section.

(h) The statement required by subdivisions (f) and (g) of this section is not required for release to the protected person or to a person authorized by law to consent to health care for the individual when the protected individual lacks capacity, or for releases made by a physician or public health officer to a contact. For disclosures of confidential HIV-related information from the patient's medical record to persons who are permitted to access this information pursuant to paragraphs (b)(4)-(15) of this section and physicians or nurses or their authorized staff who are permitted to access this information pursuant to paragraph (b)(3) of this section, it shall be sufficient for the statement required by subdivisions (f) and (g) of this section to appear in the medical record itself.

(i) No person to whom confidential HIV-related information has been disclosed shall disclose the information to another person except as authorized by this Part, provided, however, that the provisions of this Part shall not apply to the protected individual or a natural person who is authorized pursuant to law to consent to health care for the protected individual.

Notes

N.Y. Comp. Codes R. & Regs. Tit. 7 § 7.5