The New York State Senate

 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  7326--A
                                                         Cal. No. 239
 
                        2021-2022 Regular Sessions
 
                           I N  A S S E M B L Y
 
                                May 5, 2021
                                ___________
 
 Introduced  by M. of A. GOTTFRIED, BRABENEC, CYMBROWITZ, DICKENS, ENGLE-
   BRIGHT, GALLAGHER, HEVESI, McDONALD, MONTESANO, OTIS,  PAULIN,  SIMON,
   TAYLOR,  THIELE,  ZINERMAN, LAVINE, DAVILA, FORREST, FERNANDEZ, GONZA-
   LEZ-ROJAS, GOODELL, SEAWRIGHT -- read once and referred to the Commit-
   tee on Health -- ordered to a third reading -- passed by Assembly  and
   delivered  to the Senate, recalled from the Senate, vote reconsidered,
   bill amended, ordered reprinted, retaining its place on the  order  of
   third reading
 
 AN  ACT  to  amend  the public health law, in relation to protecting the
   confidentiality of vaccine information
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.   Subdivision 11 of section 2168 of the public health law,
 as amended by chapter 154 of the laws of 2013, is  amended  to  read  as
 follows:
   11.  The commissioner, or in the city of New York, the commissioner of
 the department of health and  mental  hygiene,  may  provide  registrant
 specific  immunization  and lead test records TO THE FEDERAL CENTERS FOR
 DISEASE CONTROL AND PREVENTION OR ITS SUCCESSOR AGENCY, to  other  state
 or  city  registries  and  registries  maintained  by  the Indian Health
 Service and tribal nations recognized by the state or the United  States
 pursuant  to  a  written  agreement  requiring  that  the other registry
 conform to national standards for maintaining the integrity of the  data
 and  THAT  THE  DATA will [not] ONLY be used for purposes [inconsistent]
 CONSISTENT with the provisions of this section AND PROVIDED THAT DISCLO-
 SURE OF IDENTIFIABLE REGISTRANT INFORMATION  SHALL  BE  LIMITED  TO  THE
 MINIMUM  AMOUNT NECESSARY TO ACCOMPLISH THE PURPOSES CONSISTENT WITH THE
 PROVISIONS OF THIS SECTION AS DETERMINED BY THE COMMISSIONER, OR IN  THE
 CITY  OF  NEW  YORK,  THE  COMMISSIONER  OF THE DEPARTMENT OF HEALTH AND
 MENTAL HYGIENE.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD11016-03-2

 A. 7326--A                          2
 
   § 2. Section 2168 of the public health law is amended by adding a  new
 subdivision 11-a to read as follows:
   11-A.  THE  COMMISSIONER, OR IN THE CITY OF NEW YORK, THE COMMISSIONER
 OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE, MAY ONLY SHARE  REGISTRY
 INFORMATION WITH THE FEDERAL CENTERS FOR DISEASE CONTROL AND PREVENTION,
 OR SUCCESSOR AGENCY, FOR PUBLIC HEALTH PURPOSES IN SUMMARY, STATISTICAL,
 AGGREGATE,  OR  OTHER FORM SUCH THAT NO INDIVIDUAL PERSON CAN BE IDENTI-
 FIED, EXCEPT THAT EITHER SUCH  COMMISSIONER  MAY  DISCLOSE  IDENTIFIABLE
 REGISTRANT  INFORMATION  TO  THE FEDERAL CENTERS FOR DISEASE CONTROL AND
 PREVENTION, OR ITS SUCCESSOR AGENCY, WHEN THE  COMMISSIONER  HAS  DETER-
 MINED  THAT THE DISCLOSURE IS IN THE BEST INTERESTS OF THE REGISTRANT OR
 WILL CONTRIBUTE TO THE PROTECTION OF PUBLIC HEALTH, THAT  THE  OBJECTIVE
 OF  THE  DISCLOSURE CANNOT BE SERVED BY DISCLOSURE LIMITED TO DE-IDENTI-
 FIED INFORMATION, AND THE FEDERAL HEALTH  OFFICIALS  HAVE  COMMITTED  IN
 WRITING  NOT  TO  REDISCLOSE TO OR SHARE REGISTRANT INFORMATION WITH ANY
 OTHER FEDERAL AGENCY, INCLUDING BUT NOT LIMITED  TO  THE  DEPARTMENT  OF
 HOMELAND  SECURITY,  IMMIGRATION  AND  CUSTOMS  ENFORCEMENT, CUSTOMS AND
 BORDER PROTECTION, OR ANY SUCCESSOR AGENCY, OR ANY LAW ENFORCEMENT AGEN-
 CY; PROVIDED THAT EITHER SUCH COMMISSIONER MAY FORGO THE WRITTEN COMMIT-
 MENT IF REQUIRING WRITTEN COMMITMENT WOULD RESULT IN  THE  ACTUAL  WITH-
 HOLDING OF FEDERAL FUNDS.
   §  3.  Paragraph  (d)  of  subdivision 4 of section 2168 of the public
 health law, as amended by section 7 of part A of chapter 58 of the  laws
 of 2009, is amended to read as follows:
   (d)  [A person, institution or agency to whom such immunization infor-
 mation is furnished or to whom, access to  records  or  information  has
 been  given,  shall  not  divulge any part thereof so as to disclose the
 identity of such person to whom  such  information  or  record  relates,
 except insofar as such disclosure is necessary for the best interests of
 the  person  or  other  persons,  consistent  with  the purposes of this
 section] (I)  IDENTIFIABLE REGISTRANT INFORMATION IS NOT (1) SUBJECT  TO
 DISCOVERY,  SUBPOENA,  WARRANT,  OR  OTHER MEANS OF LEGAL COMPULSION FOR
 RELEASE TO ANY PERSON OR (2) ADMISSIBLE IN  ANY  CIVIL,  ADMINISTRATIVE,
 CRIMINAL,  OR FAMILY COURT PROCEEDING, EXCEPT FOR THE PURPOSES OF INVES-
 TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR BILL-
 ING FRAUD RELATED TO VACCINATION RECORDS, FRAUDULENT STATEMENTS  RELATED
 TO  AN  INDIVIDUAL'S VACCINATION STATUS, AN ACT OF VIOLENCE OR ATTEMPTED
 VIOLENCE OCCURRING AT THE SITE OF A VACCINATION  PROVIDER'S  OR  VACCINE
 NAVIGATOR'S  BUSINESS,  OR  MEDICAL  MALPRACTICE.   DISCLOSURE FOR THESE
 PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE  COURT
 AND,  IF THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE
 REGISTRY INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY  MATERIAL
 AND RELEVANT FOR THE PURPOSE.
   (II) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT COMMISSIONERS
 OF  LOCAL SOCIAL SERVICES DISTRICTS OR THE COMMISSIONER OF THE OFFICE OF
 CHILDREN AND FAMILY  SERVICES  FROM  ACCESSING  IDENTIFIABLE  REGISTRANT
 INFORMATION UNDER PARAGRAPH (D) OF SUBDIVISION EIGHT OF THIS SECTION.
   §    4.  Subparagraph (i) of paragraph (b) of subdivision 8 of section
 2168 of the public health law, as amended by section  7  of  part  A  of
 chapter 58 of the laws of 2009, is amended to read as follows:
   (i)  The  commissioner  may use the statewide immunization information
 system and the blood lead information in such  system  for  purposes  of
 outreach, quality improvement and accountability, INCLUDING PROFESSIONAL
 RESPONSIBILITY PROCEEDINGS OF THE OFFICE OF PROFESSIONAL MEDICAL CONDUCT
 AND  THE  STATE  EDUCATION DEPARTMENT, research, epidemiological studies
 and disease control, and to obtain blood lead test results  from  physi-
 A. 7326--A                          3
 
 cian  office  laboratories  for the statewide registry of lead levels of
 children established pursuant to subdivision  two  of  section  thirteen
 hundred  seventy-a  of this chapter; (ii) the commissioner of health and
 mental  hygiene for the city of New York may use the immunization regis-
 try and the blood lead  information  in  such  system  for  purposes  of
 outreach, quality improvement and accountability, research, epidemiolog-
 ical  studies  and disease control; (iii) local health departments shall
 have access to the immunization information system and  the  blood  lead
 information in such system for purposes of outreach, quality improvement
 and  accountability,  epidemiological studies and disease control within
 their county; and
   § 5. Paragraph (c) of subdivision 8 of  section  2168  of  the  public
 health law, as amended by chapter 420 of the laws of 2014, is amended to
 read as follows:
   (c) health care providers and their designees, registered professional
 nurses,  and pharmacists authorized to administer immunizations pursuant
 to subdivision two of section sixty-eight hundred one of  the  education
 law  shall  have access to the statewide immunization information system
 and the blood lead information in  such  system  only  for  purposes  of
 submission  of  information  about  vaccinations  received by a specific
 registrant, determination of  the  immunization  status  of  a  specific
 registrant, determination of the blood lead testing status of a specific
 registrant,  submission  of  the results from a blood lead analysis of a
 sample obtained from a specific registrant in accordance with  paragraph
 (h)  of  subdivision  two  of this section, review of practice coverage,
 generation of reminder notices, quality improvement and  accountability,
 INCLUDING  PROFESSIONAL  RESPONSIBILITY  PROCEEDINGS  OF  THE  OFFICE OF
 PROFESSIONAL MEDICAL CONDUCT AND THE  STATE  EDUCATION  DEPARTMENT,  and
 printing  a  copy  of  the  immunization  or lead testing record for the
 registrant's medical record, for the registrant's parent or guardian, or
 other person in parental or custodial relation to  a  child,  or  for  a
 registrant upon reaching eighteen years of age.
   §  6. The public health law is amended by adding a new section 2169 to
 read as follows:
   § 2169. VACCINE CONFIDENTIALITY. 1. AS USED IN  THIS  SECTION,  UNLESS
 CONTEXT REQUIRES OTHERWISE:
   (A) THE TERM "CONSENT" SHALL MEAN INFORMED, AFFIRMATIVE, AND VOLUNTARY
 AUTHORIZATION.
   (B)  THE  TERM  "DE-IDENTIFIED" SHALL MEAN THAT THE INFORMATION CANNOT
 IDENTIFY OR BE MADE TO IDENTIFY OR BE ASSOCIATED WITH A PARTICULAR INDI-
 VIDUAL, DIRECTLY OR INDIRECTLY, AND IS SUBJECT TO  TECHNICAL  SAFEGUARDS
 AND  POLICIES  AND  PROCEDURES  THAT  PREVENT RE-IDENTIFICATION, WHETHER
 INTENTIONALLY OR UNINTENTIONALLY, OF ANY INDIVIDUAL.
   (C) THE TERM "DISCLOSURE" SHALL MEAN RELEASE, TRANSFER, PROVISION  OF,
 ACCESS  TO,  OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE
 ENTITY HOLDING THE INFORMATION.
   (D) THE  TERM  "IMMIGRATION  AUTHORITY"  MEANS  ANY  ENTITY,  OFFICER,
 EMPLOYEE,  OR  GOVERNMENT  EMPLOYEE  OR  AGENT  THEREOF  CHARGED WITH OR
 ENGAGED IN ENFORCEMENT OF THE FEDERAL IMMIGRATION AND  NATIONALITY  ACT,
 INCLUDING  THE UNITED STATES IMMIGRATION AND CUSTOMS ENFORCEMENT, UNITED
 STATES DEPARTMENT OF HOMELAND SECURITY, OR  UNITED  STATES  CUSTOMS  AND
 BORDER  PROTECTION,  OR  AGENT,  CONTRACTOR, OR EMPLOYEE THEREOF, OR ANY
 SUCCESSOR LEGISLATION OR ENTITY.
   (E) THE TERM "LAW ENFORCEMENT AGENT OR ENTITY" MEANS ANY  GOVERNMENTAL
 ENTITY  OR  PUBLIC  SERVANT,  OR  AGENT, CONTRACTOR OR EMPLOYEE THEREOF,
 AUTHORIZED TO INVESTIGATE, PROSECUTE, OR MAKE AN ARREST FOR  A  CRIMINAL
 A. 7326--A                          4
 
 OR  CIVIL  OFFENSE,  OR ENGAGED IN ANY SUCH ACTIVITY, BUT SHALL NOT MEAN
 THE DEPARTMENT, THE COMMISSIONER, A HEALTH DISTRICT, A COUNTY DEPARTMENT
 OF HEALTH, A COUNTY HEALTH COMMISSIONER, A  LOCAL  BOARD  OF  HEALTH,  A
 LOCAL HEALTH OFFICER, THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE
 CITY  OF  NEW  YORK, OR THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND
 MENTAL HYGIENE OF THE CITY OF NEW YORK.
   (F) THE TERM "PERSONAL INFORMATION" SHALL  MEAN  INFORMATION  OBTAINED
 FROM OR ABOUT AN INDIVIDUAL, IN CONNECTION WITH THEIR REGISTERING FOR OR
 RECEIVING A VACCINATION, THAT DIRECTLY OR INDIRECTLY IDENTIFIES, RELATES
 TO,  DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY
 BE LINKED TO A PARTICULAR INDIVIDUAL,  HOUSEHOLD,  OR  PERSONAL  DEVICE.
 INFORMATION  IS  REASONABLY  LINKABLE  TO  AN  INDIVIDUAL, HOUSEHOLD, OR
 PERSONAL DEVICE IF IT CAN BE USED ON ITS  OWN  OR  IN  COMBINATION  WITH
 OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER
 INFORMATION  IS  HELD  BY  THE VACCINE NAVIGATOR OR VACCINE PROVIDER, TO
 IDENTIFY AN INDIVIDUAL, HOUSEHOLD, OR A PERSONAL DEVICE.
   (G) THE TERM "SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION" SHALL
 MEAN SCHEDULING AND BILLING FOR  AN  IMMUNIZATION  APPOINTMENT,  SENDING
 REMINDERS  ABOUT  IMMUNIZATION,  ARRANGING  TRANSPORTATION  TO OR FROM A
 VACCINE PROVIDER, OR REPORTING TO THE  DEPARTMENT,  THE  NEW  YORK  CITY
 DEPARTMENT OF HEALTH AND MENTAL HYGIENE, OR OTHER LOCAL HEALTH AGENCY ON
 WHOSE BEHALF SUCH VACCINE NAVIGATOR IS PERFORMING SUCH SERVICES.
   (H)  THE  TERM "USE" SHALL MEAN, WITH RESPECT TO PERSONAL INFORMATION,
 THE SHARING, EMPLOYMENT, APPLICATION, UTILIZATION, EXAMINATION OR ANALY-
 SIS OF SUCH INFORMATION WITHIN AN ENTITY THAT  MAINTAINS  SUCH  INFORMA-
 TION.
   (I)  THE  TERM "VACCINE NAVIGATOR" SHALL MEAN ANY PERSON THAT COLLECTS
 PERSONAL INFORMATION FROM AN INDIVIDUAL IN ORDER TO REGISTER THAT  INDI-
 VIDUAL  FOR IMMUNIZATION OR TO HELP THAT INDIVIDUAL REGISTER FOR IMMUNI-
 ZATION, PROVIDED THE DEPARTMENT, A LOCAL  PUBLIC  HEALTH  AGENCY,  OR  A
 PERSON THAT ADMINISTERS VACCINES ARE NOT VACCINE NAVIGATORS IF THEY ONLY
 STORE   VACCINE   RECIPIENT  PERSONAL  INFORMATION  IN  MEDICAL  RECORDS
 PROTECTED UNDER THE FEDERAL HEALTH INSURANCE  PORTABILITY  AND  ACCOUNT-
 ABILITY  ACT  OF 1996, ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN
 OF THIS CHAPTER.
   2. (A) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION, ABSENT
 CONSENT FROM THE INDIVIDUAL SEEKING IMMUNIZATION, OR IF  THE  INDIVIDUAL
 LACKS  THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL AUTHOR-
 IZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL  OR  THE  INDIVIDUAL'S
 LEGAL  REPRESENTATIVE,  A  VACCINE NAVIGATOR SHALL NOT USE, DISCLOSE, OR
 MAINTAIN PERSONAL INFORMATION EXCEPT AS NECESSARY  TO  PROVIDE  SERVICES
 ATTENDANT TO THE DELIVERY OF IMMUNIZATION.
   (B)  A VACCINE NAVIGATOR MAY REQUEST CONSENT FROM AN INDIVIDUAL, OR IF
 THE INDIVIDUAL LACKS THE CAPACITY TO  MAKE  HEALTH  CARE  DECISIONS,  AN
 INDIVIDUAL  AUTHORIZED  TO  CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR
 THE INDIVIDUAL'S LEGAL REPRESENTATIVE, TO USE, DISCLOSE, OR MAINTAIN THE
 INDIVIDUAL'S PERSONAL  INFORMATION  FOR  PURPOSES  OTHER  THAN  SERVICES
 ATTENDANT TO THE DELIVERY OF IMMUNIZATION PROVIDED THAT:
   (I)  A VACCINE NAVIGATOR SHALL NOT REFUSE TO PROVIDE A SERVICE ATTEND-
 ANT TO THE DELIVERY OF IMMUNIZATION  FOR  AN  INDIVIDUAL  WHO  DOES  NOT
 PROVIDE SUCH CONSENT;
   (II)  A VACCINE NAVIGATOR SHALL NOT RELATE THE PRICE OR QUALITY OF ANY
 SERVICE ATTENDANT  TO  THE  DELIVERY  OF  IMMUNIZATION  TO  THE  PRIVACY
 PROTECTIONS  AFFORDED  THE INDIVIDUAL, INCLUDING BY PROVIDING A DISCOUNT
 OR OTHER INCENTIVE IN EXCHANGE FOR  SUCH  CONSENT,  PROVIDED  THAT  THIS
 PARAGRAPH DOES NOT PROHIBIT THE OFFERING OF INCENTIVES TO INDIVIDUALS TO
 A. 7326--A                          5
 
 GET  VACCINATED;  PROVIDED THAT SUCH INCENTIVES SHALL NOT BE CONDITIONED
 ON AN INDIVIDUAL'S CONSENT TO ADDITIONAL USES, DISCLOSURES,  OR  MAINTE-
 NANCE  OF  THEIR PERSONAL INFORMATION EXCEPT AS NECESSARY TO PROVIDE THE
 INCENTIVE; AND
   (III) A VACCINE NAVIGATOR SHALL CLEARLY DELINEATE WHAT PERSONAL INFOR-
 MATION IS ADEQUATE, RELEVANT, AND NECESSARY TO PROVIDE A SERVICE ATTEND-
 ANT  TO  THE DELIVERY OF IMMUNIZATION BY CLEARLY AND CONSPICUOUSLY INDI-
 CATING IN ANY SOLICITATION FOR THE INFORMATION THAT ALL  OTHER  REQUESTS
 FOR PERSONAL INFORMATION ARE OPTIONAL.
   (C) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION:
   (I) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE
 MAKE  PERSONAL  INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO A LAW
 ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY;
   (II) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION  OR  OTHER-
 WISE  MAKE  PERSONAL  INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO
 ANY OTHER INDIVIDUAL OR ENTITY, EXCEPT AS EXPLICITLY AUTHORIZED BY  THIS
 TITLE; AND
   (III) WITHOUT CONSENT UNDER THIS SUBDIVISION, PERSONAL INFORMATION AND
 ANY  EVIDENCE  DERIVED  THEREFROM SHALL NOT BE SUBJECT TO OR PROVIDED IN
 RESPONSE TO ANY LEGAL PROCESS OR BE ADMISSIBLE FOR ANY  PURPOSE  IN  ANY
 JUDICIAL OR ADMINISTRATIVE ACTION OR PROCEEDING.
   (D)  (I)  THIS  SECTION  DOES  NOT  BAR  OTHERWISE  LAWFUL DISCLOSURE,
 POSSESSION OR USE OF INFORMATION PERTAINING TO SERVICES ATTENDANT TO THE
 DELIVERY OF IMMUNIZATION, INCLUDING AGGREGATE INFORMATION, THAT IS DE-I-
 DENTIFIED.  DISCLOSURE, POSSESSION OR USE UNDER THIS SUBPARAGRAPH  SHALL
 ONLY BE FOR A PUBLIC HEALTH OR PUBLIC HEALTH RESEARCH PURPOSES.
   (II)  A  PERSON  MAY  ONLY  POSSESS  OR  USE DE-IDENTIFIED INFORMATION
 PERTAINING TO SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZATION IF  THE
 PERSON  MAINTAINS  TECHNICAL SAFEGUARDS AND POLICIES AND PROCEDURES THAT
 PREVENT RE-IDENTIFICATION, WHETHER INTENTIONAL OR UNINTENTIONAL, OF  ANY
 INDIVIDUAL, AS MAY BE REQUIRED BY THE COMMISSIONER (OR THE NEW YORK CITY
 COMMISSIONER  OF  HEALTH  AND MENTAL HYGIENE, IN THE CASE OF INFORMATION
 COLLECTED BY OR UNDER AUTHORITY OF  THE  NEW  YORK  CITY  DEPARTMENT  OF
 HEALTH  AND  MENTAL  HYGIENE.  THE  COMMISSIONER  (OR  THE NEW YORK CITY
 COMMISSIONER AS THE CASE MAY BE) SHALL REQUIRE SAFEGUARDS, POLICIES  AND
 PROCEDURES UNDER THIS PARAGRAPH AS THE COMMISSIONER DEEMS PRACTICABLE.
   (III)  DISCLOSURE,  POSSESSION  AND  USE  OF DE-IDENTIFIED INFORMATION
 UNDER THIS SUBDIVISION SHALL BE ONLY PURSUANT TO APPROVAL BY THE COMMIS-
 SIONER (OR THE NEW YORK CITY COMMISSIONER OF HEALTH AND  MENTAL  HYGIENE
 IN  THE  CASE  OF INFORMATION COLLECTED BY OR UNDER AUTHORITY OF THE NEW
 YORK CITY DEPARTMENT  OF  HEALTH  AND  MENTAL  HYGIENE)  SPECIFYING  THE
 PURPOSE,  NATURE  AND  SCOPE  OF  THE DISCLOSURE, POSSESSION AND USE AND
 MEASURES TO ENSURE THAT IT WILL COMPLY WITH THIS SECTION AND  THE  TERMS
 OF THE APPROVAL.
   (IV)  THIS SECTION DOES NOT PREVENT DISCLOSURE OF PERSONAL INFORMATION
 SOUGHT FOR THE PURPOSES OF  INVESTIGATIONS AND PROSECUTIONS  OF  ALLEGA-
 TIONS  OF  COMPUTER  TAMPERING  OR  BILLING FRAUD RELATED TO VACCINATION
 RECORDS, FRAUDULENT STATEMENTS RELATED TO  AN  INDIVIDUAL'S  VACCINATION
 STATUS,  AN  ACT OF VIOLENCE OR ATTEMPTED VIOLENCE OCCURRING AT THE SITE
 OF A VACCINATION PROVIDER'S OR VACCINE NAVIGATOR'S BUSINESS, OR  MEDICAL
 MALPRACTICE,  PROFESSIONAL  DISCIPLINE,  OR DEFENSE OF ANY CLAIM BROUGHT
 AGAINST A VACCINE NAVIGATOR OR PROVIDER.  DISCLOSURE FOR THESE  PURPOSES
 SHALL  BE  SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE COURT AND, IF
 THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE REGISTRY
 INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY MATERIAL AND RELE-
 VANT FOR THE PURPOSE.
 A. 7326--A                          6

   (E) A VACCINE NAVIGATOR  THAT  MAINTAINS  PERSONAL  INFORMATION  SHALL
 ESTABLISH  APPROPRIATE  ADMINISTRATIVE,  TECHNICAL,  AND  PHYSICAL SAFE-
 GUARDS, POLICIES, AND  PROCEDURES  THAT  ENSURE  THE  SECURITY  OF  THAT
 PERSONAL  INFORMATION.  THE SAFEGUARDS, POLICIES, AND PROCEDURES MUST BE
 APPROPRIATE  TO  THE VOLUME AND NATURE OF THE PERSONAL INFORMATION MAIN-
 TAINED AND THE SIZE, REVENUE, AND SOPHISTICATION OF THE VACCINE  NAVIGA-
 TOR AND MUST ENSURE THAT PERSONAL INFORMATION IS ENCRYPTED AND PROTECTED
 AT  LEAST  AS MUCH AS OR MORE THAN OTHER CONFIDENTIAL INFORMATION IN THE
 VACCINE NAVIGATOR'S POSSESSION. THE COMMISSIONER OR, IN THE CITY OF  NEW
 YORK,  THE  COMMISSIONER  OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE
 SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO REQUIRE THAT  PERSONAL
 INFORMATION POSSESSED, USED, OR UNDER THE CONTROL OF A VACCINE NAVIGATOR
 SHALL  BE  SUBJECT TO TECHNICAL SAFEGUARDS, POLICIES, AND PROCEDURES FOR
 STORAGE, TRANSMISSION, USE, AND PROTECTION OF THE INFORMATION. THE REGU-
 LATIONS MUST TAKE INTO ACCOUNT THE DIFFERENT SIZES, REVENUES AND SOPHIS-
 TICATIONS OF DIFFERENT VACCINE NAVIGATORS, AS WELL  AS  THE  VOLUME  AND
 NATURE OF THE PERSONAL INFORMATION THEY MAINTAIN.
   (F) NOTHING IN THIS SECTION SHALL LIMIT A VACCINE NAVIGATOR THAT HAS A
 PRE-EXISTING  SERVICE  PROVIDER-CLIENT,  PROVIDER-PATIENT,  OR  FAMILIAL
 RELATIONSHIP OR A FRIENDSHIP WITH AN  INDIVIDUAL  FROM  PROCESSING  THAT
 INDIVIDUAL'S  PERSONAL INFORMATION AS PREVIOUSLY AGREED TO IN THE COURSE
 OF THE PRE-EXISTING RELATIONSHIP.
   3. VACCINE PROVIDERS. A VACCINE PROVIDER SHALL NOT DELAY OR  CONDITION
 THE  PROVISION  OF ANY SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION
 BY INVITING OR REQUIRING AN INDIVIDUAL SEEKING VACCINATION  TO  COMPLETE
 AN APPLICATION FOR A CUSTOMER DISCOUNT CARD OR ACCOUNT OR SHARE PERSONAL
 INFORMATION  THAT  WILL  BE STORED OUTSIDE OF A MEDICAL RECORD PROTECTED
 UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF
 1996, ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN OF THIS  CHAPTER
 FOR  PURPOSES OTHER THAN SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZA-
 TION, OR BY ENGAGING IN ANY OTHER ACTIVITY UNRELATED TO THE PROVISION OF
 SUCH A SERVICE THAT THE COMMISSIONER DESIGNATES BY REGULATION.
   § 7. Section 2180 of the public health law is amended by  adding  nine
 new  subdivisions  12,  13,  14,  15,  16,  17, 18, 19 and 20 to read as
 follows:
   12. "COVERED ENTITY" MEANS A GOVERNMENTAL ENTITY OR A PLACE OF  PUBLIC
 ACCOMMODATION,  RESORT  OR  AMUSEMENT, AS DEFINED IN SECTION TWO HUNDRED
 NINETY-TWO OF THE EXECUTIVE LAW.
   13.  "DERIVED  FROM  AN  IMMUNITY  PASSPORT"  MEANS  ANY   INFORMATION
 CONTAINED  IN  OR  RETRIEVED  FROM  AN IMMUNITY PASSPORT, AS WELL AS ANY
 METADATA ASSOCIATED WITH THE USE OF THE IMMUNITY PASSPORT, INCLUDING THE
 TIME AND LOCATION THE IMMUNITY PASSPORT WAS USED, AS WELL AS ANY  INFER-
 ENCES MADE BASED ON THE INFORMATION CONTAINED IN AN IMMUNITY PASSPORT OR
 AN IMMUNITY PASSPORT'S USAGE.
   14.  "DISCLOSE"  MEANS THE RELEASE, TRANSFER, PROVISION OF, ACCESS TO,
 OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE ENTITY HOLD-
 ING THE INFORMATION.
   15. "GOVERNMENTAL ENTITY" MEANS A DEPARTMENT OR AGENCY OF THE STATE OR
 A POLITICAL SUBDIVISION THEREOF, AN INDIVIDUAL ACTING FOR OR  ON  BEHALF
 OF THE STATE OR A POLITICAL SUBDIVISION THEREOF, OR ANY ENTITY REGULATED
 UNDER THE SOCIAL SERVICES LAW.
   16. "IMMUNITY PASSPORT" MEANS A CREDENTIAL, WHETHER DIGITAL, ELECTRON-
 IC,  OR  PHYSICAL,  THAT  IDENTIFIES  AN INDIVIDUAL AS HAVING RECEIVED A
 COVID-19 VACCINE OR A COVID-19 TEST RESULT.
   17. "IMMUNITY PASSPORT PROVIDER" MEANS A LEGAL ENTITY  THAT  DEVELOPS,
 MAINTAINS, DISTRIBUTES, OR MARKETS IMMUNITY PASSPORTS IN NEW YORK STATE.
 A. 7326--A                          7
 
   18.  "PERSONAL  INFORMATION"  MEANS INFORMATION THAT DIRECTLY OR INDI-
 RECTLY IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED
 WITH, OR COULD REASONABLY  BE  LINKED  TO  A  PARTICULAR  INDIVIDUAL  OR
 PERSONAL DEVICE.  INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL OR
 PERSONAL  DEVICE  IF  IT  CAN  BE USED ON ITS OWN OR IN COMBINATION WITH
 OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER
 INFORMATION IS HELD BY THE COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER,
 TO IDENTIFY AN INDIVIDUAL OR A PERSONAL DEVICE.
   19. "PHYSICAL IMMUNITY PASSPORT" MEANS A CREDENTIAL THAT IDENTIFIES AN
 INDIVIDUAL AS HAVING RECEIVED A COVID-19  VACCINE  OR  A  COVID-19  TEST
 RESULT  THAT  DOES NOT RELY ON A DIGITAL OR ELECTRONIC DEVICE.  PHYSICAL
 IMMUNITY PASSPORTS INCLUDE, BUT ARE NOT  LIMITED  TO,  PIECES  OF  PAPER
 DENOTING IMMUNITY STATUS.
   20.  "USE"  MEANS,  WITH RESPECT TO PERSONAL INFORMATION, THE SHARING,
 EMPLOYMENT, APPLICATION, UTILIZATION, EXAMINATION, OR ANALYSIS  OF  SUCH
 INFORMATION WITHIN AN ENTITY THAT MAINTAINS SUCH INFORMATION.
   §  8. The public health law is amended by adding a new section 2183 to
 read as follows:
   § 2183. IMMUNITY PASSPORTS. 1. ANY COVERED ENTITY THAT REQUIRES  PROOF
 OF COVID-19 IMMUNIZATION SHALL PERMIT THE USE OF PHYSICAL IMMUNITY PASS-
 PORTS.    NO  COVERED  ENTITY MAY REQUIRE DIGITAL, ELECTRONIC, OR SMART-
 PHONE-BASED PROOF OF IMMUNITY.
   2. ANY COVERED ENTITY THAT REQUIRES THE USE OF  AN  IMMUNITY  PASSPORT
 SHALL DELETE ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT
 ABOUT THE INDIVIDUAL TO WHOM THE IMMUNITY PASSPORT PERTAINS WITHIN TWEN-
 TY-FOUR HOURS OF RECEIVING IT, EXCEPT THAT WHERE A COVERED ENTITY HAS AN
 ONGOING  RELATIONSHIP  WITH  AN INDIVIDUAL, THE COVERED ENTITY MAY STORE
 THE FACT THAT THE INDIVIDUAL HAS RECEIVED A COVID-19 VACCINE, AS WELL AS
 A COPY OF THE INDIVIDUAL'S IMMUNITY PASSPORT, PROVIDED THAT:
   (A) THE COVERED ENTITY FIRST OBTAINS THE INDIVIDUAL'S INFORMED, AFFIR-
 MATIVE, AND VOLUNTARY CONSENT TO STORE SUCH INFORMATION, AND
   (B) THE COVERED ENTITY STORES ANY COPY  OF  AN  INDIVIDUAL'S  IMMUNITY
 PASSPORT AND ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT
 AS  IF  THEY WERE SUBJECT TO THE CONFIDENTIALITY REQUIREMENTS OF TITLE I
 OF THE AMERICANS WITH DISABILITIES ACT 42 U.S.C. 12112(D) AND ITS IMPLE-
 MENTING REGULATIONS, 29 CFR 1630.14.
   3. AN IMMUNITY PASSPORT PROVIDER SHALL NOT USE  OR  DISCLOSE  PERSONAL
 INFORMATION  DERIVED  FROM AN IMMUNITY PASSPORT BEYOND WHAT IS ADEQUATE,
 RELEVANT, AND NECESSARY TO IDENTIFY AN INDIVIDUAL AS HAVING  RECEIVED  A
 COVID-19  VACCINE  OR  A  COVID-19  TEST  RESULT  AND SHALL NOT COLLECT,
 ACCESS, RECEIVE, CAPTURE, STORE, MAINTAIN,  USE,  OR  DISCLOSE  PERSONAL
 INFORMATION  PERTAINING  TO WHERE OR WHEN AN INDIVIDUAL USES AN IMMUNITY
 PASSPORT.
   4. (A) EXCEPT AS PROVIDED IN THIS SUBDIVISION, NO  COVERED  ENTITY  OR
 IMMUNITY PASSPORT PROVIDER MAY:
   (I)  PROVIDE PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT OR
 OTHERWISE MAKE SUCH PERSONAL INFORMATION ACCESSIBLE, DIRECTLY  OR  INDI-
 RECTLY, TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY;
   (II) PROVIDE SUCH PERSONAL INFORMATION OR OTHERWISE MAKE SUCH PERSONAL
 INFORMATION  ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO ANY OTHER INDIVIDUAL
 OR ENTITY EXCEPT AS EXPLICITLY AUTHORIZED BY THIS SECTION.
   (B) EXCEPT AS  PROVIDED  IN  THIS  SUBDIVISION,  PERSONAL  INFORMATION
 DERIVED  FROM  AN IMMUNITY PASSPORT, AND ANY EVIDENCE DERIVED THEREFROM,
 SHALL NOT BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS  OR
 BE  ADMISSIBLE  FOR ANY PURPOSE IN ANY JUDICIAL OR ADMINISTRATIVE ACTION
 OR PROCEEDING.
 A. 7326--A                          8
 
   (C)  PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT,  AND  ANY
 EVIDENCE  DERIVED THEREFROM, MAY BE DISCLOSED FOR THE PURPOSES OF INVES-
 TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR FRAU-
 DULENT  STATEMENTS  RELATED  TO  AN  INDIVIDUAL'S  VACCINATION   STATUS.
 DISCLOSURE  FOR  THESE PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND
 APPROVAL BY THE COURT AND, IF THE USE IS INITIATED BY A PARTY OTHER THAN
 THE INDIVIDUAL WHOSE PERSONAL INFORMATION  IS  SOUGHT,  THE  INFORMATION
 MUST BE HIGHLY MATERIAL AND RELEVANT FOR THE PURPOSE.
   5.  THE COMMISSIONER SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO
 ENSURE THAT INDIVIDUALS WHO ARE MEDICALLY CONTRAINDICATED FROM RECEIVING
 THE COVID-19 VACCINE ARE NONETHELESS ABLE TO OBTAIN REASONABLE  ACCOMMO-
 DATIONS  TO ENABLE THEM TO ACCESS THE SERVICES OF A COVERED ENTITY, IN A
 MANNER THAT DOES NOT IMPOSE AN UNDUE HARDSHIP ON THE COVERED  ENTITY  OR
 PRESENT  A DIRECT THREAT THAT CANNOT BE ADDRESSED BY A REASONABLE ACCOM-
 MODATION.
   6. NOTHING IN THIS SECTION REQUIRES A COVERED ENTITY TO REQUIRE  PROOF
 OF   COVID-19  IMMUNITY  OR  TO  INDEPENDENTLY  VERIFY  THE  INFORMATION
 CONTAINED IN AN IMMUNITY PASSPORT.
   7. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT A COVERED ENTI-
 TY'S OBLIGATIONS UNDER THE  AMERICANS  WITH  DISABILITIES  ACT,  ARTICLE
 FIFTEEN  OF THE EXECUTIVE LAW, THE CIVIL RIGHTS LAW, OR ANY OTHER FEDER-
 AL, STATE, OR LOCAL ANTI-DISCRIMINATION LAW.
   8. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO AFFECT THE  PRACTICES
 OF  A HEALTH CARE PROVIDER, AS DEFINED IN SECTION EIGHTEEN OF THIS CHAP-
 TER, A HOSPITAL OR NURSING HOME AS DEFINED IN ARTICLE TWENTY-EIGHT    OF
 THIS  CHAPTER,  A  HEALTH  PRACTITIONER AS DEFINED IN SECTION TWENTY-ONE
 HUNDRED SIXTY-FOUR OF THIS CHAPTER, A FACILITY, AS  DEFINED  IN  SECTION
 33.13  OF  THE  MENTAL  HYGIENE  LAW,  OR  A CORRECTIONAL HEALTH SERVICE
 GOVERNED BY THE DEPARTMENT OF CORRECTIONS AND COMMUNITY SUPERVISION, THE
 RULES OF THE BOARD OF CORRECTION IN THE CITY OF NEW YORK,  OR  A  COUNTY
 BOARD  OF CORRECTION, WITH RESPECT TO RECORDS CONCERNING THEIR PATIENTS'
 VACCINATIONS.
   § 9. Severability. If any provision of this act, or any application of
 any provision of this act, is held to be invalid, that shall not  affect
 the  validity or effectiveness of any other provision of this act, or of
 any other application of any provision of this act, which can  be  given
 effect  without  that  provision  or  application;  and to that end, the
 provisions and applications of this act are severable.
   § 10. This act shall take effect immediately.