§ 2782. Confidentiality and disclosure. 1. No person who obtains\nconfidential HIV related information in the course of providing any\nhealth or social service or pursuant to a release of confidential HIV\nrelated information may disclose or be compelled to disclose such\ninformation, except to the following:\n (a) the protected individual or, when the protected individual lacks\ncapacity to consent, a person authorized pursuant to law to consent to\nhealth care for the individual;\n (b) any person to whom disclosure is authorized pursuant to a release\nof confidential HIV related information;\n (c) an agent or employee of a health facility or health care provider\nif (1) the agent or employee is permitted to access medical records, (2)\nthe health facility or health care provider itself is authorized to\nobtain the HIV related information, and (3) the agent or employee\nprovides health care to the protected individual, or maintains or\nprocesses medical records for billing or reimbursement;\n (d) a health care provider or health facility when knowledge of the\nHIV related information is necessary to provide appropriate care or\ntreatment to the protected individual, a child of the individual, a\ncontact of the protected individual or a person authorized to consent to\nhealth care for such a contact;\n (e) a health facility or health care provider, in relation to the\nprocurement, processing, distributing or use of a human body or a human\nbody part, including organs, tissues, eyes, bones, arteries, blood,\nsemen, or other body fluids, for use in medical education, research,\ntherapy, or for transplantation to individuals;\n (f) health facility staff committees or accreditation or oversight\nreview organizations authorized to access medical records; provided that\nsuch committees or organizations may only disclose confidential HIV\nrelated information: (1) back to the facility or provider of a health or\nsocial service; (2) to carry out the monitoring, evaluation, or service\nreview for which it was obtained; or (3) to a federal, state or local\ngovernment agency for the purposes of and subject to the conditions\nprovided in subdivision six of this section;\n (g) a federal, state, county or local health officer when such\ndisclosure is mandated by federal or state law;\n (h) an authorized agency in connection with foster care or adoption of\na child. Such agency shall be authorized to redisclose such information\nonly pursuant to this article or in accordance with the provisions of\nsubdivision eight of section three hundred seventy-two and section three\nhundred seventy-three-a of the social services law;\n (i) third party reimbursers or their agents to the extent necessary to\nreimburse health care providers for health services; provided that,\nwhere necessary, an otherwise appropriate authorization for such\ndisclosure has been secured by the provider;\n (j) an insurance institution, for other than the purpose set forth in\nparagraph (i) of this subdivision, provided the insurance institution\nsecures a dated and written authorization that indicates that health\ncare providers, health facilities, insurance institutions, and other\npersons are authorized to disclose information about the protected\nindividual, the nature of the information to be disclosed, the purposes\nfor which the information is to be disclosed and which is signed by: (1)\nthe protected individual; (2) if the protected individual lacks the\ncapacity to consent, such other person authorized pursuant to law to\nconsent for such individual; or (3) if the protected individual is\ndeceased, the beneficiary or claimant for benefits under an insurance\npolicy, a health services plan, or an employee welfare benefit plan as\ndefined in 29 U.S.C. 1002(1), covering such protected individual;\n (k) any person to whom disclosure is ordered by a court of competent\njurisdiction pursuant to section twenty-seven hundred eighty-five of\nthis article;\n (l) an employee or agent of the department of corrections and\ncommunity supervision, in accordance with paragraph (a) of subdivision\ntwo of section twenty-seven hundred eighty-six of this article, to the\nextent the employee or agent is authorized to access records containing\nsuch information in order to carry out the department's functions,\npowers and duties with respect to the protected individual, pursuant to\nsection two hundred fifty-nine-a of the executive law;\n (m) an employee or agent of the office of probation and correctional\nalternatives or any local probation department, in accordance with\nparagraph (a) of subdivision two of section twenty-seven hundred\neighty-six of this article, to the extent the employee or agent is\nauthorized to access records containing such information in order to\ncarry out the office's or department's functions, powers and duties with\nrespect to the protected individual, pursuant to articles twelve and\ntwelve-A of the executive law;\n (n) a medical director of a local correctional facility as defined in\nsection forty of the correction law, in accordance with paragraph (a) of\nsubdivision two of section twenty-seven hundred eighty-six of this\narticle, to the extent the medical director is authorized to access\nrecords containing such information in order to carry out his or her\nfunctions, powers and duties with respect to the protected individual;\n (o) an employee or agent of the commission of correction, in\naccordance with paragraph (a) of subdivision two of section twenty-seven\nhundred eighty-six of this article, to the extent the employee or agent\nis authorized to access records containing such information in order to\ncarry out the commission's functions, powers and duties with respect to\nthe protected individual, pursuant to article three of the correction\nlaw;\n (p) an attorney appointed to represent a minor pursuant to the social\nservices law or the family court act, with respect to confidential HIV\nrelated information relating to the minor and for the purpose of\nrepresenting the minor. If the minor has the capacity to consent, the\nminor's attorney may not redisclose confidential HIV related information\nwithout the minor's permission. If the minor lacks capacity to consent,\nthe minor's attorney may redisclose confidential HIV related information\nfor the sole purpose of representing the minor. This paragraph shall not\nlimit the ability of the minor's attorney to seek relief under section\ntwenty-seven hundred eighty-five of this chapter.\n (q) an executor or an administrator of an estate shall have access to\nthe confidential HIV information of a deceased person as needed to\nfulfill his or her responsibilities/duties as an executor or\nadministrator.\n (r) qualified researchers for medical research purposes upon the\napproval of a research protocol by a human research review committee\nestablished and approved under the provisions of article twenty-four-A\nof this chapter or by an institutional review board established and\napproved under the provisions of 45 CFR part 46 or 42 USC 300 V-1, for\nthe purpose of reviewing and monitoring research involving human\nsubjects, provided that in no event shall any qualified researcher\ndisclose information tending to identify the subjects of the research.\n (s) an employee or agent of the board of correction of the city of New\nYork, in accordance with paragraph (a) of subdivision two of section\ntwenty-seven hundred eighty-six of this article, to the extent the\nemployee or agent is authorized to access records containing such\ninformation in order to carry out the board's functions, powers and\nduties with respect to the protected individual, pursuant to the charter\nof the city of New York.\n 2. A state, county or local health officer may disclose confidential\nHIV related information when:\n (a) disclosure is specifically authorized or required by federal or\nstate law; or\n (b) disclosure is made pursuant to a release of confidential HIV\nrelated information; or\n (c) disclosure is requested by a physician pursuant to subdivision\nfour of this section; or\n (d) disclosure is authorized by court order pursuant to the provisions\nof section twenty-seven hundred eighty-five of this article.\n 3. No person to whom confidential HIV related information has been\ndisclosed pursuant to this article shall disclose the information to\nanother person except as authorized by this article, provided, however,\nthat the provisions of this subdivision shall not apply:\n (a) to the protected individual; or\n (b) to a natural person who is authorized pursuant to law to consent\nto health care for the protected individual; or\n (c) to a protected individual's foster parent as defined in section\nthree hundred seventy-one of the social services law and subject to\nregulations promulgated pursuant to paragraph (a) of subdivision two of\nsection twenty-seven hundred eighty-six of this article, for the purpose\nof providing care, treatment or supervision of the protected individual;\nor\n (d) a prospective adoptive parent as specified in section three\nhundred seventy-three-a of the social services law and subject to\nregulations promulgated pursuant to paragraph (a) of subdivision two of\nsection twenty-seven hundred eighty-six of this article with whom a\nchild who is the protected individual has been placed for adoption; or\n (e) to a relative or other person legally responsible to whom a child\nwho is the protected individual is to be placed or discharged pursuant\nto section ten hundred seventeen or ten hundred fifty-five of the family\ncourt act and subject to regulations promulgated pursuant to paragraph\n(a) of subdivision two of section twenty-seven hundred eighty-six of\nthis article, for the purpose of providing care, treatment or\nsupervision of the protected individual.\n 4. (a) A physician may disclose confidential HIV related information\nunder the following conditions:\n (1) disclosure is made to a contact, to a public health officer for\nthe purpose of making the disclosure to said contact and pursuant to\nsection twenty-one hundred thirty of this chapter; or\n (2) the physician believes disclosure is medically appropriate and\nthere is a significant risk of infection to the contact; and\n (3) the physician has counseled the protected individual regarding the\nneed to notify the contact; and\n (4) the physician has informed the protected individual of his or her\nintent to make such disclosure to a contact, the physician's\nresponsibility to report the infected individual's case pursuant to\nsection twenty-one hundred thirty of this chapter and has given the\nprotected individual the opportunity to express a preference as to\nwhether disclosure should be made by the physician directly or to a\npublic health officer for the purpose of said disclosure. If the\nprotected individual expresses a preference for disclosure by a public\nhealth officer, the physician shall honor such preference.\n (5) If a physician chooses to make a notification pursuant to this\nsection, he or she shall report to the municipal health commissioner of\ndistrict health officer on his or her efforts to notify the contacts of\nthe protected individual. Such report shall be in a manner and on forms\nprescribed by the commissioner and shall include the identity of the\nprotected individual and any contacts as well as information as to\nwhether the contacts were successfully notified.\n (6) Within a reasonable time of receiving a report that a physician or\nhis or her designated agent did not notify or verify notification of\ncontacts provided by the protected individual, the health commissioner\nor district health officer of the municipality from which the report\noriginates shall take reasonable measures to notify such contacts and\notherwise comply with the provisions of this chapter.\n (b) When making such disclosures to the contact, the physician or\npublic health officer shall provide or make referrals for the provision\nof the appropriate medical advice and counseling for coping with the\nemotional consequences of learning the information and for changing\nbehavior to prevent transmission or contraction of HIV infection. The\nphysician or public health officer shall not disclose the identity of\nthe protected individual or the identity of any other contact. A\nphysician or public health officer making a notification pursuant to\nthis subdivision shall make such disclosure in person, except where\ncircumstances reasonably prevent doing so.\n (c) A physician or public health officer shall have no obligation to\nidentify or locate any contact except as provided pursuant to title\nthree of article twenty-one of this chapter.\n (d) A physician may, upon the consent of a parent or guardian,\ndisclose confidential HIV related information to a state, county, or\nlocal health officer for the purpose of reviewing the medical history of\na child to determine the fitness of the child to attend school.\n (e) A physician may disclose confidential HIV related information\npertaining to a protected individual to a person (known to the\nphysician) authorized pursuant to law to consent to health care for a\nprotected individual when the physician reasonably believes that: (1)\ndisclosure is medically necessary in order to provide timely care and\ntreatment for the protected individual; and (2) after appropriate\ncounseling as to the need for such disclosure, the protected individual\nwill not inform a person authorized by law to consent to health care;\nprovided, however, that the physician shall not make such disclosure if,\nin the judgment of the physician: (A) the disclosure would not be in the\nbest interest of the protected individual; or (B) the protected\nindividual is authorized pursuant to law to consent to such care and\ntreatment. Any decision or action by a physician under this paragraph,\nand the basis therefor, shall be recorded in the protected individual's\nmedical record.\n 5. (a) Whenever disclosure of confidential HIV related information is\nmade pursuant to this article, except for disclosures made pursuant to\nparagraphs (a), (d) and (i) of subdivision one of this section or\nparagraph (a) or (e) of subdivision four of this section, such\ndisclosure shall be accompanied or followed by a statement in writing\nwhich includes the following or substantially similar language: "This\ninformation has been disclosed to you from confidential records which\nare protected by state law. State law prohibits you from making any\nfurther disclosure of this information without the specific written\nconsent of the person to whom it pertains, or as otherwise permitted by\nlaw. Any unauthorized further disclosure in violation of state law may\nresult in a fine or jail sentence or both. A general authorization for\nthe release of medical or other information is NOT sufficient\nauthorization for further disclosure." An oral disclosure shall be\naccompanied or followed by such a notice within ten days.\n (b) Except for disclosures made pursuant to paragraph (c) of\nsubdivision one of this section, or to persons reviewing information or\nrecords in the ordinary course of ensuring that a health facility is in\ncompliance with applicable quality of care standards or any other\nauthorized program evaluation, program monitoring or service review, or\nto governmental agents requiring information necessary for payments to\nbe made on behalf of patients or clients pursuant to contract or in\naccordance to law, a notation of all such disclosures shall be placed in\nthe medical record of a protected individual, who shall be informed of\nsuch disclosures upon request; provided, however, that for disclosures\nmade to insurance institutions such a notation need only be entered at\nthe time the disclosure is first made.\n 6. (a) The provisions of this subdivision shall apply where a provider\nof a health or social service possesses confidential HIV related\ninformation relating to individuals who are recipients of the service,\nand a federal, state or local government agency supervises or monitors\nthe provider or administers the program under which the service is\nprovided.\n (b) Confidential HIV related information relating to a recipient of\nsuch service may be disclosed in accordance with regulations promulgated\npursuant to paragraph (a) of subdivision two of section twenty-seven\nhundred eighty-six of this article to an authorized employee or agent of\nsuch provider or government agency, when reasonably necessary for such\nsupervision, monitoring, administration, or provision of such service.\nThe term "authorized employee or agent", as used in this subdivision\nshall only include any employee or agent who would, in the ordinary\ncourse of business of the provider or government agency, have access to\nrecords relating to the care of, treatment of, or provision of a health\nor social service to the protected individual.\n 7. Nothing in this section shall limit a person's or agency's\nresponsibility or authority to report, investigate, or redisclose, child\nprotective and adult protective services information in accordance with\ntitle six of article six and titles one and two of article nine-B of the\nsocial services law, or to provide or monitor the provision of child and\nadult protective or preventive services.\n 8. Confidential HIV related information shall be recorded in the\nmedical record of the protected individual. The provisions of this\nsection shall not prohibit the listing of acquired immune deficiency\nsyndrome, HIV related illness or HIV infection in a certificate of\ndeath, autopsy report or related documents prepared pursuant to article\nforty-one of this chapter or other applicable laws, ordinances, rules or\nregulations relating to the documentation of cause of death, nor shall\nthis section be construed to modify any laws, ordinances, rules or\nregulations relative to access to death certificates, autopsy reports or\nsuch other related documents. Under no circumstances shall confidential\nHIV related information be disclosable pursuant to article six of the\npublic officers law. Notwithstanding the foregoing, confidential HIV\ninformation obtained pursuant to section 390.15 of the criminal\nprocedure law or section 347.1 of the family court act by either court\norder or consent of the protected individual shall not be recorded in\nthe medical record of the protected individual unless he or she consents\nto the recording of such information in a written statement containing\nthe relevant information specified in subdivision two of section two\nthousand seven hundred eighty-one of this article.\n 9. Confidential HIV related information shall be disclosed upon the\nrequest of the health care worker HIV/HBV advisory panel, established\npursuant to article twenty-seven-DD of this chapter, to the panel or its\ndesignee only when reasonably necessary for the evaluation of a worker\nwho has voluntarily sought the panel's review.\n