§ 394-H — Electronic health information protections

§ 394-h. Electronic health information protections. 1. For the\npurposes of this section, the following terms shall have the following\nmeanings:\n a. Electronic health information. The term "electronic health\ninformation" means any information in any electronic format or media\nthat relates to an individual or a device that is reasonably linkable to\nan individual or individuals in connection with any past, present, or\nfuture disability, physical health condition, or mental health\ncondition; the search for or attempt to obtain health care services; any\npast, present, or future treatment or other health care services for a\ndisability, physical health condition, or mental health condition;\nlocation information associated with a health care facility; or the\npast, present, or future payment for health care services. For the\navoidance of doubt, any inference drawn or data derived about an\nindividual or a device that is reasonably linkable to an individual or\nindividuals that relates to any of these topics in any electronic format\nor media is considered electronic health information. Electronic health\ninformation does not include deidentified information.\n b. Law enforcement agency. The term "law enforcement agency" shall\nhave the same meaning as in subdivision four of section 705.00 of the\ncriminal procedure law.\n c. Law enforcement officer. The term "law enforcement officer" means a\npolice officer or peace officer as defined in section 1.20 of the\ncriminal procedure law.\n 2. Prohibition on access to electronic health information.\nNotwithstanding any other law, law enforcement agencies and law\nenforcement officers shall be prohibited from purchasing or obtaining\nelectronic health information without a warrant.\n 3. Exemptions. Nothing in this article shall apply to:\n a. Information processed by local, state, and federal governments, and\nmunicipal corporations;\n b. Protected health information that is collected by a covered entity\nor business associate governed by the privacy, security, and breach\nnotification rules issued by the United States Department of Health and\nHuman Services, Parts 160 and 164 of Title 45 of the Code of Federal\nRegulations, established pursuant to the Health Insurance Portability\nand Accountability Act of 1996 (Public Law 104-191) and the Health\nInformation Technology for Economic and Clinical Health Act (Public Law\n111-5);\n c. Any covered entity governed by the privacy, security, and breach\nnotification rules issued by the United States Department of Health and\nHuman Services, Parts 160 and 164 of Title 45 of the Code of Federal\nRegulations, established pursuant to the Health Insurance Portability\nand Accountability Act of 1996 (Public Law 104-191), to the extent the\ncovered entity maintains patient information in the same manner as\nprotected health information as described in paragraph b of this\nsubdivision;\n d. Information collected as part of a clinical trial subject to the\nFederal Policy for the Protection of Human Subjects, also known as the\nCommon Rule, pursuant to good clinical practice guidelines issued by the\nInternational Council for Harmonisation or pursuant to human subject\nprotection requirements of the United States Food and Drug\nAdministration;\n e. Information processed pursuant to the federal Family Educational\nRights and Privacy Act (20 U.S.C. Sec. 1232g) and its implementing\nregulations;\n f. Information processed pursuant to section two-d of the education\nlaw; and\n g. Information processed pursuant to the federal Driver's Privacy\nProtection Act of 1994 (18 U.S.C. Sec. 2721 et seq).\n