§ 2181 — COVID-19 contact tracing; confidentiality

§ 2181. COVID-19 contact tracing; confidentiality. 1. (a) All contact\ntracing information shall be kept confidential by any contact tracer,\ncontact tracing entity, or designated non-governmental entity and may\nnot be disclosed except as necessary to carry out contact tracing or a\npermitted purpose. A designated non-governmental entity may only act in\nrelation to contact tracing information as explicitly authorized by this\ntitle.\n (b) Where a contact tracer or contact tracing entity discloses contact\ntracing information for a permitted purpose, the contact tracer or\ncontact tracing entity shall make a record of the disclosure, including\nto whom it was made and when it was made, which shall be part of the\ncontact tracing information.\n (c) Nothing in this title prohibits otherwise lawful voluntary\nreporting, at the discretion of the contact tracer, reasonably and in\ngood faith: (i) to the statewide central registry under title six of\narticle six of the social services law, adult protective services under\ntitles one and two of article nine-B of the social services law, or the\njustice center for the protection of people with special needs under\narticle eleven of the social services law; or (ii) to a governmental or\nnon-governmental emergency reporting system (such as a "911," domestic\nviolence or suicide prevention system) to prevent imminent risk of\ninjury to any person.\n (d) This title does not limit disclosure to or by, or possession or\nuse by, the case individual or contact individual who is the subject of\nthe information.\n 2. (a) An individual may waive the confidentiality provided for by\nthis section, only by a written, informed and voluntary waiver, in plain\nlanguage and in a language understandable to the individual making the\nwaiver, and not part of any other document. The waiver shall state the\nscope and limit of the waiver. No contact tracer, contact tracing entity\nor governmental or non-governmental entity may seek or act in reliance\non a waiver to distribute, sell, or otherwise disclose identifiable or\nde-identified data to any individual or entity. Provided however,\nnothing in this subdivision shall prohibit distribution or disclosure\nthat is otherwise explicitly authorized by this section. If an\nindividual lacks the capacity to make a waiver, an individual authorized\nto consent to health care for the individual, or the individual's legal\nrepresentative, may make the waiver. However, a waiver of\nconfidentiality is not required to be written if it is solely for the\npurpose of arranging or providing support for the individual who is the\nsubject of the contact tracing information, provided the consent is\ninformed and voluntary.\n (b) A waiver of confidentiality under this section shall only apply\nfor the purpose of arranging or providing support if the individual who\nis the subject of the contact tracing information (or, if the individual\nlacks the capacity to provide informed consent, an individual authorized\nto consent to health care for the individual, or the individual's legal\nrepresentative) provides voluntary informed consent to the arranging or\nproviding of the support.\n 3. A disclosure of contact tracing information authorized under this\nsection shall be limited in scope as to the identity of any individual,\nthe information to be disclosed, and the party to which disclosure may\nbe made, and as necessary to achieve the purpose of the disclosure under\nthis section, and shall not authorize re-disclosure except as explicitly\nauthorized by the terms of the waiver under this section. However, this\nsection does not bar disclosure of contact tracing information\npertaining to and identifying a case individual or contact individual by\nthe individual who is identified.\n 4. (a) This section does not bar otherwise-lawful disclosure,\npossession or use of de-identified contact tracing information,\nincluding aggregate contact tracing information. Disclosure, possession\nor use under this subdivision shall only be for a public health or\npublic health research or evaluation purpose as determined by the\ncommissioner (or the commissioner of the New York city department of\nhealth and mental hygiene in the case of contact tracing information\ncollected by or under authority of the New York city department of\nhealth and mental hygiene or the New York city health and hospitals\ncorporation), and shall not authorize re-disclosure or other use.\n (b) A person or entity may only disclose, possess or use de-identified\ncontact tracing information if the person or entity, and the person or\nentity to which it is disclosed, maintains technical safeguards and\npolicies and procedures that prevent re-identification, whether\nintentional or unintentional, of any individual, as may be required by\nthe commissioner (or the New York city commissioner of health and mental\nhygiene in the case of contact tracing information collected by or under\nauthority of the New York city department of health and mental hygiene\nor the New York city health and hospitals corporation). The commissioner\n(or the New York city commissioner as the case may be) shall require\nsafeguards, policies and procedures under this paragraph as the\ncommissioner deems practicable.\n (c) Disclosure, possession and use of de-identified contact tracing\ninformation under this subdivision shall be only pursuant to approval by\nthe commissioner (or the New York city commissioner of health and mental\nhygiene in the case of contact tracing information collected by or under\nauthority of the New York city department of health and mental hygiene\nor the New York city health and hospitals corporation) specifying the\npurpose, nature and scope of the disclosure, possession and use and\nmeasures to ensure that it will comply with this section and the terms\nof the approval.\n 5. No law enforcement agent or entity or immigration authority shall\nbe a contact tracer or contact tracing entity or engage in contact\ntracing. This subdivision does not bar an individual who is associated\nwith a law enforcement entity or immigration authority from acting only\nas a case individual or contact individual. This subdivision does not\nprevent a law enforcement agent or entity from assisting in a permitted\nuse under paragraph (b) of subdivision eleven of section twenty-one\nhundred eighty of this title.\n 6. No contact tracer, contact tracing entity or designated\nnon-governmental entity may provide contact tracing information to a law\nenforcement agent, entity or immigration authority, or any individual or\nentity other than the contact tracing entity from which it received the\ninformation, except as explicitly authorized by this title. Without\nconsent under subdivision two of this section, contact tracing\ninformation and any evidence derived therefrom shall not be subject to\nor provided in response to any legal process or be admissible for any\npurpose in any judicial or administrative action or proceeding. However,\nthis subdivision does not restrict providing information, relating to a\nspecified case individual or contact individual, where and only to the\nextent necessary for a permitted purpose.\n 7. (a) Contact tracing entities shall establish appropriate\nadministrative, technical and physical safeguards, policies and\nprocedures that ensure the security of contact tracing information under\nthe entity's jurisdiction. The safeguards, policies and procedures must\nensure contact tracing information is encrypted and protected at least\nas much as or more than other confidential information under the\nentity's jurisdiction. All storage of contact tracing information shall\nmeet the requirements of this title. The commissioner (or the New York\ncity commissioner of health and mental hygiene in the case of contact\ntracing information collected by or under authority of the New York city\ndepartment of health and mental hygiene or the New York city health and\nhospitals corporation) shall make regulations as reasonably necessary to\nrequire that contact tracing information possessed, used or under the\ncontrol of a contact tracer or contact tracing entity shall be subject\nto technical safeguards, policies and procedures for storage,\ntransmission, use and protection of the information. The regulations\nshall prevent possession, use or disclosure of the contact tracing\ninformation not permitted by this title, and shall be at least as or\nmore protective than the safeguards, policies and procedures the\ncommissioner (or the New York city commissioner as the case may be)\nprovides for other confidential information.\n (b) This paragraph applies to a contact tracer or contact tracing\nentity that is a non-governmental individual or entity employed by or\nunder contract with a governmental entity, or an agent thereof. Within\nsixty days of collecting or receiving the contact tracing information,\nthe entity shall (i) remove information from its possession or control\nand deliver it to the appropriate governmental contact tracing entity or\na designated non-governmental entity specified by the governmental\ncontact tracing entity, retaining no copy of it; (ii) expunge the\ninformation from its possession or control; or (iii) de-identify the\ninformation. However, the expungement or de-identification of\nparticular contact tracing information may be postponed for up to\nfifteen days after the initial sixty day period while the contact tracer\nor contact tracing entity is actively engaged in contact tracing using\nthat information, provided that the case individual or contact\nindividual to whom it pertains gives voluntary informed consent. The\ndisclosure, possession and use of the de-identified contact tracing\ninformation shall be subject to subdivision four of this section.\n