Section 18. Access to patient information

1. Definitions. For the purpose
  of this section:
    (a)  "Committee"  means  a  medical  access review committee appointed
  pursuant to subdivision four of this section.
    (b)  "Health  care  provider"  or  "provider"  means  a  "health  care
  facility"   or   a   "health  care  practitioner"  as  defined  by  this
  subdivision.
    (c) "Health care facility" or "facility" means a hospital  as  defined
  in  article twenty-eight of this chapter, a home care services agency as
  defined in article thirty-six of this chapter, a hospice as  defined  in
  article  forty  of  this  chapter,  a health maintenance organization as
  defined in article forty-four of  this  chapter,  and  a  shared  health
  facility as defined in article forty-seven of this chapter.
    (d)  "Health  care  practitioner"  or  "practitioner"  means  a person
  licensed under article one hundred thirty-one, one hundred thirty-one-B,
  one  hundred  thirty-two,  one   hundred   thirty-three,   one   hundred
  thirty-six,  one hundred thirty-nine, one hundred forty-one, one hundred
  forty-three,  one  hundred  forty-four,  one  hundred  fifty-three,  one
  hundred  fifty-four,  one hundred fifty-six or one hundred fifty-nine of
  the education law  or  a  person  certified  under  section  twenty-five
  hundred sixty of this chapter.
    (e)  "Patient  information"  or  "information"  means  any information
  concerning or relating to the examination, health assessment  including,
  but  not  limited  to,  a health assessment for insurance and employment
  purposes or treatment of an identifiable subject maintained or possessed
  by a health care facility or health care practitioner who  has  provided
  or is providing services for assessment of a health condition including,
  but  not  limited  to,  a health assessment for insurance and employment
  purposes or  has  treated  or  is  treating  such  subject,  except  (i)
  information  and  clinical  records subject to the provisions of section
  23.05 or 33.13 of the  mental  hygiene  law,  (ii)  personal  notes  and
  observations  of a health care practitioner, provided that such personal
  notes and observations  are  maintained  by  the  practitioner  and  not
  disclosed  by  the practitioner to any other person after January first,
  nineteen  hundred  eighty-seven,  (iii)  information  maintained  by   a
  practitioner,  concerning  or  relating  to  the  prior  examination  or
  treatment of a subject  received  from  another  practitioner,  provided
  however,  that such information may be requested by the subject directly
  from such other practitioner in accordance with the provisions  of  this
  section,  and  (iv)  data  disclosed  to a practitioner in confidence by
  other persons on the basis of an express condition that such data  would
  never  be  disclosed to the subject or other persons, provided that such
  data has never been disclosed to any other person. If at any  time  such
  personal  notes  and observations or such data is disclosed, it shall be
  considered  patient  information  for  purposes  of  this  section.  For
  purposes of this subdivision, "disclosure to any other person" shall not
  include  disclosures  made to practitioners as part of a consultation or
  referral during the treatment  of  the  subject,  to  persons  reviewing
  information  or  records  in  the  ordinary  course  of  ensuring that a
  provider is in compliance with applicable quality of care, licensure  or
  accreditation  standards, to an employee or official of a federal, state
  or local agency for the sole purpose  of  conducting  an  audit  in  the
  course  of  his  or  her  official duties, to the statewide planning and
  research cooperative system, to other persons pursuant to a court order,
  to governmental agencies, insurance companies licensed pursuant  to  the
  insurance  law  and  other third parties requiring information necessary
  for payments to be made to  or  on  behalf  of  patients,  to  qualified
  researchers,  to  the  state board for professional medical conduct when

  such board requests such information in the exercise  of  its  statutory
  function, to an insurance carrier insuring, or an attorney consulted by,
  a  health  care  provider,  or  to  a  health  maintenance  organization
  certified  pursuant  to  article  forty-four of this chapter or licensed
  pursuant to the insurance law, or to the committee or a  court  pursuant
  to the provisions of this section.
    For  purposes  of  this  subdivision  treatment of a subject shall not
  include  diagnostic  services,  except  mammography,  performed   by   a
  practitioner   at  the  request  of  another  health  care  practitioner
  provided,  however,  that  such  information,  and  mammograms,  may  be
  requested by the subject directly from the practitioner at whose request
  such   diagnostic  services  were  performed,  in  accordance  with  the
  provisions of this section.
    (f)  "Personal  notes  and  observations"   means   a   practitioner's
  speculations, impressions (other than tentative or actual diagnosis) and
  reminders, provided such data is maintained by a practitioner.
    (g)  "Qualified  person"  means  any properly identified subject; or a
  guardian appointed under article eighty-one of the mental  hygiene  law;
  or  a  parent  of  an infant; or a guardian of an infant appointed under
  article seventeen of  the  surrogate's  court  procedure  act  or  other
  legally  appointed  guardian of an infant who may be entitled to request
  access to a clinical record under paragraph (c) of  subdivision  two  of
  this  section;  or  a  distributee  of  any deceased subject for whom no
  personal representative, as defined in the estates,  powers  and  trusts
  law,  has been appointed; or an attorney representing a qualified person
  or the subject's estate who holds a power of attorney from the qualified
  person or the subject's estate  explicitly  authorizing  the  holder  to
  execute  a written request for patient information under this section. A
  qualified person shall be  deemed  a  "personal  representative  of  the
  individual" for purposes of the federal health insurance portability and
  accountability act of 1996 and its implementing regulations.
    (h)  "Subject" means an individual concerning whom patient information
  is maintained or possessed by a health care provider.
    (i) "Treating practitioner" means the health care practitioner who has
  primary responsibility for the care of the  subject  within  the  health
  care  facility  or  if  such practitioner is unavailable, a practitioner
  designated by such facility.
    2. Access by qualified persons.  (a)  Subject  to  the  provisions  of
  subdivision  three  of  this  section,  upon  the written request of any
  subject, a health care provider shall provide an opportunity, within ten
  days, for such subject to inspect any patient information concerning  or
  relating  to  the  examination  or  treatment  of  such  subject  in the
  possession of such health care provider.
    (b) Subject to the provisions of subdivision three  of  this  section,
  upon  the  written request of the committee for an incompetent appointed
  pursuant to article seventy-eight of the mental hygiene  law,  a  health
  care  provider  shall  provide  an opportunity, within ten days, for the
  inspection by such committee of any patient information  concerning  the
  incompetent subject in the possession of such health care provider.
    (c) Subject to the provisions of subdivision three of this section and
  except  as  otherwise  provided  by  law,  upon the written request of a
  parent or guardian of an infant appointed pursuant to article  seventeen
  of  the  surrogate's court procedure act, or any other legally appointed
  guardian, a health care provider shall provide  an  opportunity,  within
  ten days, for such parent or guardian to inspect any patient information
  maintained  or  possessed by such provider concerning care and treatment
  of the infant for which the consent  of  such  parent  or  guardian  was
  obtained  or  where  care  was  provided without consent in an emergency

  which was the result of accidental injury or  the  unexpected  onset  of
  serious  illness;  provided, however, that such parent or guardian shall
  not be entitled to inspect or make copies  of  any  patient  information
  concerning  the  care  and  treatment of an infant where the health care
  provider determines that access to the  information  requested  by  such
  parent  or  guardian  would  have a detrimental effect on the provider's
  professional relationship with the infant, or on the care and  treatment
  of  the  infant, or on the infant's relationship with his or her parents
  or guardian.
    (d) Subject to the provisions of subdivision three  of  this  section,
  upon the written request of any qualified person, a health care provider
  shall  furnish  to  such person, within a reasonable time, a copy of any
  patient information requested, and original mammograms requested,  which
  the person is authorized to inspect pursuant to this subdivision.
    (e)  The  provider  may impose a reasonable charge for all inspections
  and copies, not exceeding the costs incurred by such provider, provided,
  however, that a provider may not impose a charge for copying an original
  mammogram when the original has been furnished to any  qualified  person
  and  provided,  further,  that  any  charge  for  furnishing an original
  mammogram pursuant to this section shall not exceed the documented costs
  associated therewith. However, the reasonable charge  for  paper  copies
  shall  not  exceed seventy-five cents per page. A qualified person shall
  not be denied access to patient information solely because of  inability
  to pay.
    (f)  A  provider  may place reasonable limitations on the time, place,
  and frequency of any inspections of patient information.
    (g) In the event that a practitioner does not have space available  to
  permit  the  inspection of patient information, the practitioner may, in
  the alternative, furnish a qualified person a copy of  such  information
  within ten days.
    (h)  A  provider  may  request  the  opportunity to review the patient
  information with the qualified person requesting such  information,  but
  such review shall not be a prerequisite for furnishing the information.
    (i)  A  provider may make available for inspection either the original
  or a copy of patient information.
    3. Limitations on access. (a) Upon receipt of a written request  by  a
  qualified  person to inspect or copy patient information, a practitioner
  may review the information requested. Unless the practitioner determines
  pursuant to paragraph (d) of this subdivision  that  (i)  the  requested
  review   of   the  information  can  reasonably  be  expected  to  cause
  substantial and identifiable harm to the subject or others  which  would
  outweigh  the  qualified person's right to access to the information, or
  (ii) the material requested is personal notes and observations,  or  the
  information  requested  would  have  a  detrimental effect as defined in
  subdivision two of this section,  review  of  such  patient  information
  shall be permitted or copies provided.
    (b) Upon receipt of a written request by a qualified person to inspect
  patient  information maintained by a facility, the facility shall inform
  the treating practitioner of the request. The treating practitioner  may
  review  the  information  requested.  Unless  the  treating practitioner
  determines, pursuant to paragraph  (d)  of  this  subdivision  that  the
  requested  review of the information can reasonably be expected to cause
  substantial and identifiable harm to the subject or others  which  would
  outweigh  the  qualified  person's right of access to the information or
  would have a detrimental effect as defined in subdivision  two  of  this
  section, review of such patient information shall be permitted or copies
  provided.

    (c)  A  subject  over  the  age of twelve years may be notified of any
  request by a qualified person to  review  his/her  patient  information,
  and,  if  the  subject  objects to disclosure, the provider may deny the
  request. In the case of a facility, the treating practitioner  shall  be
  consulted.
    (d)  The  provider may deny access to all or a part of the information
  and may grant access to a prepared summary of the information if,  after
  consideration of all the attendant facts and circumstances, the provider
  determines  that  (i) the request to review all or a part of the patient
  information  can  reasonably  be  expected  to  cause  substantial   and
  identifiable  harm  to  the  subject  or others which would outweigh the
  qualified person's right of access to the information, or would  have  a
  detrimental  effect  as  defined  in subdivision two of this section, or
  (ii) the material requested  is  personal  notes  and  observations.  In
  conducting  such  review, the provider may consider, among other things,
  the following factors: (i) the need for, and  the  fact  of,  continuing
  care  and  treatment;  (ii)  the  extent  to  which the knowledge of the
  information may be harmful to the health or safety  of  the  subject  or
  others;  (iii)  the  extent  to which the information contains sensitive
  material  disclosed  in  confidence  to  the  practitioner  or  treating
  practitioner  by  family  members,  friends  and other persons; (iv) the
  extent to which the information contains sensitive  materials  disclosed
  to  the  practitioner  or the treating practitioner by the subject which
  would be injurious to the subject's relationships  with  other  persons,
  except  when the subject is requesting information concerning himself or
  herself; and (v) in the case of a minor  making  a  request  for  access
  pursuant to subdivision two of this section, the age of the subject.
    (e)  In the event of a denial of access, the qualified person shall be
  informed by the provider of such denial, and whether the denial is based
  on the reasonable  expectation  that  release  of  the  information  can
  reasonably be expected to cause substantial and identifiable harm to the
  subject or others which outweighs the qualified person's right of access
  to  the information or on the reasonable expectation that release of the
  information would have a detrimental effect as  defined  in  subdivision
  two  of  this  section,  or on the basis that the materials sought to be
  reviewed  constitute  personal  notes  and  observations,  and  of   the
  qualified person's right to obtain, without cost, a review of the denial
  by  the  appropriate  medical  record  access  review  committee. If the
  qualified person requests such review, the provider  shall,  within  ten
  days  of  receipt  of  such  request, transmit the information including
  personal notes and observations as defined herein, to  the  chairman  of
  the  appropriate  committee  with a statement setting forth the specific
  reasons for which access was denied. After an in camera  review  of  the
  materials   provided  and  after  providing  all  parties  a  reasonable
  opportunity to be heard, the committee shall  promptly  make  a  written
  determination  whether  the  requested  review  of  the  information can
  reasonably be expected to cause substantial and identifiable harm to the
  subject or others which outweighs the qualified person's right of access
  to the information pursuant to paragraph  (d)  of  this  subdivision  or
  whether  the requested review would have a detrimental effect as defined
  in subdivision two of this section,  or  whether  all  or  part  of  the
  materials   sought   to   be  reviewed  constitute  personal  notes  and
  observations, and shall accordingly determine whether access to  all  or
  part of such materials shall be granted. In the event that the committee
  determines  that  the request for access shall be granted in whole or in
  part, the committee shall notify all  parties  and  the  provider  shall
  grant access pursuant to such determination.

    (f) In the event that access is denied in whole or in part because the
  requested  review  of  information  can  reasonably be expected to cause
  substantial and identifiable harm to the subject or others  which  would
  outweigh  the  qualified person's right of access to the information, or
  would  have  a  detrimental effect as defined in subdivision two of this
  section, the committee shall notify the qualified person of his  or  her
  right  to  seek judicial review of the provider's determination pursuant
  to this section: provided however, that a determination by the committee
  as to whether materials sought to be reviewed constitute personal  notes
  and  observations  shall  not  be the subject of judicial review. Within
  thirty days of receiving notification of such  decision,  the  qualified
  person  may commence, upon notice, a special proceeding in supreme court
  for a judgment requiring the provider to make available the  information
  for  inspection or copying. The court upon such application and after an
  in camera review of the materials provided including  the  determination
  and  record  of  the  committee,  and  after  providing  all  parties an
  opportunity  to  be  heard,  shall  determine  whether  there  exists  a
  reasonable basis for the denial of access. The relief available pursuant
  to  this  section shall be limited to a judgement requiring the provider
  to make available to the qualified person the requested information  for
  inspection or copying.
    (g)  Where  the  written  request  for  patient information under this
  section is signed by a distributee of a  deceased  subject  for  whom  a
  personal  representative has not been appointed, or from the holder of a
  power of attorney from such a distributee, a copy of a certified copy of
  the certificate of death of the subject shall be attached to the written
  request.
    (h) Where the written  request  for  patient  information  under  this
  section  is  signed  by the holder of a power of attorney, a copy of the
  power of attorney shall be attached to the written  request.  A  written
  request  under  this  subdivision  shall  be subject to the duration and
  terms of the power of attorney.
    (i) The release of  patient  information  shall  be  subject  to:  (i)
  article  twenty-seven-F  of  this  chapter  in  the case of confidential
  HIV-related information; (ii) section  seventeen  of  this  article  and
  sections   twenty-three   hundred  one,  twenty-three  hundred  six  and
  twenty-three hundred eight of this chapter in the case of termination of
  a pregnancy and treatment for  a  sexually  transmitted  disease;  (iii)
  article  thirty-three  of  the  mental  hygiene  law; and (iv) any other
  provisions of law creating special requirements relating to the  release
  of   patient   information,   including  the  federal  health  insurance
  portability  and  accountability  act  of  1996  and  its   implementing
  regulations.
    4.  Medical  record  access  review committees. The commissioner shall
  appoint medical record access review committees to hear appeals  of  the
  denial  of access to patient information as provided in paragraph (e) of
  subdivision three of this section. Members of such committees  shall  be
  appointed  by  the  commissioner  from  a  list of nominees submitted by
  statewide  associations  of  providers  in   the   particular   licensed
  profession  involved;  provided,  however, that, with respect to patient
  information maintained by a psychiatrist, the list of nominees shall  be
  composed  of psychiatrists. In the case of the licensed physicians, such
  association shall be the medical society of the state of New York.  Such
  medical  record  access  review committees shall consist of no less than
  three nor more than five licensed professionals. The commissioner  shall
  promulgate  rules and regulations necessary to effectuate the provisions
  of this subdivision.

    5. Annual report. The commissioner shall submit an annual report on or
  before December thirty-first to the governor and the  legislature.  Such
  report  shall include, but not be limited to, the number of requests for
  committee review of providers' denial  of  access  and  the  committees'
  determinations thereon.
    6.  Disclosure  to  third persons. Whenever a health care provider, as
  otherwise authorized by law, discloses patient information to  a  person
  or  entity  other  than  the  subject  of  such  information or to other
  qualified persons, either a copy of the subject's written  authorization
  shall  be  added  to  the patient information or the name and address of
  such third party and a notation of the purpose for the disclosure  shall
  be indicated in the file or record of such subject's patient information
  maintained  by the provider provided, however, that for disclosures made
  to government agencies making payments  on  behalf  of  patients  or  to
  insurance  companies  licensed  pursuant  to  the  insurance  law such a
  notation shall only be entered at the time the disclosure is first made.
  This subdivision shall not apply to disclosure to practitioners or other
  personnel employed by  or  under  contract  with  the  facility,  or  to
  government agencies for purposes of facility inspections or professional
  conduct  investigations.  Any  disclosure  made pursuant to this section
  shall be limited to that information necessary in light  of  the  reason
  for  disclosure. Information so disclosed should be kept confidential by
  the party  receiving  such  information  and  the  limitations  on  such
  disclosure in this section shall apply to such party.
    7.  Applicability  of  federal law. Whenever federal law or applicable
  federal regulations affecting the release of patient information  are  a
  condition  for the receipt of federal aid, and are inconsistent with the
  provisions of this section, the provisions of  federal  law  or  federal
  regulations shall be controlling.
    8.  Challenges  to  accuracy.  A  qualified  person  may challenge the
  accuracy of information maintained in the patient  information  and  may
  require that a brief written statement prepared by him or her concerning
  the  challenged  information  be  inserted into the patient information.
  This statement shall become a permanent part of the patient  information
  and  shall  be  released  whenever the information at issue is released.
  This subdivision shall apply only to factual statements  and  shall  not
  include a provider's observations, inferences or conclusions.
    A facility may place reasonable restrictions on the time and frequency
  of any challenges to accuracy.
    9.  Waivers void. Any agreement by an individual to waive any right to
  inspect, copy or seek correction of patient information as provided  for
  in  this section shall be deemed to be void as against public policy and
  wholly unenforceable.
    10. Nothing contained in this section shall restrict, expand or in any
  way limit  the  disclosure  of  any  information  pursuant  to  articles
  twenty-three,  thirty-one  and  forty-five of the civil practice law and
  rules or section six hundred seventy-seven of the county law.
    11. No proceeding shall be brought  or  penalty  assessed,  except  as
  provided  for  in  this  section, against a health care provider, who in
  good faith, denies access to patient information.
    12.  Immunity  from  liability.  No  health  care  provider  shall  be
  subjected  to  civil liability arising solely from granting or providing
  access to any patient information in accordance with this section.
    * NB There are 2 § 18's