S. 6541--A 2
11-A. THE COMMISSIONER, OR IN THE CITY OF NEW YORK, THE COMMISSIONER
OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE, MAY ONLY SHARE REGISTRY
INFORMATION WITH THE FEDERAL CENTERS FOR DISEASE CONTROL AND PREVENTION,
OR SUCCESSOR AGENCY, FOR PUBLIC HEALTH PURPOSES IN SUMMARY, STATISTICAL,
AGGREGATE, OR OTHER FORM SUCH THAT NO INDIVIDUAL PERSON CAN BE IDENTI-
FIED, EXCEPT THAT EITHER SUCH COMMISSIONER MAY DISCLOSE IDENTIFIABLE
REGISTRANT INFORMATION TO THE FEDERAL CENTERS FOR DISEASE CONTROL AND
PREVENTION, OR ITS SUCCESSOR AGENCY, WHEN THE COMMISSIONER HAS DETER-
MINED THAT THE DISCLOSURE IS IN THE BEST INTERESTS OF THE REGISTRANT OR
WILL CONTRIBUTE TO THE PROTECTION OF PUBLIC HEALTH, THAT THE OBJECTIVE
OF THE DISCLOSURE CANNOT BE SERVED BY DISCLOSURE LIMITED TO DE-IDENTI-
FIED INFORMATION, AND THE FEDERAL HEALTH OFFICIALS HAVE COMMITTED IN
WRITING NOT TO REDISCLOSE TO OR SHARE REGISTRANT INFORMATION WITH ANY
OTHER FEDERAL AGENCY, INCLUDING BUT NOT LIMITED TO THE DEPARTMENT OF
HOMELAND SECURITY, IMMIGRATION AND CUSTOMS ENFORCEMENT, CUSTOMS AND
BORDER PROTECTION, OR ANY SUCCESSOR AGENCY, OR ANY LAW ENFORCEMENT AGEN-
CY; PROVIDED THAT EITHER SUCH COMMISSIONER MAY FORGO THE WRITTEN COMMIT-
MENT IF REQUIRING WRITTEN COMMITMENT WOULD RESULT IN THE ACTUAL WITH-
HOLDING OF FEDERAL FUNDS.
§ 3. Paragraph (d) of subdivision 4 of section 2168 of the public
health law, as amended by section 7 of part A of chapter 58 of the laws
of 2009, is amended to read as follows:
(d) [A person, institution or agency to whom such immunization infor-
mation is furnished or to whom, access to records or information has
been given, shall not divulge any part thereof so as to disclose the
identity of such person to whom such information or record relates,
except insofar as such disclosure is necessary for the best interests of
the person or other persons, consistent with the purposes of this
section] (I) IDENTIFIABLE REGISTRANT INFORMATION IS NOT (1) SUBJECT TO
DISCOVERY, SUBPOENA, WARRANT, OR OTHER MEANS OF LEGAL COMPULSION FOR
RELEASE TO ANY PERSON OR (2) ADMISSIBLE IN ANY CIVIL, ADMINISTRATIVE,
CRIMINAL, OR FAMILY COURT PROCEEDING, EXCEPT FOR THE PURPOSES OF INVES-
TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR BILL-
ING FRAUD RELATED TO VACCINATION RECORDS, FRAUDULENT STATEMENTS RELATED
TO AN INDIVIDUAL'S VACCINATION STATUS, AN ACT OF VIOLENCE OR ATTEMPTED
VIOLENCE OCCURRING AT THE SITE OF A VACCINATION PROVIDER'S OR VACCINE
NAVIGATOR'S BUSINESS, OR MEDICAL MALPRACTICE. DISCLOSURE FOR THESE
PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE COURT
AND, IF THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE
REGISTRY INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY MATERIAL
AND RELEVANT FOR THE PURPOSE.
(II) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT COMMISSIONERS
OF LOCAL SOCIAL SERVICES DISTRICTS OR THE COMMISSIONER OF THE OFFICE OF
CHILDREN AND FAMILY SERVICES FROM ACCESSING IDENTIFIABLE REGISTRANT
INFORMATION UNDER PARAGRAPH (D) OF SUBDIVISION EIGHT OF THIS SECTION.
§ 4. Subparagraph (i) of paragraph (b) of subdivision 8 of section
2168 of the public health law, as amended by section 7 of part A of
chapter 58 of the laws of 2009, is amended to read as follows:
(i) The commissioner may use the statewide immunization information
system and the blood lead information in such system for purposes of
outreach, quality improvement and accountability, INCLUDING PROFESSIONAL
RESPONSIBILITY PROCEEDINGS OF THE OFFICE OF PROFESSIONAL MEDICAL CONDUCT
AND THE STATE EDUCATION DEPARTMENT, research, epidemiological studies
and disease control, and to obtain blood lead test results from physi-
cian office laboratories for the statewide registry of lead levels of
children established pursuant to subdivision two of section thirteen
S. 6541--A 3
hundred seventy-a of this chapter; (ii) the commissioner of health and
mental hygiene for the city of New York may use the immunization regis-
try and the blood lead information in such system for purposes of
outreach, quality improvement and accountability, research, epidemiolog-
ical studies and disease control; (iii) local health departments shall
have access to the immunization information system and the blood lead
information in such system for purposes of outreach, quality improvement
and accountability, epidemiological studies and disease control within
their county; and
§ 5. Paragraph (c) of subdivision 8 of section 2168 of the public
health law, as amended by chapter 420 of the laws of 2014, is amended to
read as follows:
(c) health care providers and their designees, registered professional
nurses, and pharmacists authorized to administer immunizations pursuant
to subdivision two of section sixty-eight hundred one of the education
law shall have access to the statewide immunization information system
and the blood lead information in such system only for purposes of
submission of information about vaccinations received by a specific
registrant, determination of the immunization status of a specific
registrant, determination of the blood lead testing status of a specific
registrant, submission of the results from a blood lead analysis of a
sample obtained from a specific registrant in accordance with paragraph
(h) of subdivision two of this section, review of practice coverage,
generation of reminder notices, quality improvement and accountability,
INCLUDING PROFESSIONAL RESPONSIBILITY PROCEEDINGS OF THE OFFICE OF
PROFESSIONAL MEDICAL CONDUCT AND THE STATE EDUCATION DEPARTMENT, and
printing a copy of the immunization or lead testing record for the
registrant's medical record, for the registrant's parent or guardian, or
other person in parental or custodial relation to a child, or for a
registrant upon reaching eighteen years of age.
§ 6. The public health law is amended by adding a new section 2169 to
read as follows:
§ 2169. VACCINE CONFIDENTIALITY. 1. AS USED IN THIS SECTION, UNLESS
CONTEXT REQUIRES OTHERWISE:
(A) THE TERM "CONSENT" SHALL MEAN INFORMED, AFFIRMATIVE, AND VOLUNTARY
AUTHORIZATION.
(B) THE TERM "DE-IDENTIFIED" SHALL MEAN THAT THE INFORMATION CANNOT
IDENTIFY OR BE MADE TO IDENTIFY OR BE ASSOCIATED WITH A PARTICULAR INDI-
VIDUAL, DIRECTLY OR INDIRECTLY, AND IS SUBJECT TO TECHNICAL SAFEGUARDS
AND POLICIES AND PROCEDURES THAT PREVENT RE-IDENTIFICATION, WHETHER
INTENTIONALLY OR UNINTENTIONALLY, OF ANY INDIVIDUAL.
(C) THE TERM "DISCLOSURE" SHALL MEAN RELEASE, TRANSFER, PROVISION OF,
ACCESS TO, OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE
ENTITY HOLDING THE INFORMATION.
(D) THE TERM "IMMIGRATION AUTHORITY" MEANS ANY ENTITY, OFFICER,
EMPLOYEE, OR GOVERNMENT EMPLOYEE OR AGENT THEREOF CHARGED WITH OR
ENGAGED IN ENFORCEMENT OF THE FEDERAL IMMIGRATION AND NATIONALITY ACT,
INCLUDING THE UNITED STATES IMMIGRATION AND CUSTOMS ENFORCEMENT, UNITED
STATES DEPARTMENT OF HOMELAND SECURITY, OR UNITED STATES CUSTOMS AND
BORDER PROTECTION, OR AGENT, CONTRACTOR, OR EMPLOYEE THEREOF, OR ANY
SUCCESSOR LEGISLATION OR ENTITY.
(E) THE TERM "LAW ENFORCEMENT AGENT OR ENTITY" MEANS ANY GOVERNMENTAL
ENTITY OR PUBLIC SERVANT, OR AGENT, CONTRACTOR OR EMPLOYEE THEREOF,
AUTHORIZED TO INVESTIGATE, PROSECUTE, OR MAKE AN ARREST FOR A CRIMINAL
OR CIVIL OFFENSE, OR ENGAGED IN ANY SUCH ACTIVITY, BUT SHALL NOT MEAN
THE DEPARTMENT, THE COMMISSIONER, A HEALTH DISTRICT, A COUNTY DEPARTMENT
S. 6541--A 4
OF HEALTH, A COUNTY HEALTH COMMISSIONER, A LOCAL BOARD OF HEALTH, A
LOCAL HEALTH OFFICER, THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE
CITY OF NEW YORK, OR THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND
MENTAL HYGIENE OF THE CITY OF NEW YORK.
(F) THE TERM "PERSONAL INFORMATION" SHALL MEAN INFORMATION OBTAINED
FROM OR ABOUT AN INDIVIDUAL, IN CONNECTION WITH THEIR REGISTERING FOR OR
RECEIVING A VACCINATION, THAT DIRECTLY OR INDIRECTLY IDENTIFIES, RELATES
TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY
BE LINKED TO A PARTICULAR INDIVIDUAL, HOUSEHOLD, OR PERSONAL DEVICE.
INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL, HOUSEHOLD, OR
PERSONAL DEVICE IF IT CAN BE USED ON ITS OWN OR IN COMBINATION WITH
OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER
INFORMATION IS HELD BY THE VACCINE NAVIGATOR OR VACCINE PROVIDER, TO
IDENTIFY AN INDIVIDUAL, HOUSEHOLD, OR A PERSONAL DEVICE.
(G) THE TERM "SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION" SHALL
MEAN SCHEDULING AND BILLING FOR AN IMMUNIZATION APPOINTMENT, SENDING
REMINDERS ABOUT IMMUNIZATION, ARRANGING TRANSPORTATION TO OR FROM A
VACCINE PROVIDER, OR REPORTING TO THE DEPARTMENT, THE NEW YORK CITY
DEPARTMENT OF HEALTH AND MENTAL HYGIENE, OR OTHER LOCAL HEALTH AGENCY ON
WHOSE BEHALF SUCH VACCINE NAVIGATOR IS PERFORMING SUCH SERVICES.
(H) THE TERM "USE" SHALL MEAN, WITH RESPECT TO PERSONAL INFORMATION,
THE SHARING, EMPLOYMENT, APPLICATION, UTILIZATION, EXAMINATION OR ANALY-
SIS OF SUCH INFORMATION WITHIN AN ENTITY THAT MAINTAINS SUCH INFORMA-
TION.
(I) THE TERM "VACCINE NAVIGATOR" SHALL MEAN ANY PERSON THAT COLLECTS
PERSONAL INFORMATION FROM AN INDIVIDUAL IN ORDER TO REGISTER THAT INDI-
VIDUAL FOR IMMUNIZATION OR TO HELP THAT INDIVIDUAL REGISTER FOR IMMUNI-
ZATION, PROVIDED THE DEPARTMENT, A LOCAL PUBLIC HEALTH AGENCY, OR A
PERSON THAT ADMINISTERS VACCINES ARE NOT VACCINE NAVIGATORS IF THEY ONLY
STORE VACCINE RECIPIENT PERSONAL INFORMATION IN MEDICAL RECORDS
PROTECTED UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNT-
ABILITY ACT OF 1996, ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN
OF THIS CHAPTER.
2. (A) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION, ABSENT
CONSENT FROM THE INDIVIDUAL SEEKING IMMUNIZATION, OR IF THE INDIVIDUAL
LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL AUTHOR-
IZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR THE INDIVIDUAL'S
LEGAL REPRESENTATIVE, A VACCINE NAVIGATOR SHALL NOT USE, DISCLOSE, OR
MAINTAIN PERSONAL INFORMATION EXCEPT AS NECESSARY TO PROVIDE SERVICES
ATTENDANT TO THE DELIVERY OF IMMUNIZATION.
(B) A VACCINE NAVIGATOR MAY REQUEST CONSENT FROM AN INDIVIDUAL, OR IF
THE INDIVIDUAL LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN
INDIVIDUAL AUTHORIZED TO CONSENT TO HEALTH CARE FOR THE INDIVIDUAL OR
THE INDIVIDUAL'S LEGAL REPRESENTATIVE, TO USE, DISCLOSE, OR MAINTAIN THE
INDIVIDUAL'S PERSONAL INFORMATION FOR PURPOSES OTHER THAN SERVICES
ATTENDANT TO THE DELIVERY OF IMMUNIZATION PROVIDED THAT:
(I) A VACCINE NAVIGATOR SHALL NOT REFUSE TO PROVIDE A SERVICE ATTEND-
ANT TO THE DELIVERY OF IMMUNIZATION FOR AN INDIVIDUAL WHO DOES NOT
PROVIDE SUCH CONSENT;
(II) A VACCINE NAVIGATOR SHALL NOT RELATE THE PRICE OR QUALITY OF ANY
SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION TO THE PRIVACY
PROTECTIONS AFFORDED THE INDIVIDUAL, INCLUDING BY PROVIDING A DISCOUNT
OR OTHER INCENTIVE IN EXCHANGE FOR SUCH CONSENT, PROVIDED THAT THIS
PARAGRAPH DOES NOT PROHIBIT THE OFFERING OF INCENTIVES TO INDIVIDUALS TO
GET VACCINATED; PROVIDED THAT SUCH INCENTIVES SHALL NOT BE CONDITIONED
ON AN INDIVIDUAL'S CONSENT TO ADDITIONAL USES, DISCLOSURES, OR MAINTE-
S. 6541--A 5
NANCE OF THEIR PERSONAL INFORMATION EXCEPT AS NECESSARY TO PROVIDE THE
INCENTIVE; AND
(III) A VACCINE NAVIGATOR SHALL CLEARLY DELINEATE WHAT PERSONAL INFOR-
MATION IS ADEQUATE, RELEVANT, AND NECESSARY TO PROVIDE A SERVICE ATTEND-
ANT TO THE DELIVERY OF IMMUNIZATION BY CLEARLY AND CONSPICUOUSLY INDI-
CATING IN ANY SOLICITATION FOR THE INFORMATION THAT ALL OTHER REQUESTS
FOR PERSONAL INFORMATION ARE OPTIONAL.
(C) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION:
(I) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE
MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO A LAW
ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY;
(II) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION OR OTHER-
WISE MAKE PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO
ANY OTHER INDIVIDUAL OR ENTITY, EXCEPT AS EXPLICITLY AUTHORIZED BY THIS
TITLE; AND
(III) WITHOUT CONSENT UNDER THIS SUBDIVISION, PERSONAL INFORMATION AND
ANY EVIDENCE DERIVED THEREFROM SHALL NOT BE SUBJECT TO OR PROVIDED IN
RESPONSE TO ANY LEGAL PROCESS OR BE ADMISSIBLE FOR ANY PURPOSE IN ANY
JUDICIAL OR ADMINISTRATIVE ACTION OR PROCEEDING.
(D) (I) THIS SECTION DOES NOT BAR OTHERWISE LAWFUL DISCLOSURE,
POSSESSION OR USE OF INFORMATION PERTAINING TO SERVICES ATTENDANT TO THE
DELIVERY OF IMMUNIZATION, INCLUDING AGGREGATE INFORMATION, THAT IS DE-I-
DENTIFIED. DISCLOSURE, POSSESSION OR USE UNDER THIS SUBPARAGRAPH SHALL
ONLY BE FOR A PUBLIC HEALTH OR PUBLIC HEALTH RESEARCH PURPOSES.
(II) A PERSON MAY ONLY POSSESS OR USE DE-IDENTIFIED INFORMATION
PERTAINING TO SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZATION IF THE
PERSON MAINTAINS TECHNICAL SAFEGUARDS AND POLICIES AND PROCEDURES THAT
PREVENT RE-IDENTIFICATION, WHETHER INTENTIONAL OR UNINTENTIONAL, OF ANY
INDIVIDUAL, AS MAY BE REQUIRED BY THE COMMISSIONER (OR THE NEW YORK CITY
COMMISSIONER OF HEALTH AND MENTAL HYGIENE, IN THE CASE OF INFORMATION
COLLECTED BY OR UNDER AUTHORITY OF THE NEW YORK CITY DEPARTMENT OF
HEALTH AND MENTAL HYGIENE. THE COMMISSIONER (OR THE NEW YORK CITY
COMMISSIONER AS THE CASE MAY BE) SHALL REQUIRE SAFEGUARDS, POLICIES AND
PROCEDURES UNDER THIS PARAGRAPH AS THE COMMISSIONER DEEMS PRACTICABLE.
(III) DISCLOSURE, POSSESSION AND USE OF DE-IDENTIFIED INFORMATION
UNDER THIS SUBDIVISION SHALL BE ONLY PURSUANT TO APPROVAL BY THE COMMIS-
SIONER (OR THE NEW YORK CITY COMMISSIONER OF HEALTH AND MENTAL HYGIENE
IN THE CASE OF INFORMATION COLLECTED BY OR UNDER AUTHORITY OF THE NEW
YORK CITY DEPARTMENT OF HEALTH AND MENTAL HYGIENE) SPECIFYING THE
PURPOSE, NATURE AND SCOPE OF THE DISCLOSURE, POSSESSION AND USE AND
MEASURES TO ENSURE THAT IT WILL COMPLY WITH THIS SECTION AND THE TERMS
OF THE APPROVAL.
(IV) THIS SECTION DOES NOT PREVENT DISCLOSURE OF PERSONAL INFORMATION
SOUGHT FOR THE PURPOSES OF INVESTIGATIONS AND PROSECUTIONS OF ALLEGA-
TIONS OF COMPUTER TAMPERING OR BILLING FRAUD RELATED TO VACCINATION
RECORDS, FRAUDULENT STATEMENTS RELATED TO AN INDIVIDUAL'S VACCINATION
STATUS, AN ACT OF VIOLENCE OR ATTEMPTED VIOLENCE OCCURRING AT THE SITE
OF A VACCINATION PROVIDER'S OR VACCINE NAVIGATOR'S BUSINESS, OR MEDICAL
MALPRACTICE, PROFESSIONAL DISCIPLINE, OR DEFENSE OF ANY CLAIM BROUGHT
AGAINST A VACCINE NAVIGATOR OR PROVIDER. DISCLOSURE FOR THESE PURPOSES
SHALL BE SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE COURT AND, IF
THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE REGISTRY
INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY MATERIAL AND RELE-
VANT FOR THE PURPOSE.
(E) A VACCINE NAVIGATOR THAT MAINTAINS PERSONAL INFORMATION SHALL
ESTABLISH APPROPRIATE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFE-
S. 6541--A 6
GUARDS, POLICIES, AND PROCEDURES THAT ENSURE THE SECURITY OF THAT
PERSONAL INFORMATION. THE SAFEGUARDS, POLICIES, AND PROCEDURES MUST BE
APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL INFORMATION MAIN-
TAINED AND THE SIZE, REVENUE, AND SOPHISTICATION OF THE VACCINE NAVIGA-
TOR AND MUST ENSURE THAT PERSONAL INFORMATION IS ENCRYPTED AND PROTECTED
AT LEAST AS MUCH AS OR MORE THAN OTHER CONFIDENTIAL INFORMATION IN THE
VACCINE NAVIGATOR'S POSSESSION. THE COMMISSIONER OR, IN THE CITY OF NEW
YORK, THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE
SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO REQUIRE THAT PERSONAL
INFORMATION POSSESSED, USED, OR UNDER THE CONTROL OF A VACCINE NAVIGATOR
SHALL BE SUBJECT TO TECHNICAL SAFEGUARDS, POLICIES, AND PROCEDURES FOR
STORAGE, TRANSMISSION, USE, AND PROTECTION OF THE INFORMATION. THE REGU-
LATIONS MUST TAKE INTO ACCOUNT THE DIFFERENT SIZES, REVENUES AND SOPHIS-
TICATIONS OF DIFFERENT VACCINE NAVIGATORS, AS WELL AS THE VOLUME AND
NATURE OF THE PERSONAL INFORMATION THEY MAINTAIN.
(F) NOTHING IN THIS SECTION SHALL LIMIT A VACCINE NAVIGATOR THAT HAS A
PRE-EXISTING SERVICE PROVIDER-CLIENT, PROVIDER-PATIENT, OR FAMILIAL
RELATIONSHIP OR A FRIENDSHIP WITH AN INDIVIDUAL FROM PROCESSING THAT
INDIVIDUAL'S PERSONAL INFORMATION AS PREVIOUSLY AGREED TO IN THE COURSE
OF THE PRE-EXISTING RELATIONSHIP.
3. VACCINE PROVIDERS. A VACCINE PROVIDER SHALL NOT DELAY OR CONDITION
THE PROVISION OF ANY SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION
BY INVITING OR REQUIRING AN INDIVIDUAL SEEKING VACCINATION TO COMPLETE
AN APPLICATION FOR A CUSTOMER DISCOUNT CARD OR ACCOUNT OR SHARE PERSONAL
INFORMATION THAT WILL BE STORED OUTSIDE OF A MEDICAL RECORD PROTECTED
UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF
1996, ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN OF THIS CHAPTER
FOR PURPOSES OTHER THAN SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZA-
TION, OR BY ENGAGING IN ANY OTHER ACTIVITY UNRELATED TO THE PROVISION OF
SUCH A SERVICE THAT THE COMMISSIONER DESIGNATES BY REGULATION.
§ 7. Section 2180 of the public health law is amended by adding nine
new subdivisions 12, 13, 14, 15, 16, 17, 18, 19 and 20 to read as
follows:
12. "COVERED ENTITY" MEANS A GOVERNMENTAL ENTITY OR A PLACE OF PUBLIC
ACCOMMODATION, RESORT OR AMUSEMENT, AS DEFINED IN SECTION TWO HUNDRED
NINETY-TWO OF THE EXECUTIVE LAW.
13. "DERIVED FROM AN IMMUNITY PASSPORT" MEANS ANY INFORMATION
CONTAINED IN OR RETRIEVED FROM AN IMMUNITY PASSPORT, AS WELL AS ANY
METADATA ASSOCIATED WITH THE USE OF THE IMMUNITY PASSPORT, INCLUDING THE
TIME AND LOCATION THE IMMUNITY PASSPORT WAS USED, AS WELL AS ANY INFER-
ENCES MADE BASED ON THE INFORMATION CONTAINED IN AN IMMUNITY PASSPORT OR
AN IMMUNITY PASSPORT'S USAGE.
14. "DISCLOSE" MEANS THE RELEASE, TRANSFER, PROVISION OF, ACCESS TO,
OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE ENTITY HOLD-
ING THE INFORMATION.
15. "GOVERNMENTAL ENTITY" MEANS A DEPARTMENT OR AGENCY OF THE STATE OR
A POLITICAL SUBDIVISION THEREOF, AN INDIVIDUAL ACTING FOR OR ON BEHALF
OF THE STATE OR A POLITICAL SUBDIVISION THEREOF, OR ANY ENTITY REGULATED
UNDER THE SOCIAL SERVICES LAW.
16. "IMMUNITY PASSPORT" MEANS A CREDENTIAL, WHETHER DIGITAL, ELECTRON-
IC, OR PHYSICAL, THAT IDENTIFIES AN INDIVIDUAL AS HAVING RECEIVED A
COVID-19 VACCINE OR A COVID-19 TEST RESULT.
17. "IMMUNITY PASSPORT PROVIDER" MEANS A LEGAL ENTITY THAT DEVELOPS,
MAINTAINS, DISTRIBUTES, OR MARKETS IMMUNITY PASSPORTS IN NEW YORK STATE.
18. "PERSONAL INFORMATION" MEANS INFORMATION THAT DIRECTLY OR INDI-
RECTLY IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED
S. 6541--A 7
WITH, OR COULD REASONABLY BE LINKED TO A PARTICULAR INDIVIDUAL OR
PERSONAL DEVICE. INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL OR
PERSONAL DEVICE IF IT CAN BE USED ON ITS OWN OR IN COMBINATION WITH
OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER
INFORMATION IS HELD BY THE COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER,
TO IDENTIFY AN INDIVIDUAL OR A PERSONAL DEVICE.
19. "PHYSICAL IMMUNITY PASSPORT" MEANS A CREDENTIAL THAT IDENTIFIES AN
INDIVIDUAL AS HAVING RECEIVED A COVID-19 VACCINE OR A COVID-19 TEST
RESULT THAT DOES NOT RELY ON A DIGITAL OR ELECTRONIC DEVICE. PHYSICAL
IMMUNITY PASSPORTS INCLUDE, BUT ARE NOT LIMITED TO, PIECES OF PAPER
DENOTING IMMUNITY STATUS.
20. "USE" MEANS, WITH RESPECT TO PERSONAL INFORMATION, THE SHARING,
EMPLOYMENT, APPLICATION, UTILIZATION, EXAMINATION, OR ANALYSIS OF SUCH
INFORMATION WITHIN AN ENTITY THAT MAINTAINS SUCH INFORMATION.
§ 8. The public health law is amended by adding a new section 2183 to
read as follows:
§ 2183. IMMUNITY PASSPORTS. 1. ANY COVERED ENTITY THAT REQUIRES PROOF
OF COVID-19 IMMUNIZATION SHALL PERMIT THE USE OF PHYSICAL IMMUNITY PASS-
PORTS. NO COVERED ENTITY MAY REQUIRE DIGITAL, ELECTRONIC, OR SMART-
PHONE-BASED PROOF OF IMMUNITY.
2. ANY COVERED ENTITY THAT REQUIRES THE USE OF AN IMMUNITY PASSPORT
SHALL DELETE ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT
ABOUT THE INDIVIDUAL TO WHOM THE IMMUNITY PASSPORT PERTAINS WITHIN TWEN-
TY-FOUR HOURS OF RECEIVING IT, EXCEPT THAT WHERE A COVERED ENTITY HAS AN
ONGOING RELATIONSHIP WITH AN INDIVIDUAL, THE COVERED ENTITY MAY STORE
THE FACT THAT THE INDIVIDUAL HAS RECEIVED A COVID-19 VACCINE, AS WELL AS
A COPY OF THE INDIVIDUAL'S IMMUNITY PASSPORT, PROVIDED THAT:
(A) THE COVERED ENTITY FIRST OBTAINS THE INDIVIDUAL'S INFORMED, AFFIR-
MATIVE, AND VOLUNTARY CONSENT TO STORE SUCH INFORMATION, AND
(B) THE COVERED ENTITY STORES ANY COPY OF AN INDIVIDUAL'S IMMUNITY
PASSPORT AND ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT
AS IF THEY WERE SUBJECT TO THE CONFIDENTIALITY REQUIREMENTS OF TITLE I
OF THE AMERICANS WITH DISABILITIES ACT 42 U.S.C. 12112(D) AND ITS IMPLE-
MENTING REGULATIONS, 29 CFR 1630.14.
3. AN IMMUNITY PASSPORT PROVIDER SHALL NOT USE OR DISCLOSE PERSONAL
INFORMATION DERIVED FROM AN IMMUNITY PASSPORT BEYOND WHAT IS ADEQUATE,
RELEVANT, AND NECESSARY TO IDENTIFY AN INDIVIDUAL AS HAVING RECEIVED A
COVID-19 VACCINE OR A COVID-19 TEST RESULT AND SHALL NOT COLLECT,
ACCESS, RECEIVE, CAPTURE, STORE, MAINTAIN, USE, OR DISCLOSE PERSONAL
INFORMATION PERTAINING TO WHERE OR WHEN AN INDIVIDUAL USES AN IMMUNITY
PASSPORT.
4. (A) EXCEPT AS PROVIDED IN THIS SUBDIVISION, NO COVERED ENTITY OR
IMMUNITY PASSPORT PROVIDER MAY:
(I) PROVIDE PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT OR
OTHERWISE MAKE SUCH PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDI-
RECTLY, TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY;
(II) PROVIDE SUCH PERSONAL INFORMATION OR OTHERWISE MAKE SUCH PERSONAL
INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO ANY OTHER INDIVIDUAL
OR ENTITY EXCEPT AS EXPLICITLY AUTHORIZED BY THIS SECTION.
(B) EXCEPT AS PROVIDED IN THIS SUBDIVISION, PERSONAL INFORMATION
DERIVED FROM AN IMMUNITY PASSPORT, AND ANY EVIDENCE DERIVED THEREFROM,
SHALL NOT BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS OR
BE ADMISSIBLE FOR ANY PURPOSE IN ANY JUDICIAL OR ADMINISTRATIVE ACTION
OR PROCEEDING.
(C) PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT, AND ANY
EVIDENCE DERIVED THEREFROM, MAY BE DISCLOSED FOR THE PURPOSES OF INVES-
S. 6541--A 8
TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR FRAU-
DULENT STATEMENTS RELATED TO AN INDIVIDUAL'S VACCINATION STATUS.
DISCLOSURE FOR THESE PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND
APPROVAL BY THE COURT AND, IF THE USE IS INITIATED BY A PARTY OTHER THAN
THE INDIVIDUAL WHOSE PERSONAL INFORMATION IS SOUGHT, THE INFORMATION
MUST BE HIGHLY MATERIAL AND RELEVANT FOR THE PURPOSE.
5. THE COMMISSIONER SHALL MAKE REGULATIONS AS REASONABLY NECESSARY TO
ENSURE THAT INDIVIDUALS WHO ARE MEDICALLY CONTRAINDICATED FROM RECEIVING
THE COVID-19 VACCINE ARE NONETHELESS ABLE TO OBTAIN REASONABLE ACCOMMO-
DATIONS TO ENABLE THEM TO ACCESS THE SERVICES OF A COVERED ENTITY, IN A
MANNER THAT DOES NOT IMPOSE AN UNDUE HARDSHIP ON THE COVERED ENTITY OR
PRESENT A DIRECT THREAT THAT CANNOT BE ADDRESSED BY A REASONABLE ACCOM-
MODATION.
6. NOTHING IN THIS SECTION REQUIRES A COVERED ENTITY TO REQUIRE PROOF
OF COVID-19 IMMUNITY OR TO INDEPENDENTLY VERIFY THE INFORMATION
CONTAINED IN AN IMMUNITY PASSPORT.
7. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT A COVERED ENTI-
TY'S OBLIGATIONS UNDER THE AMERICANS WITH DISABILITIES ACT, ARTICLE
FIFTEEN OF THE EXECUTIVE LAW, THE CIVIL RIGHTS LAW, OR ANY OTHER FEDER-
AL, STATE, OR LOCAL ANTI-DISCRIMINATION LAW.
8. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO AFFECT THE PRACTICES
OF A HEALTH CARE PROVIDER, AS DEFINED IN SECTION EIGHTEEN OF THIS CHAP-
TER, A HOSPITAL OR NURSING HOME AS DEFINED IN ARTICLE TWENTY-EIGHT OF
THIS CHAPTER, A HEALTH PRACTITIONER AS DEFINED IN SECTION TWENTY-ONE
HUNDRED SIXTY-FOUR OF THIS CHAPTER, A FACILITY, AS DEFINED IN SECTION
33.13 OF THE MENTAL HYGIENE LAW, OR A CORRECTIONAL HEALTH SERVICE
GOVERNED BY THE DEPARTMENT OF CORRECTIONS AND COMMUNITY SUPERVISION, THE
RULES OF THE BOARD OF CORRECTION IN THE CITY OF NEW YORK, OR A COUNTY
BOARD OF CORRECTION, WITH RESPECT TO RECORDS CONCERNING THEIR PATIENTS'
VACCINATIONS.
§ 9. Severability. If any provision of this act, or any application of
any provision of this act, is held to be invalid, that shall not affect
the validity or effectiveness of any other provision of this act, or of
any other application of any provision of this act, which can be given
effect without that provision or application; and to that end, the
provisions and applications of this act are severable.
§ 10. This act shall take effect immediately.
