§ 4410 — Health maintenance organizations; professional services

§ 4410. Health maintenance organizations; professional services. 1.\nThe provision of comprehensive health services directly or indirectly,\nby a health maintenance organization through its comprehensive health\nservices plan shall not be considered the practice of the profession of\nmedicine by such organization or plan. However, each member, employee or\nagent of such organization or plan shall be fully and personally liable\nand accountable for any negligent or wrongful act or misconduct\ncommitted by him or any person under his direct supervision and control\nwhile rendering professional services on behalf of such organization or\nplan.\n 2. Unless the patient waives the right of confidentiality, a health\nmaintenance organization or its comprehensive health services plan shall\nnot be allowed to disclose any information which was acquired by such\norganization or plan in the course of the rendering to a patient of\nprofessional services by a person authorized to practice medicine,\nregistered professional nursing, licensed practical nursing, or\ndentistry, and which was necessary to acquire to enable such person to\nact in that capacity, except as may be otherwise required by law. A\nnon-participating provider shall provide an enrollee's organization with\nsuch patient information as is reasonably required by the organization\nto administer its plan. In making such disclosure a provider shall\ncomply with the provisions of subdivision six of section eighteen of\nthis chapter concerning the disclosure of patient information to third\nparties provided, however, that with respect to a protected individual\nas defined in subdivision six of section twenty-seven hundred eighty of\nthis chapter, disclosure shall be made only pursuant to an enrollee's\nwritten authorization and shall otherwise be consistent with the\nrequirements of such section and rules and regulations promulgated\npursuant thereto.\n 3. Notwithstanding the provisions of this section, the provisions of\nsection four hundred twenty-two of the social services law shall apply\nto any information or reports submitted by a health maintenance\norganization to the statewide central register of child abuse and\nmaltreatment reports.\n 4. (a) The commissioner shall have access to patient-specific medical\ninformation, including encounter data, maintained by a health\nmaintenance organization or other organization certified pursuant to\nthis article for the purposes of quality assurance and oversight,\nsubject to any other limitations of federal and state law regarding\ndisclosure thereof to third parties and subject to the provisions of\nthis subdivision. The provisions of sections thirty-one hundred one, and\nforty-five hundred four, forty-five hundred seven and forty-five hundred\neight of the civil practice law and rules, subdivision three of this\nsection and section 33.13 of the mental hygiene law, shall not bar\ndisclosure by the health maintenance organization to the commissioner\nfor such purposes.\n (b) The commissioner may only obtain enrollee information subject to\nthe establishment of protocols that will ensure that such\npatient-specific information is not disclosed to third parties other\nthan to entities serving as agents of the state for the purposes of\nquality assurance and oversight. Such protocols shall be developed in\nconsultation with representatives of health maintenance organizations,\nhealth care provider organizations and consumer organizations and shall,\nwhere possible, include the development of a unique confidential\nidentifier to be used in connection with patient-specific data. These\nprotocols shall address issues relating to the collection, maintenance,\nand disclosure of such patient-specific information. Such protocols\nshall be promulgated as regulations, provided however, that protocols or\nregulations in use prior to the effective date of this subdivision shall\nremain in effect until the regulations developed hereunder are\npromulgated.\n (c) In addition to any other sanction or penalty as provided by law,\nany employee of the department who willfully violates this regulation or\nany other rule or procedure pertaining to the disclosure of any material\ncollected pursuant to this subdivision shall be deemed to have committed\nan act of misconduct and shall be disciplined in accordance with the\nprovisions of the civil service law.\n