Assembly Actions - Lowercase Senate Actions - UPPERCASE |
|
---|---|
Dec 30, 2022 | approval memo.107 signed chap.829 |
Dec 19, 2022 | delivered to governor |
Jun 03, 2022 | returned to senate passed assembly ordered to third reading cal.239 substituted for a7326a |
Jun 03, 2022 | substituted by s6541a |
May 31, 2022 | amended on third reading 7326a |
May 31, 2022 | vote reconsidered - restored to third reading returned to assembly recalled from senate |
Feb 16, 2022 | referred to health delivered to senate passed assembly |
Jan 05, 2022 | ordered to third reading cal.239 returned to assembly died in senate |
Jun 09, 2021 | referred to rules delivered to senate passed assembly ordered to third reading rules cal.676 rules report cal.676 reported |
Jun 02, 2021 | reported referred to rules |
May 20, 2021 | reported referred to codes |
May 05, 2021 | referred to health |
assembly Bill A7326A
Signed By Governor2021-2022 Legislative Session
Protects the confidentiality of vaccine information
Sponsored By
GOTTFRIED
Archive: Last Bill Status Via S6541 - Signed by Governor
- Introduced
- In Committee
- On Floor Calendar
- Passed Senate
- Passed Assembly
- Delivered to Governor
- Signed by Governor
Your Voice
Actions
-
view actions (27)
Votes
-
view votes
Jun 2, 2022 - floor Vote
S6541A630floor63Aye0Nay0Absent0Excused0Abstained-
show floor vote details
Floor Vote: Jun 2, 2022
aye (63)- Addabbo
- Akshar
- Bailey
- Biaggi
- Borrello
- Boyle
- Breslin
- Brisport
- Brooks
- Brouk
- Cleare
- Comrie
- Cooney
- Felder
- Gallivan
- Gaughran
- Gianaris
- Gounardes
- Griffo
- Harckham
- Helming
- Hinchey
- Hoylman-Sigal
- Jackson
- Jordan
- Kaminsky
- Kaplan
- Kavanagh
- Kennedy
- Krueger
- Lanza
- Liu
- Mannion
- Martucci
- Mattera
- May
- Mayer
- Myrie
- O'Mara
- Oberacker
- Ortt
- Palumbo
- Parker
- Persaud
- Ramos
- Rath III
- Reichlin-Melnick
- Ritchie
- Rivera
- Ryan
- Salazar
- Sanders
- Savino
- Sepúlveda
- Serino
- Serrano
- Skoufis
- Stavisky
- Stec
- Stewart-Cousins
- Tedisco
- Thomas
- Weik
Jun 2, 2022 - Rules committee Vote
S6541A200committee20Aye0Nay0Aye with Reservations1Absent0Excused0AbstainedMay 3, 2022 - Health committee Vote
S6541100committee10Aye0Nay4Aye with Reservations0Absent1Excused0AbstainedMay 19, 2021 - Health committee Vote
S6541110committee11Aye0Nay4Aye with Reservations0Absent0Excused0Abstained -
show floor vote details
Co-Sponsors
Karl Brabenec
Steven Cymbrowitz
Inez E. Dickens
Steven Englebright
- view additional co-sponsors
Emily Gallagher
Andrew Hevesi
John T. McDonald III
Michael Montesano
Steven Otis
Amy Paulin
Jo Anne Simon
Al Taylor
Fred Thiele
Stefani Zinerman
Charles Lavine
Maritza Davila
Phara Souffrant Forrest
Charles Barron
Nathalia Fernandez
Carmen De La Rosa
Jessica Gonzalez-Rojas
Andrew Goodell
Rebecca Seawright
A7326 - Details
- See Senate Version of this Bill:
- S6541
- Law Section:
- Public Health Law
- Laws Affected:
- Amd §§2168 & 2180, add §§2169 & 2183, Pub Health L
A7326 - Bill Text download pdf
S T A T E O F N E W Y O R K ________________________________________________________________________ 7326 2021-2022 Regular Sessions I N A S S E M B L Y May 5, 2021 ___________ Introduced by M. of A. GOTTFRIED, BRABENEC, CYMBROWITZ, DICKENS, ENGLE- BRIGHT, GALLAGHER, HEVESI, McDONALD, MONTESANO, OTIS, PAULIN, SIMON, TAYLOR, THIELE, ZINERMAN -- read once and referred to the Committee on Health AN ACT to amend the public health law, in relation to protecting the confidentiality of vaccine information THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM- BLY, DO ENACT AS FOLLOWS: Section 1. Paragraph (d) of subdivision 4 of section 2168 of the public health law, as amended by section 7 of part A chapter 58 of the laws of 2009, is amended to read as follows: (d) [A person, institution or agency to whom such immunization infor- mation is furnished or to whom, access to records or information has been given, shall not divulge any part thereof so as to disclose the identity of such person to whom such information or record relates, except insofar as such disclosure is necessary for the best interests of the person or other persons, consistent with the purposes of this section] REGISTRY INFORMATION IS NOT (I) SUBJECT TO DISCOVERY, SUBPOE- NA, WARRANT, OR OTHER MEANS OF LEGAL COMPULSION FOR RELEASE TO ANY PERSON OR ENTITY OR (II) ADMISSIBLE IN ANY CIVIL, ADMINISTRATIVE, CRIMI- NAL, OR FAMILY COURT PROCEEDING. § 2. Subdivision 11 of section 2168 of the public health law, as amended by chapter 154 of the laws of 2013, is amended to read as follows: 11. The commissioner, or in the city of New York, the commissioner of the department of health and mental hygiene, may provide registrant specific immunization and lead test records to other state or city registries and registries maintained by the Indian Health Service and tribal nations recognized by the state or the United States pursuant to a written agreement requiring that the other registry conform to national standards for maintaining the integrity of the data and will EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets [ ] is old law to be omitted.
LBD11016-01-1 A. 7326 2 [not] ONLY be used for purposes [inconsistent] CONSISTENT with the provisions of this section AND PROVIDED THAT EVERY EFFORT SHALL BE MADE TO LIMIT DISCLOSURE OF PERSONAL IDENTIFYING INFORMATION TO THE MINIMUM AMOUNT NECESSARY TO ACCOMPLISH THE PROVISIONS OF THIS SECTION. § 3. Section 2168 of the public health law is amended by adding a new subdivision 11-a to read as follows: 11-A. THE COMMISSIONER, OR IN THE CITY OF NEW YORK, THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE, MAY ONLY SHARE REGISTRY INFORMATION WITH THE FEDERAL CENTERS FOR DISEASE CONTROL AND PREVENTION, OR SUCCESSOR AGENCY, FOR PUBLIC HEALTH PURPOSES IN SUMMARY, STATISTICAL, AGGREGATE, OR OTHER FORM SUCH THAT NO INDIVIDUAL PERSON CAN BE IDENTI- FIED. § 4. The public health law is amended by adding a new section 2169 to read as follows: § 2169. VACCINE CONFIDENTIALITY. 1. AS USED IN THIS SECTION, UNLESS CONTEXT REQUIRES OTHERWISE: (A) THE TERM "INDIVIDUAL" SHALL MEAN A NATURAL PERSON WHOM A VACCINE NAVIGATOR OR VACCINE PROVIDER KNOWS OR HAS REASON TO KNOW IS LOCATED IN NEW YORK STATE. (B) THE TERM "IMMIGRATION AUTHORITY" MEANS ANY ENTITY, OFFICER, EMPLOYEE, OR GOVERNMENT EMPLOYEE OR AGENT THEREOF CHARGED WITH OR ENGAGED IN ENFORCEMENT OF THE FEDERAL IMMIGRATION AND NATIONALITY ACT, INCLUDING THE UNITED STATES IMMIGRATION AND CUSTOMS ENFORCEMENT, UNITED STATES DEPARTMENT OF HOMELAND SECURITY, OR UNITED STATES CUSTOMS AND BORDER PROTECTION, OR AGENT, CONTRACTOR, OR EMPLOYEE THEREOF, OR ANY SUCCESSOR LEGISLATION OR ENTITY. (C) THE TERM "LAW ENFORCEMENT AGENT OR ENTITY" MEANS ANY GOVERNMENTAL ENTITY OR PUBLIC SERVANT, OR AGENT, CONTRACTOR OR EMPLOYEE THEREOF, AUTHORIZED TO INVESTIGATE, PROSECUTE, OR MAKE AN ARREST FOR A CRIMINAL OR CIVIL OFFENSE, OR ENGAGED IN ANY SUCH ACTIVITY, BUT SHALL NOT MEAN THE DEPARTMENT, THE COMMISSIONER, A HEALTH DISTRICT, A COUNTY DEPARTMENT OF HEALTH, A COUNTY HEALTH COMMISSIONER, A LOCAL BOARD OF HEALTH, A LOCAL HEALTH OFFICER, THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE CITY OF NEW YORK, OR THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE CITY OF NEW YORK. (D) THE TERM "PERSONAL INFORMATION" SHALL MEAN INFORMATION THAT DIRECTLY OR INDIRECTLY IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY BE LINKED TO A PARTICULAR INDIVIDUAL, HOUSEHOLD, OR PERSONAL DEVICE. INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL, HOUSEHOLD, OR PERSONAL DEVICE IF IT CAN BE USED ON ITS OWN OR IN COMBINATION WITH OTHER REASONABLY AVAILABLE INFOR- MATION, REGARDLESS OF WHETHER SUCH OTHER INFORMATION IS HELD BY THE VACCINE NAVIGATOR OR VACCINE PROVIDER, TO IDENTIFY AN INDIVIDUAL, HOUSE- HOLD, OR A PERSONAL DEVICE. (E) THE TERM "PROCESS" SHALL MEAN ANY ACTION OR SET OF ACTIONS PERFORMED ON OR WITH PERSONAL INFORMATION, INCLUDING BUT NOT LIMITED TO COLLECTION, ACCESS, USE, RETENTION, SHARING, MONETIZING, ANALYSIS, CREATION, GENERATION, DERIVATION, DECISION-MAKING, RECORDING, ALTER- ATION, ORGANIZATION, STRUCTURING, STORAGE, DISCLOSURE, TRANSMISSION, SALE, LICENSING, DISPOSAL, DESTRUCTION, DE-IDENTIFYING, OR OTHER HANDL- ING OF PERSONAL INFORMATION. (F) THE TERM "VACCINE NAVIGATOR" SHALL MEAN ANY PERSON THAT COLLECTS PERSONAL INFORMATION FROM AN INDIVIDUAL IN ORDER TO REGISTER THAT INDI- VIDUAL FOR IMMUNIZATION OR TO HELP THAT INDIVIDUAL REGISTER FOR IMMUNI- ZATION. A. 7326 3 (G) THE TERM "VACCINE PROVIDER" SHALL MEAN ANY PERSON AUTHORIZED BY LAW TO ADMINISTER AN IMMUNIZATION. 2. (A) ABSENT FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS OPT-IN CONSENT FROM THE INDIVIDUAL SEEKING IMMUNIZATION, OR IF THE INDIVIDUAL LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL AUTHOR- IZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR THE INDIVIDUAL'S LEGAL REPRESENTATIVE, A VACCINE NAVIGATOR SHALL NOT PROCESS PERSONAL INFORMATION BEYOND WHAT IS ADEQUATE, RELEVANT, AND NECESSARY TO SCHEDULE AN IMMUNIZATION APPOINTMENT, SEND ANY APPROPRIATE REMINDERS ABOUT EXIST- ING IMMUNIZATION APPOINTMENTS OR NECESSARY BOOSTER IMMUNIZATION APPOINT- MENTS, OR ARRANGE TRANSPORTATION TO A VACCINE PROVIDER. (B) ABSENT FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS OPT-IN CONSENT FROM THE INDIVIDUAL SEEKING IMMUNIZATION, OR IF THE INDIVIDUAL LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL AUTHOR- IZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR THE INDIVIDUAL'S LEGAL REPRESENTATIVE, A VACCINE PROVIDER SHALL NOT PROCESS PERSONAL INFORMATION OUTSIDE OF A MEDICAL RECORD PROTECTED UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996, ITS IMPLE- MENTING REGULATIONS, OR SECTION EIGHTEEN OF THIS CHAPTER OR A RECORD INCLUDED IN THE STATEWIDE IMMUNIZATION INFORMATION SYSTEM, OR THE CITY- WIDE IMMUNIZATION REGISTRY IN THE CITY OF NEW YORK, BEYOND WHAT IS ADEQUATE, RELEVANT, AND NECESSARY TO SCHEDULE AN IMMUNIZATION APPOINT- MENT, SEND ANY APPROPRIATE REMINDERS ABOUT EXISTING IMMUNIZATION APPOINTMENTS OR NECESSARY BOOSTER IMMUNIZATION APPOINTMENTS, OR ARRANGE TRANSPORTATION TO A VACCINE PROVIDER. (C) A VACCINE NAVIGATOR OR VACCINE PROVIDER MAY REQUEST FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS OPT-IN CONSENT FROM AN INDIVIDUAL, OR IF THE INDIVIDUAL LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL AUTHORIZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR THE INDIVIDUAL'S LEGAL REPRESENTATIVE, TO PROCESS THE INDIVIDUAL'S PERSONAL INFORMATION FOR PURPOSES OTHER THAN SCHEDULING AN IMMUNIZATION APPOINTMENT, SENDING ANY APPROPRIATE REMINDERS ABOUT EXISTING IMMUNIZA- TION APPOINTMENTS OR NECESSARY BOOSTER IMMUNIZATION APPOINTMENTS, OR ARRANGING TRANSPORTATION TO A VACCINE PROVIDER PROVIDED THAT: (I) A VACCINE NAVIGATOR OR VACCINE PROVIDER SHALL NOT REFUSE TO SCHED- ULE AN IMMUNIZATION APPOINTMENT, SEND ANY APPROPRIATE REMINDERS ABOUT EXISTING IMMUNIZATION APPOINTMENTS OR NECESSARY BOOSTER IMMUNIZATION APPOINTMENTS, OR ARRANGE TRANSPORTATION TO A VACCINE PROVIDER FOR AN INDIVIDUAL WHO DOES NOT APPROVE OF THE PROCESSING OF THE INDIVIDUAL'S PERSONAL INFORMATION BEYOND WHAT IS NECESSARY TO SCHEDULE AN IMMUNIZA- TION APPOINTMENT, SEND ANY APPROPRIATE REMINDERS ABOUT EXISTING IMMUNI- ZATION APPOINTMENTS OR NECESSARY BOOSTER IMMUNIZATION APPOINTMENTS, OR ARRANGE TRANSPORTATION TO A VACCINE PROVIDER; (II) A VACCINE NAVIGATOR OR VACCINE PROVIDER SHALL NOT RELATE THE PRICE OR QUALITY OF SCHEDULING AN IMMUNIZATION APPOINTMENT, SENDING ANY APPROPRIATE REMINDERS ABOUT EXISTING IMMUNIZATION APPOINTMENTS OR NECES- SARY BOOSTER IMMUNIZATION APPOINTMENTS, OR ARRANGING TRANSPORTATION TO A VACCINE PROVIDER TO THE PRIVACY PROTECTIONS AFFORDED THE INDIVIDUAL, INCLUDING BY PROVIDING A DISCOUNT OR OTHER INCENTIVE IN EXCHANGE FOR THE OPT-IN CONSENT OF THE INDIVIDUAL TO ADDITIONAL PROCESSING OF THE INDI- VIDUAL'S PERSONAL INFORMATION; AND (III) A VACCINE NAVIGATOR OR VACCINE PROVIDER SHALL CLEARLY DELINEATE WHAT PERSONAL INFORMATION IS ADEQUATE, RELEVANT, AND NECESSARY TO SCHED- ULE AN IMMUNIZATION APPOINTMENT, SEND ANY APPROPRIATE REMINDERS ABOUT EXISTING IMMUNIZATION APPOINTMENTS OR NECESSARY BOOSTER IMMUNIZATION APPOINTMENTS, OR ARRANGE TRANSPORTATION TO A VACCINE PROVIDER BY CLEARLY A. 7326 4 AND CONSPICUOUSLY INDICATING THAT ALL OTHER REQUESTS FOR PERSONAL INFOR- MATION ARE OPTIONAL. (D) NO VACCINE NAVIGATOR OR VACCINE PROVIDER MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY UNDER ANY CIRCUMSTANCES. NO VACCINE NAVIGATOR OR VACCINE PROVIDER MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO ANY OTHER INDIVIDUAL OR ENTITY, EXCEPT AS EXPLICITLY AUTHORIZED BY THIS TITLE. WITHOUT CONSENT UNDER THIS SUBDIVISION, PERSONAL INFORMATION AND ANY EVIDENCE DERIVED THEREFROM SHALL NOT BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS OR BE ADMISSIBLE FOR ANY PURPOSE IN ANY JUDICIAL OR ADMIN- ISTRATIVE ACTION OR PROCEEDING. (E) A VACCINE NAVIGATOR THAT MAINTAINS PERSONAL INFORMATION SHALL ESTABLISH APPROPRIATE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFE- GUARDS, POLICIES, AND PROCEDURES THAT ENSURE THE SECURITY OF THAT PERSONAL INFORMATION. THE SAFEGUARDS, POLICIES, AND PROCEDURES MUST ENSURE THAT PERSONAL INFORMATION IS ENCRYPTED AND PROTECTED AT LEAST AS MUCH AS OR MORE THAN OTHER CONFIDENTIAL INFORMATION IN THE VACCINE NAVIGATOR'S POSSESSION. THE COMMISSIONER OR, IN THE CITY OF NEW YORK, THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO REQUIRE THAT PERSONAL INFOR- MATION POSSESSED, USED, OR UNDER THE CONTROL OF A VACCINE NAVIGATOR SHALL BE SUBJECT TO TECHNICAL SAFEGUARDS, POLICIES, AND PROCEDURES FOR STORAGE, TRANSMISSION, USE, AND PROTECTION OF THE INFORMATION. THE REGU- LATIONS SHALL BE AT LEAST AS OR MORE PROTECTIVE THAN THE SAFEGUARDS, POLICIES, AND PROCEDURES THE COMMISSIONER, OR IN THE CITY OF NEW YORK, THE COMMISSIONER OF HEALTH AND MENTAL HYGIENE, PROVIDES FOR OTHER CONFI- DENTIAL INFORMATION. (F) A VACCINE PROVIDER THAT MAINTAINS PERSONAL INFORMATION OUTSIDE OF A MEDICAL RECORD PROTECTED UNDER THE FEDERAL HEALTH INSURANCE PORTABIL- ITY AND ACCOUNTABILITY ACT OF 1996, ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN OF THIS CHAPTER OR A RECORD INCLUDED IN THE STATEWIDE IMMUNIZATION INFORMATION SYSTEM OR THE CITYWIDE IMMUNIZATION REGISTRY IN THE CITY OF NEW YORK, SHALL ESTABLISH APPROPRIATE ADMINISTRATIVE, TECH- NICAL, AND PHYSICAL SAFEGUARDS, POLICIES, AND PROCEDURES THAT ENSURE THE SECURITY OF THAT PERSONAL INFORMATION. THE SAFEGUARDS, POLICIES, AND PROCEDURES MUST ENSURE THAT PERSONAL INFORMATION IS ENCRYPTED AND PROTECTED AT LEAST AS MUCH AS OR MORE THAN OTHER CONFIDENTIAL INFORMA- TION IN THE VACCINE PROVIDER'S POSSESSION. THE COMMISSIONER, OR IN THE CITY OF NEW YORK THE COMMISSIONER OF HEALTH AND MENTAL HYGIENE, SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO REQUIRE THAT PERSONAL INFOR- MATION POSSESSED, USED, OR UNDER THE CONTROL OF A VACCINE PROVIDER SHALL BE SUBJECT TO TECHNICAL SAFEGUARDS, POLICIES, AND PROCEDURES FOR STOR- AGE, TRANSMISSION, USE, AND PROTECTION OF THE INFORMATION. THE REGU- LATIONS SHALL BE AT LEAST AS OR MORE PROTECTIVE THAN THE SAFEGUARDS, POLICIES, AND PROCEDURES THE COMMISSIONER OR, IN THE CITY OF NEW YORK, THE COMMISSIONER OF HEALTH AND MENTAL HYGIENE PROVIDES FOR OTHER CONFI- DENTIAL INFORMATION. (G) NOTHING IN THIS SECTION SHALL LIMIT A VACCINE NAVIGATOR OR VACCINE PROVIDER THAT HAS A PRE-EXISTING SERVICE PROVIDER-CLIENT, PROVIDER-PA- TIENT, OR FAMILIAL RELATIONSHIP OR A FRIENDSHIP WITH AN INDIVIDUAL FROM PROCESSING THAT INDIVIDUAL'S PERSONAL INFORMATION AS PREVIOUSLY AGREED TO IN THE COURSE OF THE PRE-EXISTING RELATIONSHIP. § 5. Section 2180 of the public health law is amended by adding eight new subdivisions 12, 13, 14, 15, 16, 17, 18 and 19 to read as follows: A. 7326 5 12. "COVERED ENTITY" MEANS A GOVERNMENTAL ENTITY OR A PLACE OF PUBLIC ACCOMMODATION, RESORT OR AMUSEMENT, AS DEFINED IN SECTION TWO HUNDRED NINETY-TWO OF THE EXECUTIVE LAW. 13. "GOVERNMENTAL ENTITY" MEANS A DEPARTMENT OR AGENCY OF THE STATE OR A POLITICAL SUBDIVISION THEREOF, AN INDIVIDUAL ACTING FOR OR ON BEHALF OF THE STATE OR A POLITICAL SUBDIVISION THEREOF, OR ANY ENTITY REGULATED UNDER THE SOCIAL SERVICES LAW. 14. "IMMUNITY PASSPORT" MEANS A CREDENTIAL, WHETHER DIGITAL, ELECTRON- IC, OR PHYSICAL, THAT IDENTIFIES AN INDIVIDUAL AS HAVING RECEIVED A COVID-19 VACCINE OR A COVID-19 TEST RESULT. 15. "IMMUNITY PASSPORT PROVIDER" MEANS A LEGAL ENTITY THAT DEVELOPS, MAINTAINS, DISTRIBUTES, OR MARKETS IMMUNITY PASSPORTS IN NEW YORK STATE. 16. "INDIVIDUAL" MEANS A NATURAL PERSON WHOM THE COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER KNOWS OR HAS REASON TO KNOW IS LOCATED IN NEW YORK STATE. 17. "PERSONAL INFORMATION" MEANS INFORMATION THAT DIRECTLY OR INDI- RECTLY IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY BE LINKED TO A PARTICULAR INDIVIDUAL OR PERSONAL DEVICE. INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL OR PERSONAL DEVICE IF IT CAN BE USED ON ITS OWN OR IN COMBINATION WITH OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER INFORMATION IS HELD BY THE COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER, TO IDENTIFY AN INDIVIDUAL OR A PERSONAL DEVICE. 18. "PHYSICAL IMMUNITY PASSPORT" MEANS A CREDENTIAL THAT IDENTIFIES AN INDIVIDUAL AS HAVING RECEIVED A COVID-19 VACCINE OR A COVID-19 TEST RESULT THAT DOES NOT RELY ON A DIGITAL OR ELECTRONIC DEVICE. PHYSICAL IMMUNITY PASSPORTS INCLUDE, BUT ARE NOT LIMITED TO, PIECES OF PAPER DENOTING IMMUNITY STATUS. 19. "PROCESS" MEANS ANY ACTION OR SET OF ACTIONS PERFORMED ON OR WITH PERSONAL INFORMATION, INCLUDING BUT NOT LIMITED TO COLLECTION, ACCESS, USE, RETENTION, SHARING, MONETIZING, ANALYSIS, CREATION, GENERATION, DERIVATION, DECISION-MAKING, RECORDING, ALTERATION, ORGANIZATION, STRUC- TURING, STORAGE, DISCLOSURE, TRANSMISSION, SALE, LICENSING, DISPOSAL, DESTRUCTION, DE-IDENTIFYING, OR OTHER HANDLING OF PERSONAL INFORMATION. § 6. The public health law is amended by adding a new section 2183 to read as follows: § 2183. IMMUNITY PASSPORTS. 1. ANY COVERED ENTITY THAT REQUIRES PROOF OF COVID-19 IMMUNIZATION SHALL PERMIT THE USE OF PHYSICAL IMMUNITY PASS- PORTS. NO COVERED ENTITY MAY REQUIRE DIGITAL, ELECTRONIC, OR SMART- PHONE-BASED PROOF OF IMMUNITY. 2. ANY COVERED ENTITY THAT REQUIRES THE USE OF AN IMMUNITY PASSPORT SHALL DELETE ANY PERSONAL INFORMATION PROCESSED ABOUT THE INDIVIDUAL TO WHOM THE IMMUNITY PASSPORT PERTAINS WITHIN TWENTY-FOUR HOURS OF PROCESS- ING. 3. AN IMMUNITY PASSPORT PROVIDER SHALL NOT PROCESS PERSONAL INFORMA- TION BEYOND WHAT IS ADEQUATE, RELEVANT, AND NECESSARY TO IDENTIFY AN INDIVIDUAL AS HAVING RECEIVED A COVID-19 VACCINE OR A COVID-19 TEST RESULT AND SHALL NOT PROCESS PERSONAL INFORMATION PERTAINING TO WHERE OR WHEN AN INDIVIDUAL USES AN IMMUNITY PASSPORT. 4. NO COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMI- GRATION AUTHORITY UNDER ANY CIRCUMSTANCES. NO COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO ANY OTHER INDIVIDUAL OR ENTITY, EXCEPT AS EXPLICITLY AUTHORIZED BY THIS SECTION. A. 7326 6 PERSONAL INFORMATION AND ANY EVIDENCE DERIVED THEREFROM SHALL NOT BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS OR BE ADMISSIBLE FOR ANY PURPOSE IN ANY JUDICIAL OR ADMINISTRATIVE ACTION OR PROCEEDING. 5. THE COMMISSIONER SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO ENSURE THAT INDIVIDUALS WHO ARE MEDICALLY CONTRAINDICATED FROM RECEIVING THE COVID-19 VACCINE ARE NONETHELESS ABLE TO ACCESS COVERED ENTITIES, TAKING INTO ACCOUNT THE HEALTH RISKS ASSOCIATED WITH EACH TYPE OF COVERED ENTITY AND THE FACT THAT THE ACCOMMODATION REQUIRED MAY VARY BASED ON THE TYPE OF COVERED ENTITY. 6. NOTHING IN THIS SECTION REQUIRES A COVERED ENTITY TO REQUIRE PROOF OF COVID-19 IMMUNITY OR TO INDEPENDENTLY VERIFY THE INFORMATION CONTAINED IN AN IMMUNITY PASSPORT. 7. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT A COVERED ENTI- TY'S OBLIGATIONS UNDER THE AMERICANS WITH DISABILITIES ACT, ARTICLE FIFTEEN OF THE EXECUTIVE LAW, THE CIVIL RIGHTS LAW, OR ANY OTHER FEDER- AL, STATE, OR LOCAL ANTI-DISCRIMINATION LAW. 8. THE COMMISSIONER SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO IMPLEMENT THIS SECTION. § 7. Severability. If any provision of this act, or any application of any provision of this act, is held to be invalid, that shall not affect the validity or effectiveness of any other provision of this act, or of any other application of any provision of this act, which can be given effect without that provision or application; and to that end, the provisions and applications of this act are severable. § 8. This act shall take effect immediately.
Co-Sponsors
Karl Brabenec
Steven Cymbrowitz
Inez E. Dickens
Steven Englebright
- view additional co-sponsors
Emily Gallagher
Andrew Hevesi
John T. McDonald III
Michael Montesano
Steven Otis
Amy Paulin
Jo Anne Simon
Al Taylor
Fred Thiele
Stefani Zinerman
Charles Lavine
Maritza Davila
Phara Souffrant Forrest
Charles Barron
Nathalia Fernandez
Carmen De La Rosa
Jessica Gonzalez-Rojas
Andrew Goodell
Rebecca Seawright
A7326A (ACTIVE) - Details
- See Senate Version of this Bill:
- S6541
- Law Section:
- Public Health Law
- Laws Affected:
- Amd §§2168 & 2180, add §§2169 & 2183, Pub Health L
A7326A (ACTIVE) - Bill Text download pdf
S T A T E O F N E W Y O R K ________________________________________________________________________ 7326--A Cal. No. 239 2021-2022 Regular Sessions I N A S S E M B L Y May 5, 2021 ___________ Introduced by M. of A. GOTTFRIED, BRABENEC, CYMBROWITZ, DICKENS, ENGLE- BRIGHT, GALLAGHER, HEVESI, McDONALD, MONTESANO, OTIS, PAULIN, SIMON, TAYLOR, THIELE, ZINERMAN, LAVINE, DAVILA, FORREST, FERNANDEZ, GONZA- LEZ-ROJAS, GOODELL, SEAWRIGHT -- read once and referred to the Commit- tee on Health -- ordered to a third reading -- passed by Assembly and delivered to the Senate, recalled from the Senate, vote reconsidered, bill amended, ordered reprinted, retaining its place on the order of third reading AN ACT to amend the public health law, in relation to protecting the confidentiality of vaccine information THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM- BLY, DO ENACT AS FOLLOWS: Section 1. Subdivision 11 of section 2168 of the public health law, as amended by chapter 154 of the laws of 2013, is amended to read as follows: 11. The commissioner, or in the city of New York, the commissioner of the department of health and mental hygiene, may provide registrant specific immunization and lead test records TO THE FEDERAL CENTERS FOR DISEASE CONTROL AND PREVENTION OR ITS SUCCESSOR AGENCY, to other state or city registries and registries maintained by the Indian Health Service and tribal nations recognized by the state or the United States pursuant to a written agreement requiring that the other registry conform to national standards for maintaining the integrity of the data and THAT THE DATA will [not] ONLY be used for purposes [inconsistent] CONSISTENT with the provisions of this section AND PROVIDED THAT DISCLO- SURE OF IDENTIFIABLE REGISTRANT INFORMATION SHALL BE LIMITED TO THE MINIMUM AMOUNT NECESSARY TO ACCOMPLISH THE PURPOSES CONSISTENT WITH THE PROVISIONS OF THIS SECTION AS DETERMINED BY THE COMMISSIONER, OR IN THE CITY OF NEW YORK, THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE. EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD11016-03-2
A. 7326--A 2 § 2. Section 2168 of the public health law is amended by adding a new subdivision 11-a to read as follows: 11-A. THE COMMISSIONER, OR IN THE CITY OF NEW YORK, THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE, MAY ONLY SHARE REGISTRY INFORMATION WITH THE FEDERAL CENTERS FOR DISEASE CONTROL AND PREVENTION, OR SUCCESSOR AGENCY, FOR PUBLIC HEALTH PURPOSES IN SUMMARY, STATISTICAL, AGGREGATE, OR OTHER FORM SUCH THAT NO INDIVIDUAL PERSON CAN BE IDENTI- FIED, EXCEPT THAT EITHER SUCH COMMISSIONER MAY DISCLOSE IDENTIFIABLE REGISTRANT INFORMATION TO THE FEDERAL CENTERS FOR DISEASE CONTROL AND PREVENTION, OR ITS SUCCESSOR AGENCY, WHEN THE COMMISSIONER HAS DETER- MINED THAT THE DISCLOSURE IS IN THE BEST INTERESTS OF THE REGISTRANT OR WILL CONTRIBUTE TO THE PROTECTION OF PUBLIC HEALTH, THAT THE OBJECTIVE OF THE DISCLOSURE CANNOT BE SERVED BY DISCLOSURE LIMITED TO DE-IDENTI- FIED INFORMATION, AND THE FEDERAL HEALTH OFFICIALS HAVE COMMITTED IN WRITING NOT TO REDISCLOSE TO OR SHARE REGISTRANT INFORMATION WITH ANY OTHER FEDERAL AGENCY, INCLUDING BUT NOT LIMITED TO THE DEPARTMENT OF HOMELAND SECURITY, IMMIGRATION AND CUSTOMS ENFORCEMENT, CUSTOMS AND BORDER PROTECTION, OR ANY SUCCESSOR AGENCY, OR ANY LAW ENFORCEMENT AGEN- CY; PROVIDED THAT EITHER SUCH COMMISSIONER MAY FORGO THE WRITTEN COMMIT- MENT IF REQUIRING WRITTEN COMMITMENT WOULD RESULT IN THE ACTUAL WITH- HOLDING OF FEDERAL FUNDS. § 3. Paragraph (d) of subdivision 4 of section 2168 of the public health law, as amended by section 7 of part A of chapter 58 of the laws of 2009, is amended to read as follows: (d) [A person, institution or agency to whom such immunization infor- mation is furnished or to whom, access to records or information has been given, shall not divulge any part thereof so as to disclose the identity of such person to whom such information or record relates, except insofar as such disclosure is necessary for the best interests of the person or other persons, consistent with the purposes of this section] (I) IDENTIFIABLE REGISTRANT INFORMATION IS NOT (1) SUBJECT TO DISCOVERY, SUBPOENA, WARRANT, OR OTHER MEANS OF LEGAL COMPULSION FOR RELEASE TO ANY PERSON OR (2) ADMISSIBLE IN ANY CIVIL, ADMINISTRATIVE, CRIMINAL, OR FAMILY COURT PROCEEDING, EXCEPT FOR THE PURPOSES OF INVES- TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR BILL- ING FRAUD RELATED TO VACCINATION RECORDS, FRAUDULENT STATEMENTS RELATED TO AN INDIVIDUAL'S VACCINATION STATUS, AN ACT OF VIOLENCE OR ATTEMPTED VIOLENCE OCCURRING AT THE SITE OF A VACCINATION PROVIDER'S OR VACCINE NAVIGATOR'S BUSINESS, OR MEDICAL MALPRACTICE. DISCLOSURE FOR THESE PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE COURT AND, IF THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE REGISTRY INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY MATERIAL AND RELEVANT FOR THE PURPOSE. (II) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT COMMISSIONERS OF LOCAL SOCIAL SERVICES DISTRICTS OR THE COMMISSIONER OF THE OFFICE OF CHILDREN AND FAMILY SERVICES FROM ACCESSING IDENTIFIABLE REGISTRANT INFORMATION UNDER PARAGRAPH (D) OF SUBDIVISION EIGHT OF THIS SECTION. § 4. Subparagraph (i) of paragraph (b) of subdivision 8 of section 2168 of the public health law, as amended by section 7 of part A of chapter 58 of the laws of 2009, is amended to read as follows: (i) The commissioner may use the statewide immunization information system and the blood lead information in such system for purposes of outreach, quality improvement and accountability, INCLUDING PROFESSIONAL RESPONSIBILITY PROCEEDINGS OF THE OFFICE OF PROFESSIONAL MEDICAL CONDUCT AND THE STATE EDUCATION DEPARTMENT, research, epidemiological studies and disease control, and to obtain blood lead test results from physi- A. 7326--A 3 cian office laboratories for the statewide registry of lead levels of children established pursuant to subdivision two of section thirteen hundred seventy-a of this chapter; (ii) the commissioner of health and mental hygiene for the city of New York may use the immunization regis- try and the blood lead information in such system for purposes of outreach, quality improvement and accountability, research, epidemiolog- ical studies and disease control; (iii) local health departments shall have access to the immunization information system and the blood lead information in such system for purposes of outreach, quality improvement and accountability, epidemiological studies and disease control within their county; and § 5. Paragraph (c) of subdivision 8 of section 2168 of the public health law, as amended by chapter 420 of the laws of 2014, is amended to read as follows: (c) health care providers and their designees, registered professional nurses, and pharmacists authorized to administer immunizations pursuant to subdivision two of section sixty-eight hundred one of the education law shall have access to the statewide immunization information system and the blood lead information in such system only for purposes of submission of information about vaccinations received by a specific registrant, determination of the immunization status of a specific registrant, determination of the blood lead testing status of a specific registrant, submission of the results from a blood lead analysis of a sample obtained from a specific registrant in accordance with paragraph (h) of subdivision two of this section, review of practice coverage, generation of reminder notices, quality improvement and accountability, INCLUDING PROFESSIONAL RESPONSIBILITY PROCEEDINGS OF THE OFFICE OF PROFESSIONAL MEDICAL CONDUCT AND THE STATE EDUCATION DEPARTMENT, and printing a copy of the immunization or lead testing record for the registrant's medical record, for the registrant's parent or guardian, or other person in parental or custodial relation to a child, or for a registrant upon reaching eighteen years of age. § 6. The public health law is amended by adding a new section 2169 to read as follows: § 2169. VACCINE CONFIDENTIALITY. 1. AS USED IN THIS SECTION, UNLESS CONTEXT REQUIRES OTHERWISE: (A) THE TERM "CONSENT" SHALL MEAN INFORMED, AFFIRMATIVE, AND VOLUNTARY AUTHORIZATION. (B) THE TERM "DE-IDENTIFIED" SHALL MEAN THAT THE INFORMATION CANNOT IDENTIFY OR BE MADE TO IDENTIFY OR BE ASSOCIATED WITH A PARTICULAR INDI- VIDUAL, DIRECTLY OR INDIRECTLY, AND IS SUBJECT TO TECHNICAL SAFEGUARDS AND POLICIES AND PROCEDURES THAT PREVENT RE-IDENTIFICATION, WHETHER INTENTIONALLY OR UNINTENTIONALLY, OF ANY INDIVIDUAL. (C) THE TERM "DISCLOSURE" SHALL MEAN RELEASE, TRANSFER, PROVISION OF, ACCESS TO, OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE ENTITY HOLDING THE INFORMATION. (D) THE TERM "IMMIGRATION AUTHORITY" MEANS ANY ENTITY, OFFICER, EMPLOYEE, OR GOVERNMENT EMPLOYEE OR AGENT THEREOF CHARGED WITH OR ENGAGED IN ENFORCEMENT OF THE FEDERAL IMMIGRATION AND NATIONALITY ACT, INCLUDING THE UNITED STATES IMMIGRATION AND CUSTOMS ENFORCEMENT, UNITED STATES DEPARTMENT OF HOMELAND SECURITY, OR UNITED STATES CUSTOMS AND BORDER PROTECTION, OR AGENT, CONTRACTOR, OR EMPLOYEE THEREOF, OR ANY SUCCESSOR LEGISLATION OR ENTITY. (E) THE TERM "LAW ENFORCEMENT AGENT OR ENTITY" MEANS ANY GOVERNMENTAL ENTITY OR PUBLIC SERVANT, OR AGENT, CONTRACTOR OR EMPLOYEE THEREOF, AUTHORIZED TO INVESTIGATE, PROSECUTE, OR MAKE AN ARREST FOR A CRIMINAL A. 7326--A 4 OR CIVIL OFFENSE, OR ENGAGED IN ANY SUCH ACTIVITY, BUT SHALL NOT MEAN THE DEPARTMENT, THE COMMISSIONER, A HEALTH DISTRICT, A COUNTY DEPARTMENT OF HEALTH, A COUNTY HEALTH COMMISSIONER, A LOCAL BOARD OF HEALTH, A LOCAL HEALTH OFFICER, THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE CITY OF NEW YORK, OR THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE CITY OF NEW YORK. (F) THE TERM "PERSONAL INFORMATION" SHALL MEAN INFORMATION OBTAINED FROM OR ABOUT AN INDIVIDUAL, IN CONNECTION WITH THEIR REGISTERING FOR OR RECEIVING A VACCINATION, THAT DIRECTLY OR INDIRECTLY IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY BE LINKED TO A PARTICULAR INDIVIDUAL, HOUSEHOLD, OR PERSONAL DEVICE. INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL, HOUSEHOLD, OR PERSONAL DEVICE IF IT CAN BE USED ON ITS OWN OR IN COMBINATION WITH OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER INFORMATION IS HELD BY THE VACCINE NAVIGATOR OR VACCINE PROVIDER, TO IDENTIFY AN INDIVIDUAL, HOUSEHOLD, OR A PERSONAL DEVICE. (G) THE TERM "SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION" SHALL MEAN SCHEDULING AND BILLING FOR AN IMMUNIZATION APPOINTMENT, SENDING REMINDERS ABOUT IMMUNIZATION, ARRANGING TRANSPORTATION TO OR FROM A VACCINE PROVIDER, OR REPORTING TO THE DEPARTMENT, THE NEW YORK CITY DEPARTMENT OF HEALTH AND MENTAL HYGIENE, OR OTHER LOCAL HEALTH AGENCY ON WHOSE BEHALF SUCH VACCINE NAVIGATOR IS PERFORMING SUCH SERVICES. (H) THE TERM "USE" SHALL MEAN, WITH RESPECT TO PERSONAL INFORMATION, THE SHARING, EMPLOYMENT, APPLICATION, UTILIZATION, EXAMINATION OR ANALY- SIS OF SUCH INFORMATION WITHIN AN ENTITY THAT MAINTAINS SUCH INFORMA- TION. (I) THE TERM "VACCINE NAVIGATOR" SHALL MEAN ANY PERSON THAT COLLECTS PERSONAL INFORMATION FROM AN INDIVIDUAL IN ORDER TO REGISTER THAT INDI- VIDUAL FOR IMMUNIZATION OR TO HELP THAT INDIVIDUAL REGISTER FOR IMMUNI- ZATION, PROVIDED THE DEPARTMENT, A LOCAL PUBLIC HEALTH AGENCY, OR A PERSON THAT ADMINISTERS VACCINES ARE NOT VACCINE NAVIGATORS IF THEY ONLY STORE VACCINE RECIPIENT PERSONAL INFORMATION IN MEDICAL RECORDS PROTECTED UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNT- ABILITY ACT OF 1996, ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN OF THIS CHAPTER. 2. (A) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION, ABSENT CONSENT FROM THE INDIVIDUAL SEEKING IMMUNIZATION, OR IF THE INDIVIDUAL LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL AUTHOR- IZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR THE INDIVIDUAL'S LEGAL REPRESENTATIVE, A VACCINE NAVIGATOR SHALL NOT USE, DISCLOSE, OR MAINTAIN PERSONAL INFORMATION EXCEPT AS NECESSARY TO PROVIDE SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZATION. (B) A VACCINE NAVIGATOR MAY REQUEST CONSENT FROM AN INDIVIDUAL, OR IF THE INDIVIDUAL LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL AUTHORIZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR THE INDIVIDUAL'S LEGAL REPRESENTATIVE, TO USE, DISCLOSE, OR MAINTAIN THE INDIVIDUAL'S PERSONAL INFORMATION FOR PURPOSES OTHER THAN SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZATION PROVIDED THAT: (I) A VACCINE NAVIGATOR SHALL NOT REFUSE TO PROVIDE A SERVICE ATTEND- ANT TO THE DELIVERY OF IMMUNIZATION FOR AN INDIVIDUAL WHO DOES NOT PROVIDE SUCH CONSENT; (II) A VACCINE NAVIGATOR SHALL NOT RELATE THE PRICE OR QUALITY OF ANY SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION TO THE PRIVACY PROTECTIONS AFFORDED THE INDIVIDUAL, INCLUDING BY PROVIDING A DISCOUNT OR OTHER INCENTIVE IN EXCHANGE FOR SUCH CONSENT, PROVIDED THAT THIS PARAGRAPH DOES NOT PROHIBIT THE OFFERING OF INCENTIVES TO INDIVIDUALS TO A. 7326--A 5 GET VACCINATED; PROVIDED THAT SUCH INCENTIVES SHALL NOT BE CONDITIONED ON AN INDIVIDUAL'S CONSENT TO ADDITIONAL USES, DISCLOSURES, OR MAINTE- NANCE OF THEIR PERSONAL INFORMATION EXCEPT AS NECESSARY TO PROVIDE THE INCENTIVE; AND (III) A VACCINE NAVIGATOR SHALL CLEARLY DELINEATE WHAT PERSONAL INFOR- MATION IS ADEQUATE, RELEVANT, AND NECESSARY TO PROVIDE A SERVICE ATTEND- ANT TO THE DELIVERY OF IMMUNIZATION BY CLEARLY AND CONSPICUOUSLY INDI- CATING IN ANY SOLICITATION FOR THE INFORMATION THAT ALL OTHER REQUESTS FOR PERSONAL INFORMATION ARE OPTIONAL. (C) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION: (I) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY; (II) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION OR OTHER- WISE MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO ANY OTHER INDIVIDUAL OR ENTITY, EXCEPT AS EXPLICITLY AUTHORIZED BY THIS TITLE; AND (III) WITHOUT CONSENT UNDER THIS SUBDIVISION, PERSONAL INFORMATION AND ANY EVIDENCE DERIVED THEREFROM SHALL NOT BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS OR BE ADMISSIBLE FOR ANY PURPOSE IN ANY JUDICIAL OR ADMINISTRATIVE ACTION OR PROCEEDING. (D) (I) THIS SECTION DOES NOT BAR OTHERWISE LAWFUL DISCLOSURE, POSSESSION OR USE OF INFORMATION PERTAINING TO SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZATION, INCLUDING AGGREGATE INFORMATION, THAT IS DE-I- DENTIFIED. DISCLOSURE, POSSESSION OR USE UNDER THIS SUBPARAGRAPH SHALL ONLY BE FOR A PUBLIC HEALTH OR PUBLIC HEALTH RESEARCH PURPOSES. (II) A PERSON MAY ONLY POSSESS OR USE DE-IDENTIFIED INFORMATION PERTAINING TO SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZATION IF THE PERSON MAINTAINS TECHNICAL SAFEGUARDS AND POLICIES AND PROCEDURES THAT PREVENT RE-IDENTIFICATION, WHETHER INTENTIONAL OR UNINTENTIONAL, OF ANY INDIVIDUAL, AS MAY BE REQUIRED BY THE COMMISSIONER (OR THE NEW YORK CITY COMMISSIONER OF HEALTH AND MENTAL HYGIENE, IN THE CASE OF INFORMATION COLLECTED BY OR UNDER AUTHORITY OF THE NEW YORK CITY DEPARTMENT OF HEALTH AND MENTAL HYGIENE. THE COMMISSIONER (OR THE NEW YORK CITY COMMISSIONER AS THE CASE MAY BE) SHALL REQUIRE SAFEGUARDS, POLICIES AND PROCEDURES UNDER THIS PARAGRAPH AS THE COMMISSIONER DEEMS PRACTICABLE. (III) DISCLOSURE, POSSESSION AND USE OF DE-IDENTIFIED INFORMATION UNDER THIS SUBDIVISION SHALL BE ONLY PURSUANT TO APPROVAL BY THE COMMIS- SIONER (OR THE NEW YORK CITY COMMISSIONER OF HEALTH AND MENTAL HYGIENE IN THE CASE OF INFORMATION COLLECTED BY OR UNDER AUTHORITY OF THE NEW YORK CITY DEPARTMENT OF HEALTH AND MENTAL HYGIENE) SPECIFYING THE PURPOSE, NATURE AND SCOPE OF THE DISCLOSURE, POSSESSION AND USE AND MEASURES TO ENSURE THAT IT WILL COMPLY WITH THIS SECTION AND THE TERMS OF THE APPROVAL. (IV) THIS SECTION DOES NOT PREVENT DISCLOSURE OF PERSONAL INFORMATION SOUGHT FOR THE PURPOSES OF INVESTIGATIONS AND PROSECUTIONS OF ALLEGA- TIONS OF COMPUTER TAMPERING OR BILLING FRAUD RELATED TO VACCINATION RECORDS, FRAUDULENT STATEMENTS RELATED TO AN INDIVIDUAL'S VACCINATION STATUS, AN ACT OF VIOLENCE OR ATTEMPTED VIOLENCE OCCURRING AT THE SITE OF A VACCINATION PROVIDER'S OR VACCINE NAVIGATOR'S BUSINESS, OR MEDICAL MALPRACTICE, PROFESSIONAL DISCIPLINE, OR DEFENSE OF ANY CLAIM BROUGHT AGAINST A VACCINE NAVIGATOR OR PROVIDER. DISCLOSURE FOR THESE PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE COURT AND, IF THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE REGISTRY INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY MATERIAL AND RELE- VANT FOR THE PURPOSE. A. 7326--A 6 (E) A VACCINE NAVIGATOR THAT MAINTAINS PERSONAL INFORMATION SHALL ESTABLISH APPROPRIATE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFE- GUARDS, POLICIES, AND PROCEDURES THAT ENSURE THE SECURITY OF THAT PERSONAL INFORMATION. THE SAFEGUARDS, POLICIES, AND PROCEDURES MUST BE APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL INFORMATION MAIN- TAINED AND THE SIZE, REVENUE, AND SOPHISTICATION OF THE VACCINE NAVIGA- TOR AND MUST ENSURE THAT PERSONAL INFORMATION IS ENCRYPTED AND PROTECTED AT LEAST AS MUCH AS OR MORE THAN OTHER CONFIDENTIAL INFORMATION IN THE VACCINE NAVIGATOR'S POSSESSION. THE COMMISSIONER OR, IN THE CITY OF NEW YORK, THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO REQUIRE THAT PERSONAL INFORMATION POSSESSED, USED, OR UNDER THE CONTROL OF A VACCINE NAVIGATOR SHALL BE SUBJECT TO TECHNICAL SAFEGUARDS, POLICIES, AND PROCEDURES FOR STORAGE, TRANSMISSION, USE, AND PROTECTION OF THE INFORMATION. THE REGU- LATIONS MUST TAKE INTO ACCOUNT THE DIFFERENT SIZES, REVENUES AND SOPHIS- TICATIONS OF DIFFERENT VACCINE NAVIGATORS, AS WELL AS THE VOLUME AND NATURE OF THE PERSONAL INFORMATION THEY MAINTAIN. (F) NOTHING IN THIS SECTION SHALL LIMIT A VACCINE NAVIGATOR THAT HAS A PRE-EXISTING SERVICE PROVIDER-CLIENT, PROVIDER-PATIENT, OR FAMILIAL RELATIONSHIP OR A FRIENDSHIP WITH AN INDIVIDUAL FROM PROCESSING THAT INDIVIDUAL'S PERSONAL INFORMATION AS PREVIOUSLY AGREED TO IN THE COURSE OF THE PRE-EXISTING RELATIONSHIP. 3. VACCINE PROVIDERS. A VACCINE PROVIDER SHALL NOT DELAY OR CONDITION THE PROVISION OF ANY SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION BY INVITING OR REQUIRING AN INDIVIDUAL SEEKING VACCINATION TO COMPLETE AN APPLICATION FOR A CUSTOMER DISCOUNT CARD OR ACCOUNT OR SHARE PERSONAL INFORMATION THAT WILL BE STORED OUTSIDE OF A MEDICAL RECORD PROTECTED UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996, ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN OF THIS CHAPTER FOR PURPOSES OTHER THAN SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZA- TION, OR BY ENGAGING IN ANY OTHER ACTIVITY UNRELATED TO THE PROVISION OF SUCH A SERVICE THAT THE COMMISSIONER DESIGNATES BY REGULATION. § 7. Section 2180 of the public health law is amended by adding nine new subdivisions 12, 13, 14, 15, 16, 17, 18, 19 and 20 to read as follows: 12. "COVERED ENTITY" MEANS A GOVERNMENTAL ENTITY OR A PLACE OF PUBLIC ACCOMMODATION, RESORT OR AMUSEMENT, AS DEFINED IN SECTION TWO HUNDRED NINETY-TWO OF THE EXECUTIVE LAW. 13. "DERIVED FROM AN IMMUNITY PASSPORT" MEANS ANY INFORMATION CONTAINED IN OR RETRIEVED FROM AN IMMUNITY PASSPORT, AS WELL AS ANY METADATA ASSOCIATED WITH THE USE OF THE IMMUNITY PASSPORT, INCLUDING THE TIME AND LOCATION THE IMMUNITY PASSPORT WAS USED, AS WELL AS ANY INFER- ENCES MADE BASED ON THE INFORMATION CONTAINED IN AN IMMUNITY PASSPORT OR AN IMMUNITY PASSPORT'S USAGE. 14. "DISCLOSE" MEANS THE RELEASE, TRANSFER, PROVISION OF, ACCESS TO, OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE ENTITY HOLD- ING THE INFORMATION. 15. "GOVERNMENTAL ENTITY" MEANS A DEPARTMENT OR AGENCY OF THE STATE OR A POLITICAL SUBDIVISION THEREOF, AN INDIVIDUAL ACTING FOR OR ON BEHALF OF THE STATE OR A POLITICAL SUBDIVISION THEREOF, OR ANY ENTITY REGULATED UNDER THE SOCIAL SERVICES LAW. 16. "IMMUNITY PASSPORT" MEANS A CREDENTIAL, WHETHER DIGITAL, ELECTRON- IC, OR PHYSICAL, THAT IDENTIFIES AN INDIVIDUAL AS HAVING RECEIVED A COVID-19 VACCINE OR A COVID-19 TEST RESULT. 17. "IMMUNITY PASSPORT PROVIDER" MEANS A LEGAL ENTITY THAT DEVELOPS, MAINTAINS, DISTRIBUTES, OR MARKETS IMMUNITY PASSPORTS IN NEW YORK STATE. A. 7326--A 7 18. "PERSONAL INFORMATION" MEANS INFORMATION THAT DIRECTLY OR INDI- RECTLY IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY BE LINKED TO A PARTICULAR INDIVIDUAL OR PERSONAL DEVICE. INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL OR PERSONAL DEVICE IF IT CAN BE USED ON ITS OWN OR IN COMBINATION WITH OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER INFORMATION IS HELD BY THE COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER, TO IDENTIFY AN INDIVIDUAL OR A PERSONAL DEVICE. 19. "PHYSICAL IMMUNITY PASSPORT" MEANS A CREDENTIAL THAT IDENTIFIES AN INDIVIDUAL AS HAVING RECEIVED A COVID-19 VACCINE OR A COVID-19 TEST RESULT THAT DOES NOT RELY ON A DIGITAL OR ELECTRONIC DEVICE. PHYSICAL IMMUNITY PASSPORTS INCLUDE, BUT ARE NOT LIMITED TO, PIECES OF PAPER DENOTING IMMUNITY STATUS. 20. "USE" MEANS, WITH RESPECT TO PERSONAL INFORMATION, THE SHARING, EMPLOYMENT, APPLICATION, UTILIZATION, EXAMINATION, OR ANALYSIS OF SUCH INFORMATION WITHIN AN ENTITY THAT MAINTAINS SUCH INFORMATION. § 8. The public health law is amended by adding a new section 2183 to read as follows: § 2183. IMMUNITY PASSPORTS. 1. ANY COVERED ENTITY THAT REQUIRES PROOF OF COVID-19 IMMUNIZATION SHALL PERMIT THE USE OF PHYSICAL IMMUNITY PASS- PORTS. NO COVERED ENTITY MAY REQUIRE DIGITAL, ELECTRONIC, OR SMART- PHONE-BASED PROOF OF IMMUNITY. 2. ANY COVERED ENTITY THAT REQUIRES THE USE OF AN IMMUNITY PASSPORT SHALL DELETE ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT ABOUT THE INDIVIDUAL TO WHOM THE IMMUNITY PASSPORT PERTAINS WITHIN TWEN- TY-FOUR HOURS OF RECEIVING IT, EXCEPT THAT WHERE A COVERED ENTITY HAS AN ONGOING RELATIONSHIP WITH AN INDIVIDUAL, THE COVERED ENTITY MAY STORE THE FACT THAT THE INDIVIDUAL HAS RECEIVED A COVID-19 VACCINE, AS WELL AS A COPY OF THE INDIVIDUAL'S IMMUNITY PASSPORT, PROVIDED THAT: (A) THE COVERED ENTITY FIRST OBTAINS THE INDIVIDUAL'S INFORMED, AFFIR- MATIVE, AND VOLUNTARY CONSENT TO STORE SUCH INFORMATION, AND (B) THE COVERED ENTITY STORES ANY COPY OF AN INDIVIDUAL'S IMMUNITY PASSPORT AND ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT AS IF THEY WERE SUBJECT TO THE CONFIDENTIALITY REQUIREMENTS OF TITLE I OF THE AMERICANS WITH DISABILITIES ACT 42 U.S.C. 12112(D) AND ITS IMPLE- MENTING REGULATIONS, 29 CFR 1630.14. 3. AN IMMUNITY PASSPORT PROVIDER SHALL NOT USE OR DISCLOSE PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT BEYOND WHAT IS ADEQUATE, RELEVANT, AND NECESSARY TO IDENTIFY AN INDIVIDUAL AS HAVING RECEIVED A COVID-19 VACCINE OR A COVID-19 TEST RESULT AND SHALL NOT COLLECT, ACCESS, RECEIVE, CAPTURE, STORE, MAINTAIN, USE, OR DISCLOSE PERSONAL INFORMATION PERTAINING TO WHERE OR WHEN AN INDIVIDUAL USES AN IMMUNITY PASSPORT. 4. (A) EXCEPT AS PROVIDED IN THIS SUBDIVISION, NO COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER MAY: (I) PROVIDE PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT OR OTHERWISE MAKE SUCH PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDI- RECTLY, TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY; (II) PROVIDE SUCH PERSONAL INFORMATION OR OTHERWISE MAKE SUCH PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO ANY OTHER INDIVIDUAL OR ENTITY EXCEPT AS EXPLICITLY AUTHORIZED BY THIS SECTION. (B) EXCEPT AS PROVIDED IN THIS SUBDIVISION, PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT, AND ANY EVIDENCE DERIVED THEREFROM, SHALL NOT BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS OR BE ADMISSIBLE FOR ANY PURPOSE IN ANY JUDICIAL OR ADMINISTRATIVE ACTION OR PROCEEDING. A. 7326--A 8 (C) PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT, AND ANY EVIDENCE DERIVED THEREFROM, MAY BE DISCLOSED FOR THE PURPOSES OF INVES- TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR FRAU- DULENT STATEMENTS RELATED TO AN INDIVIDUAL'S VACCINATION STATUS. DISCLOSURE FOR THESE PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE COURT AND, IF THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE PERSONAL INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY MATERIAL AND RELEVANT FOR THE PURPOSE. 5. THE COMMISSIONER SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO ENSURE THAT INDIVIDUALS WHO ARE MEDICALLY CONTRAINDICATED FROM RECEIVING THE COVID-19 VACCINE ARE NONETHELESS ABLE TO OBTAIN REASONABLE ACCOMMO- DATIONS TO ENABLE THEM TO ACCESS THE SERVICES OF A COVERED ENTITY, IN A MANNER THAT DOES NOT IMPOSE AN UNDUE HARDSHIP ON THE COVERED ENTITY OR PRESENT A DIRECT THREAT THAT CANNOT BE ADDRESSED BY A REASONABLE ACCOM- MODATION. 6. NOTHING IN THIS SECTION REQUIRES A COVERED ENTITY TO REQUIRE PROOF OF COVID-19 IMMUNITY OR TO INDEPENDENTLY VERIFY THE INFORMATION CONTAINED IN AN IMMUNITY PASSPORT. 7. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT A COVERED ENTI- TY'S OBLIGATIONS UNDER THE AMERICANS WITH DISABILITIES ACT, ARTICLE FIFTEEN OF THE EXECUTIVE LAW, THE CIVIL RIGHTS LAW, OR ANY OTHER FEDER- AL, STATE, OR LOCAL ANTI-DISCRIMINATION LAW. 8. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO AFFECT THE PRACTICES OF A HEALTH CARE PROVIDER, AS DEFINED IN SECTION EIGHTEEN OF THIS CHAP- TER, A HOSPITAL OR NURSING HOME AS DEFINED IN ARTICLE TWENTY-EIGHT OF THIS CHAPTER, A HEALTH PRACTITIONER AS DEFINED IN SECTION TWENTY-ONE HUNDRED SIXTY-FOUR OF THIS CHAPTER, A FACILITY, AS DEFINED IN SECTION 33.13 OF THE MENTAL HYGIENE LAW, OR A CORRECTIONAL HEALTH SERVICE GOVERNED BY THE DEPARTMENT OF CORRECTIONS AND COMMUNITY SUPERVISION, THE RULES OF THE BOARD OF CORRECTION IN THE CITY OF NEW YORK, OR A COUNTY BOARD OF CORRECTION, WITH RESPECT TO RECORDS CONCERNING THEIR PATIENTS' VACCINATIONS. § 9. Severability. If any provision of this act, or any application of any provision of this act, is held to be invalid, that shall not affect the validity or effectiveness of any other provision of this act, or of any other application of any provision of this act, which can be given effect without that provision or application; and to that end, the provisions and applications of this act are severable. § 10. This act shall take effect immediately.