§ 3006-A — Patient privacy

§ 3006-a. Patient privacy. 1. As used in this section:\n (a) "Individual identifying information" means information identifying\nor tending to identify a patient.\n (b) "Marketing" means advertising, detailing, marketing, promotion, or\nany other activity that is intended to be used to influence business\nvolume, sales or market share or evaluate the effectiveness of marketing\npractices or marketing personnel, regardless of whether the beneficiary\nof the marketing is a governmental, for-profit, or not-for-profit\nentity.\n 2. No ambulance service, advanced life support first response service,\nor employee, member or agent thereof shall disclose, sell, transfer,\nexchange, provide or use any individual identifying information to any\nperson or entity for the purpose of marketing.\n 3. Notwithstanding subdivision two of this section, and subject to\notherwise applicable law, individual identifying information may be:\n (a) disclosed, sold, transferred or exchanged to:\n (i) the patient who is the subject of the information, or a person\nauthorized to make health care decisions for the patient;\n (ii) a health care provider providing care or treatment to the\npatient, for the purpose of such care or treatment; or a health\ninformation system subject to regulations of the department, for the\npurpose of such care or treatment;\n (iii) an officer, inspector or investigator for a government health,\nlicensing or law enforcement agency acting under appropriate legal\nauthority;\n (iv) a person authorized by a court order or a subpoena to receive\nsuch information;\n (v) the patient's health plan, insurer, or third party payer, or an\nagent thereof, for the purpose of payment or reimbursement for health\ncare services, including determining compliance with the terms of\ncoverage or medical necessity, or utilization review;\n (vi) a person or entity to whom, and for a purpose for which,\ndisclosure or transfer is otherwise explicitly authorized or required by\nlaw;\n (vii) a person or entity, for the purpose of conducting quality\nassurance or evaluating the performance of an ambulance service,\nadvanced life support first response service, or any employee, member or\nagent thereof;\n (viii) a person or entity acting as an employee or agent of a person\nor entity under any preceding paragraph of this subdivision, for the\npurpose of and consistent with that paragraph; or\n (ix) a government entity as provided by law; and\n (b) used by such ambulance service, advanced life support first\nresponder service, or employee, member or agent thereof, for training,\npromotion, staff recognition or recruitment purposes, consistent with\napplicable law, provided the patient or a qualified person as defined by\nparagraph (G) of subdivision one of section eighteen of this chapter has\nprovided consent to such use in a separate, stand-alone document. Such\nconsent shall be limited to the particular type or types of use and\nspecific transaction or transactions for which such consent is given.\n 4. Nothing in this section shall prohibit the collection, use,\ntransfer, or sale of patient data by zip code, geographic region, or\nmedical specialty for marketing purposes, providing it does not contain\nindividual identifying information.\n 5. This section shall not prevent a person from disclosing, selling,\ntransferring, or exchanging for value his or her own individual\nidentifying information, for any purpose; provided that the information\ndoes not include individual identifying information pertaining to any\nother person.\n 6. This section does not prohibit a not-for-profit or governmental\nambulance service or advanced life support first response service, or\nagent thereof, from using a patient's name and address in order to\ncontact such patient or a family member at such address with requests\nfor donations to such service; providing that such use shall not include\ndisclosing any individual identifying information.\n 7. No person or entity to whom or which individual identifying\ninformation is disclosed, sold, transferred or exchanged shall disclose,\nsell, transfer or exchange it to any person or entity other than for the\nlawful purpose for which it was disclosed, sold, transferred or\nexchanged to the person or entity, and without satisfactory assurance\nthat the recipient will safeguard the records from being disclosed or\nused for marketing purposes.\n 8. This section does not authorize any disclosure, sale, transfer, or\nexchange of individual identifying information that is not otherwise\nauthorized or required by law.\n 9. In addition to the commissioner's authority to enforce this section\nunder section three thousand twelve of this article, the attorney\ngeneral shall have the authority to bring an action to enforce\ncompliance with this section without referral by the commissioner.\n