Section 2782. Confidentiality and disclosure

1. No person who obtains
  confidential HIV related information in  the  course  of  providing  any
  health  or  social  service or pursuant to a release of confidential HIV
  related information may  disclose  or  be  compelled  to  disclose  such
  information, except to the following:
    (a)  the  protected individual or, when the protected individual lacks
  capacity to consent, a person authorized pursuant to law to  consent  to
  health care for the individual;
    (b)  any person to whom disclosure is authorized pursuant to a release
  of confidential HIV related information;
    (c) an agent or employee of a health facility or health care  provider
  if (1) the agent or employee is permitted to access medical records, (2)
  the  health  facility  or  health  care provider itself is authorized to
  obtain the HIV related  information,  and  (3)  the  agent  or  employee
  provides  health  care  to  the  protected  individual,  or maintains or
  processes medical records for billing or reimbursement;
    (d) a health care provider or health facility when  knowledge  of  the
  HIV  related  information  is  necessary  to provide appropriate care or
  treatment to the protected individual, a  child  of  the  individual,  a
  contact of the protected individual or a person authorized to consent to
  health care for such a contact;
    (e)  a  health  facility  or  health care provider, in relation to the
  procurement, processing, distributing or use of a human body or a  human
  body  part,  including  organs,  tissues,  eyes, bones, arteries, blood,
  semen, or other body fluids, for use  in  medical  education,  research,
  therapy, or for transplantation to individuals;
    (f)  health  facility  staff  committees or accreditation or oversight
  review organizations authorized to access medical records; provided that
  such committees or organizations  may  only  disclose  confidential  HIV
  related information: (1) back to the facility or provider of a health or
  social  service; (2) to carry out the monitoring, evaluation, or service
  review for which it was obtained; or (3) to a federal,  state  or  local
  government  agency  for  the  purposes  of and subject to the conditions
  provided in subdivision six of this section;
    (g) a federal,  state,  county  or  local  health  officer  when  such
  disclosure is mandated by federal or state law;
    (h) an authorized agency in connection with foster care or adoption of
  a  child. Such agency shall be authorized to redisclose such information
  only pursuant to this article or in accordance with  the  provisions  of
  subdivision eight of section three hundred seventy-two and section three
  hundred seventy-three-a of the social services law;
    (i) third party reimbursers or their agents to the extent necessary to
  reimburse  health  care  providers  for  health services; provided that,
  where  necessary,  an  otherwise  appropriate  authorization  for   such
  disclosure has been secured by the provider;
    (j)  an insurance institution, for other than the purpose set forth in
  paragraph (i) of this subdivision, provided  the  insurance  institution
  secures  a  dated  and  written authorization that indicates that health
  care providers, health facilities,  insurance  institutions,  and  other
  persons  are  authorized  to  disclose  information  about the protected
  individual, the nature of the information to be disclosed, the  purposes
  for which the information is to be disclosed and which is signed by: (1)
  the  protected  individual;  (2)  if  the protected individual lacks the
  capacity to consent, such other person authorized  pursuant  to  law  to
  consent  for  such  individual;  or  (3)  if the protected individual is
  deceased, the beneficiary or claimant for benefits  under  an  insurance
  policy,  a  health services plan, or an employee welfare benefit plan as
  defined in 29 U.S.C. 1002(1), covering such protected individual;

    (k) any person to whom disclosure is ordered by a court  of  competent
  jurisdiction  pursuant  to  section  twenty-seven hundred eighty-five of
  this article;
    (l) an employee or agent of the division of parole, in accordance with
  paragraph  (a)  of  subdivision  two  of  section  twenty-seven  hundred
  eighty-six of this article, to the  extent  the  employee  or  agent  is
  authorized  to  access  records  containing such information in order to
  carry out the division's functions, powers and duties  with  respect  to
  the  protected  individual, pursuant to section two hundred fifty-nine-a
  of the executive law;
    (m) an employee or agent of the division of probation and correctional
  alternatives or any  local  probation  department,  in  accordance  with
  paragraph  (a)  of  subdivision  two  of  section  twenty-seven  hundred
  eighty-six of this article, to the  extent  the  employee  or  agent  is
  authorized  to  access  records  containing such information in order to
  carry out the division's or department's functions,  powers  and  duties
  with  respect  to  the protected individual, pursuant to articles twelve
  and twelve-A of the executive law;
    (n) a medical director of a local correctional facility as defined  in
  section forty of the correction law, in accordance with paragraph (a) of
  subdivision  two  of  section  twenty-seven  hundred  eighty-six of this
  article, to the extent the medical  director  is  authorized  to  access
  records  containing  such  information  in order to carry out his or her
  functions, powers and duties with respect to the  protected  individual;
  or
    (o)  an  employee  or  agent  of  the  commission  of  correction,  in
  accordance with paragraph (a) of subdivision two of section twenty-seven
  hundred eighty-six of this article, to the extent the employee or  agent
  is  authorized to access records containing such information in order to
  carry out the commission's functions, powers and duties with respect  to
  the  protected  individual,  pursuant to article three of the correction
  law.
    (p) a law guardian, appointed to represent a  minor  pursuant  to  the
  social   services   law  or  the  family  court  act,  with  respect  to
  confidential HIV related information relating to the minor and  for  the
  purpose  of  representing  the  minor.  If the minor has the capacity to
  consent, the law guardian may not redisclose  confidential  HIV  related
  information  without the minor's permission. If the minor lacks capacity
  to consent, the law guardian may  redisclose  confidential  HIV  related
  information  for  the  sole  purpose  of  representing  the  minor. This
  paragraph shall not limit a law guardian's ability to seek relief  under
  section twenty-seven hundred eighty-five of this chapter.
    2.  A  state, county or local health officer may disclose confidential
  HIV related information when:
    (a) disclosure is specifically authorized or required  by  federal  or
  state law; or
    (b)  disclosure  is  made  pursuant  to  a release of confidential HIV
  related information; or
    (c) disclosure is requested by a  physician  pursuant  to  subdivision
  four of this section; or
    (d) disclosure is authorized by court order pursuant to the provisions
  of section twenty-seven hundred eighty-five of this article.
    3.  No  person  to  whom confidential HIV related information has been
  disclosed pursuant to this article shall  disclose  the  information  to
  another  person except as authorized by this article, provided, however,
  that the provisions of this subdivision shall not apply:
    (a) to the protected individual; or

    (b) to a natural person who is authorized pursuant to law  to  consent
  to health care for the protected individual; or
    (c)  to  a  protected individual's foster parent as defined in section
  three hundred seventy-one of the social  services  law  and  subject  to
  regulations  promulgated pursuant to paragraph (a) of subdivision two of
  section twenty-seven hundred eighty-six of this article, for the purpose
  of providing care, treatment or supervision of the protected individual;
  or
    (d) a prospective  adoptive  parent  as  specified  in  section  three
  hundred  seventy-three-a  of  the  social  services  law  and subject to
  regulations promulgated pursuant to paragraph (a) of subdivision two  of
  section  twenty-seven  hundred  eighty-six  of  this article with whom a
  child who is the protected individual has been placed for adoption; or
    (e) to a relative or other person legally responsible to whom a  child
  who  is  the protected individual is to be placed or discharged pursuant
  to section ten hundred seventeen or ten hundred fifty-five of the family
  court act and subject to regulations promulgated pursuant  to  paragraph
  (a)  of  subdivision  two  of section twenty-seven hundred eighty-six of
  this  article,  for  the  purpose  of  providing  care,   treatment   or
  supervision of the protected individual.
    4.  (a)  A physician may disclose confidential HIV related information
  under the following conditions:
    (1) disclosure is made to a contact, to a public  health  officer  for
  the  purpose  of  making  the disclosure to said contact and pursuant to
  section twenty-one hundred thirty of this chapter; or
    (2) the physician believes disclosure  is  medically  appropriate  and
  there is a significant risk of infection to the contact; and
    (3) the physician has counseled the protected individual regarding the
  need to notify the contact; and
    (4)  the physician has informed the protected individual of his or her
  intent  to  make  such  disclosure  to  a   contact,   the   physician's
  responsibility  to  report  the  infected  individual's case pursuant to
  section twenty-one hundred thirty of this  chapter  and  has  given  the
  protected  individual  the  opportunity  to  express  a preference as to
  whether disclosure should be made by the  physician  directly  or  to  a
  public  health  officer  for  the  purpose  of said disclosure.   If the
  protected individual expresses a preference for disclosure by  a  public
  health officer, the physician shall honor such preference.
    (5)  If  a  physician  chooses to make a notification pursuant to this
  section, he or she shall report to the municipal health commissioner  of
  district  health officer on his or her efforts to notify the contacts of
  the protected individual. Such report shall be in a manner and on  forms
  prescribed  by  the  commissioner  and shall include the identity of the
  protected individual and any contacts  as  well  as  information  as  to
  whether the contacts were successfully notified.
    (6) Within a reasonable time of receiving a report that a physician or
  his  or  her  designated  agent did not notify or verify notification of
  contacts provided by the protected individual, the  health  commissioner
  or  district  health  officer  of the municipality from which the report
  originates shall take reasonable measures to notify  such  contacts  and
  otherwise comply with the provisions of this chapter.
    (b)  When  making  such  disclosures  to the contact, the physician or
  public health officer shall provide or make referrals for the  provision
  of  the  appropriate  medical  advice and counseling for coping with the
  emotional consequences of learning  the  information  and  for  changing
  behavior  to  prevent  transmission or contraction of HIV infection. The
  physician or public health officer shall not disclose  the  identity  of
  the  protected  individual  or  the  identity  of  any  other contact. A

  physician or public health officer making  a  notification  pursuant  to
  this  subdivision  shall  make  such  disclosure in person, except where
  circumstances reasonably prevent doing so.
    (c)  A  physician or public health officer shall have no obligation to
  identify or locate any contact except  as  provided  pursuant  to  title
  three of article twenty-one of this chapter.
    (d)  A  physician  may,  upon  the  consent  of  a parent or guardian,
  disclose confidential HIV related information to  a  state,  county,  or
  local health officer for the purpose of reviewing the medical history of
  a child to determine the fitness of the child to attend school.
    (e)  A  physician  may  disclose  confidential HIV related information
  pertaining  to  a  protected  individual  to  a  person  (known  to  the
  physician)  authorized  pursuant  to law to consent to health care for a
  protected individual when the physician reasonably  believes  that:  (1)
  disclosure  is  medically  necessary in order to provide timely care and
  treatment for  the  protected  individual;  and  (2)  after  appropriate
  counseling  as to the need for such disclosure, the protected individual
  will not inform a person authorized by law to consent  to  health  care;
  provided, however, that the physician shall not make such disclosure if,
  in the judgment of the physician: (A) the disclosure would not be in the
  best  interest  of  the  protected  individual;  or  (B)  the  protected
  individual is authorized pursuant to law to consent  to  such  care  and
  treatment.  Any  decision or action by a physician under this paragraph,
  and the basis therefor, shall be recorded in the protected  individual's
  medical record.
    5.  (a) Whenever disclosure of confidential HIV related information is
  made pursuant to this article, except for disclosures made  pursuant  to
  paragraph (a) of subdivision one of this section or paragraph (a) or (e)
  of   subdivision   four  of  this  section,  such  disclosure  shall  be
  accompanied or followed by a statement in  writing  which  includes  the
  following  or substantially similar language: "This information has been
  disclosed to you from confidential records which are protected by  state
  law.  State law prohibits you from making any further disclosure of this
  information without the specific written consent of the person  to  whom
  it  pertains, or as otherwise permitted by law. Any unauthorized further
  disclosure in violation of state law  may  result  in  a  fine  or  jail
  sentence  or both. A general authorization for the release of medical or
  other  information  is  NOT   sufficient   authorization   for   further
  disclosure." An oral disclosure shall be accompanied or followed by such
  a notice within ten days.
    (b)   Except  for  disclosures  made  pursuant  to  paragraph  (c)  of
  subdivision one of this section, or to persons reviewing information  or
  records  in the ordinary course of ensuring that a health facility is in
  compliance with applicable  quality  of  care  standards  or  any  other
  authorized  program evaluation, program monitoring or service review, or
  to governmental agents requiring information necessary for  payments  to
  be  made  on  behalf  of  patients or clients pursuant to contract or in
  accordance to law, a notation of all such disclosures shall be placed in
  the medical record of a protected individual, who shall be  informed  of
  such  disclosures  upon request; provided, however, that for disclosures
  made to insurance institutions such a notation need only be  entered  at
  the time the disclosure is first made.
    6. (a) The provisions of this subdivision shall apply where a provider
  of  a  health  or  social  service  possesses  confidential  HIV related
  information relating to individuals who are recipients of  the  service,
  and  a  federal, state or local government agency supervises or monitors
  the provider or administers the  program  under  which  the  service  is
  provided.

    (b)  Confidential  HIV  related information relating to a recipient of
  such service may be disclosed in accordance with regulations promulgated
  pursuant to paragraph (a) of subdivision  two  of  section  twenty-seven
  hundred eighty-six of this article to an authorized employee or agent of
  such  provider  or government agency, when reasonably necessary for such
  supervision, monitoring, administration, or provision of  such  service.
  The  term  "authorized  employee  or agent", as used in this subdivision
  shall only include any employee or agent  who  would,  in  the  ordinary
  course  of business of the provider or government agency, have access to
  records relating to the care of, treatment of, or provision of a  health
  or social service to the protected individual.
    7.  Nothing  in  this  section  shall  limit  a  person's  or agency's
  responsibility or authority to report, investigate, or redisclose, child
  protective and adult protective services information in accordance  with
  title six of article six and titles one and two of article nine-B of the
  social services law, or to provide or monitor the provision of child and
  adult protective or preventive services.
    8.  Confidential  HIV  related  information  shall  be recorded in the
  medical record of the protected individual.    The  provisions  of  this
  section  shall  not  prohibit  the listing of acquired immune deficiency
  syndrome, HIV related illness or  HIV  infection  in  a  certificate  of
  death,  autopsy report or related documents prepared pursuant to article
  forty-one of this chapter or other applicable laws, ordinances, rules or
  regulations relating to the documentation of cause of death,  nor  shall
  this  section  be  construed  to  modify  any laws, ordinances, rules or
  regulations relative to access to death certificates, autopsy reports or
  such other related documents. Under no circumstances shall  confidential
  HIV  related  information  be disclosable pursuant to article six of the
  public officers law.   Notwithstanding the foregoing,  confidential  HIV
  information   obtained  pursuant  to  section  390.15  of  the  criminal
  procedure law or section 347.1 of the family court act by  either  court
  order  or  consent  of the protected individual shall not be recorded in
  the medical record of the protected individual unless he or she consents
  to the recording of such information in a written  statement  containing
  the  relevant  information  specified  in subdivision two of section two
  thousand seven hundred eighty-one of this article.
    9. Confidential HIV related information shall be  disclosed  upon  the
  request  of  the  health care worker HIV/HBV advisory panel, established
  pursuant to article twenty-seven-DD of this chapter, to the panel or its
  designee only when reasonably necessary for the evaluation of  a  worker
  who has voluntarily sought the panel's review.