S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                    900
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                                (PREFILED)
 
                              January 6, 2021
                                ___________
 
 Introduced  by  Sen.  RIVERA -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the public health law, in relation to the confidentiali-
   ty of contact tracing information

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Sections 2180, 2181 and 2182 of the public health law, as
 added by a chapter of the laws of 2020, amending the public  health  law
 relating  to  the  confidentiality  of  contact  tracing information, as
 proposed in  legislative  bills  numbers  S.8450-C  and  A.10500-C,  are
 amended to read as follows:
   §  2180.  Definitions. As used in this title the following terms shall
 have the following meanings:
   1. "Contact tracing" means COVID-19 case investigation and identifica-
 tion of [principal] CASE individuals and contact individuals.
   2. (A) "Contact tracer" and "contact tracing entity" means an individ-
 ual or entity employed by or under contract  with  the  state,  a  local
 government,  a  state or local governmental entity, or an agent thereof,
 to conduct contact  tracing,  engage  in  contact  tracing,  or  receive
 contact tracing information.
   (B)  A  CONTACT  TRACER  OR CONTACT TRACING ENTITY SHALL NOT INCLUDE A
 SERVICE PROVIDER THAT IS A NON-GOVERNMENTAL ENTITY THAT IS  EMPLOYED  BY
 OR  UNDER  CONTRACT  WITH  A CONTACT TRACING ENTITY OR AN AGENT THEREOF,
 THAT RECEIVES, TRANSMITS, MAINTAINS, STORES, OR  HOSTS  CONTACT  TRACING
 INFORMATION  AT  THE  DIRECTION  OF  A CONTACT TRACER OR CONTACT TRACING
 ENTITY SO LONG AS SUCH SERVICE PROVIDER'S ACCESS TO THE  INFORMATION  IS
 EXCLUSIVELY  LIMITED  TO  THE  MAINTENANCE  OF  THE  INFORMATION AND THE
 CONTACT TRACER OR CONTACT TRACING ENTITY HAS THE ABILITY TO  DELETE  AND
 MANAGE  CONTACT  TRACING  INFORMATION  AS PROVIDED BY THIS CHAPTER, LAW,
 RULES OR REGULATIONS.  A SERVICE PROVIDER UNDER THIS PARAGRAPH SHALL  BE
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
              

                       [ ] is old law to be omitted.
                                                            LBD07194-01-1

 S. 900                              2
 
 REFERRED  TO IN THIS TITLE AS A "DESIGNATED NON-GOVERNMENTAL ENTITY."  A
 SERVICE PROVIDER THAT DOES NOT MEET THE REQUIREMENTS OF  THIS  PARAGRAPH
 AND  WOULD  OTHERWISE  BE  SUBJECT  TO PARAGRAPH (A) OF THIS SUBDIVISION
 SHALL BE A CONTACT TRACING ENTITY.
   3.  "Contact  tracing information" means any information that includes
 or can reveal the identity of any [principal] CASE individual or contact
 individual,  and  any  COVID-19-related  information  or  test  results,
 received  or collected for the purpose or in the course of contact trac-
 ing.
   4. "Contact individual" means an individual who has or may  have  come
 in  contact  with  a  [principal] CASE individual or who has or may have
 been exposed to and possibly infected with COVID-19.
   5. "[Principal] CASE individual" means an individual with a  confirmed
 or probable diagnosis of COVID-19.
   6. "COVID-19" means infection with or the disease caused by the severe
 acute respiratory syndrome coronavirus 2 (SARS-CoV-2).
   7.  "Immigration  authority"  means  any entity, officer, employee, or
 government employee or agent thereof charged with or engaged in enforce-
 ment of the federal  Immigration  and  Nationality  Act,  including  the
 United States Immigration and Customs Enforcement, UNITED STATES DEPART-
 MENT   OF  HOMELAND  SECURITY,  or  United  States  Customs  and  Border
 Protection, OR AGENT, CONTRACTOR OR EMPLOYEE THEREOF, or  any  successor
 legislation or entity.
   8.  "De-identified" means, in relation to contact tracing information,
 that the information cannot identify or be made to identify or be  asso-
 ciated  with  a  particular  individual,  directly  or indirectly and is
 subject to technical safeguards and policies and procedures that prevent
 re-identification, whether  intentionally  or  unintentionally,  of  any
 individual.
   9.  "Law enforcement agent or entity" means any governmental entity or
 public servant, or agent, contractor or employee thereof, authorized  to
 investigate,  prosecute,  or  make  an  arrest  for  a criminal or civil
 offense (EXCEPT A DESIGNATED CIVIL OFFENSE),  or  engaged  in  any  such
 activity,  but shall not mean the department, the commissioner, a health
 district, a county department of health, a county health commissioner, a
 local board of health, a local health officer, the department of  health
 and  mental  hygiene of the city of New York, or the commissioner of the
 department of health and mental hygiene of the city of  New  York.    AS
 USED  IN  THIS  SUBDIVISION,  "DESIGNATED  CIVIL  OFFENSE" MEANS A CIVIL
 OFFENSE OR OFFENSES DESIGNATED BY THE COMMISSIONER (OR THE  COMMISSIONER
 OF THE NEW YORK CITY DEPARTMENT OF HEALTH AND MENTAL HYGIENE IN THE CASE
 OF  CONTACT  TRACING  INFORMATION COLLECTED BY OR UNDER AUTHORITY OF THE
 NEW YORK CITY DEPARTMENT OF HEALTH AND MENTAL HYGIENE OR  THE  NEW  YORK
 CITY HEALTH AND HOSPITALS CORPORATION).
   10. "Support" means resources or services provided to an individual to
 enable  such  individual  to  safely  quarantine  or  isolate, including
 grocery, meal or pharmacy delivery, laundry  services,  child  or  elder
 care,  pet walking, assistance with telephone, internet, or other commu-
 nication services or devices, health and mental health  services,  legal
 services,  provision  of  appropriate  living  space for individuals who
 cannot isolate or quarantine at home, and income replacement.  "Support"
 may  also  include  support  provided  to other individuals for whom the
 individual commonly provides those resources or services.
   11. "Permitted purpose" means:
   (a) disclosure to appropriate health care providers or their personnel
 for the purpose of the clinical diagnosis,  care  or  treatment  of  the

 S. 900                              3
 
 [principal]  CASE individual or contact individual who is the subject of
 the information, where an emergency exists  and  the  individual  is  in
 immediate  need  of  medical  attention and an attempt to secure consent
 would  result in delay of treatment which would increase the risk to the
 individual's life or health;
   (b) facilitating a legally-authorized  public  health-related  action,
 [in relation to a specified principal individual or contact individual,]
 where  and  only to the extent necessary to protect the public health IN
 RELATION TO COVID-19; or
   (c) [the investigation, prosecution or defense of  a  civil  or  legal
 action for] USE OR DISCLOSURE OF CONTACT TRACING INFORMATION TO PURSUE A
 LEGAL  ACTION  IN  RELATION  TO a violation of this title; provided that
 DISCLOSURE SHALL BE SUBJECT TO IN CAMERA  REVIEW  AND  APPROVAL  BY  THE
 COURT,  AND,  if the use is initiated by a party other than the [princi-
 pal] CASE individual or contact individual who is  the  subject  of  the
 contact tracing information, the information must be highly material and
 relevant for the purpose.
   § 2181. COVID-19 contact tracing; confidentiality. 1.  (a) All contact
 tracing  information  shall  be  kept confidential by any contact tracer
 [and], contact tracing entity, OR DESIGNATED NON-GOVERNMENTAL ENTITY and
 may not be disclosed except as necessary to carry out contact tracing or
 a permitted purpose. A DESIGNATED NON-GOVERNMENTAL ENTITY MAY  ONLY  ACT
 IN  RELATION  TO CONTACT TRACING INFORMATION AS EXPLICITLY AUTHORIZED BY
 THIS TITLE.
   (b) Where a contact tracer or contact tracing entity discloses contact
 tracing information for a  permitted  purpose,  the  contact  tracer  or
 contact  tracing entity shall make a record of the disclosure, including
 to whom it was made AND WHEN IT WAS MADE, which shall  be  part  of  the
 contact tracing information.
   (C)    NOTHING  IN  THIS  TITLE  PROHIBITS  OTHERWISE LAWFUL VOLUNTARY
 REPORTING, AT THE DISCRETION OF THE CONTACT TRACER,  REASONABLY  AND  IN
 GOOD  FAITH:    (I) TO THE STATEWIDE CENTRAL REGISTRY UNDER TITLE SIX OF
 ARTICLE SIX OF THE SOCIAL SERVICES LAW, ADULT PROTECTIVE SERVICES  UNDER
 TITLES  ONE AND TWO OF ARTICLE NINE-B OF THE SOCIAL SERVICES LAW, OR THE
 JUSTICE CENTER FOR THE PROTECTION OF PEOPLE  WITH  SPECIAL  NEEDS  UNDER
 ARTICLE  ELEVEN OF THE SOCIAL SERVICES LAW; OR (II) TO A GOVERNMENTAL OR
 NON-GOVERNMENTAL EMERGENCY REPORTING SYSTEM (SUCH AS A  "911,"  DOMESTIC
 VIOLENCE  OR  SUICIDE  PREVENTION    SYSTEM) TO PREVENT IMMINENT RISK OF
 INJURY TO ANY PERSON.
   (D) THIS TITLE DOES NOT LIMIT DISCLOSURE TO OR BY,  OR  POSSESSION  OR
 USE  BY, THE CASE INDIVIDUAL OR CONTACT INDIVIDUAL WHO IS THE SUBJECT OF
 THE INFORMATION.
   2. (a) An individual may waive the  confidentiality  provided  for  by
 this section, only by a written, informed and voluntary waiver, in plain
 language  and  in a language understandable to the individual making the
 waiver, and not part of any other document. The waiver shall  state  the
 scope and limit of the waiver.  NO CONTACT TRACER, CONTACT TRACING ENTI-
 TY  OR  GOVERNMENTAL OR NON-GOVERNMENTAL ENTITY MAY SEEK OR ACT IN RELI-
 ANCE ON A WAIVER TO DISTRIBUTE, SELL, OR OTHERWISE DISCLOSE IDENTIFIABLE
 OR DE-IDENTIFIED DATA TO ANY INDIVIDUAL OR ENTITY.    PROVIDED  HOWEVER,
 NOTHING  IN  THIS  SUBDIVISION SHALL PROHIBIT DISTRIBUTION OR DISCLOSURE
 THAT IS OTHERWISE EXPLICITLY AUTHORIZED BY THIS SECTION. If an  individ-
 ual  lacks  the  capacity  to make a waiver, an individual authorized to
 consent to health care for the individual,  or  the  individual's  legal
 representative, may make the waiver.  However, a waiver of confidential-
 ity  is  not  required  to be written if it is solely for the purpose of

 S. 900                              4
 
 arranging or providing support for the individual who is the subject  of
 the  contact  tracing  information, PROVIDED THE CONSENT IS INFORMED AND
 VOLUNTARY.
   (b)  A  waiver  of confidentiality under this section shall only apply
 for the purpose of arranging or providing support if the individual  who
 is the subject of the contact tracing information (OR, IF THE INDIVIDUAL
 LACKS THE CAPACITY TO PROVIDE INFORMED CONSENT, AN INDIVIDUAL AUTHORIZED
 TO  CONSENT TO HEALTH CARE FOR THE INDIVIDUAL, OR THE INDIVIDUAL'S LEGAL
 REPRESENTATIVE) provides voluntary informed consent to the arranging  or
 providing of the support.
   3.  A  disclosure of contact tracing information authorized under this
 section shall be limited in scope as to the identity of any  individual,
 the  information  to be disclosed, and the party to which disclosure may
 be made, and as necessary to achieve the purpose of the disclosure under
 this section, and shall not authorize re-disclosure except as explicitly
 authorized by the terms of the waiver under this section.  However, this
 section does not bar disclosure of contact tracing information  pertain-
 ing to and identifying a [principal] CASE individual or contact individ-
 ual by the individual who is identified.
   4.   (a)  This  section  does  not  bar  otherwise-lawful  disclosure,
 possession or use of DE-IDENTIFIED contact tracing information,  includ-
 ing  aggregate  contact  tracing  information[,  that is de-identified].
 Disclosure, possession or use under this subdivision shall only be for a
 public health or public health research OR EVALUATION purpose AS  DETER-
 MINED  BY  THE  COMMISSIONER  (OR  THE COMMISSIONER OF THE NEW YORK CITY
 DEPARTMENT OF HEALTH AND MENTAL HYGIENE IN THE CASE OF  CONTACT  TRACING
 INFORMATION COLLECTED BY OR UNDER AUTHORITY OF THE NEW YORK CITY DEPART-
 MENT OF HEALTH AND MENTAL HYGIENE OR THE NEW YORK CITY HEALTH AND HOSPI-
 TALS CORPORATION), AND SHALL NOT AUTHORIZE RE-DISCLOSURE OR OTHER USE.
   (b) A person or entity may only DISCLOSE, possess or use de-identified
 contact  tracing  information if the person or entity, AND THE PERSON OR
 ENTITY TO WHICH IT IS  DISCLOSED,  maintains  technical  safeguards  and
 policies  and  procedures that prevent re-identification, whether inten-
 tional or unintentional, of any individual, as may be  required  by  the
 commissioner  (or  the  New  York city commissioner of health and mental
 hygiene in the case of contact tracing information collected by or under
 authority of the New York city department of health and  mental  hygiene
 or the New York city health and hospitals corporation).  The commission-
 er  (or the New York city commissioner as the case may be) shall require
 safeguards, policies and procedures under this paragraph as the  commis-
 sioner deems practicable.
   (c)  Disclosure,  possession  and use of de-identified contact tracing
 information under this subdivision shall be only pursuant to approval by
 the commissioner (or the New York city commissioner of health and mental
 hygiene in the case of contact tracing information collected by or under
 authority of the New York city department of health and  mental  hygiene
 or  the  New  York city health and hospitals corporation) specifying the
 purpose, nature and scope of the  disclosure,  possession  and  use  and
 measures  to  ensure that it will comply with this section and the terms
 of the approval.
   5. No law enforcement agent or entity or immigration  authority  shall
 be a contact tracer or contact tracing entity or engage in contact trac-
 ing.  This subdivision does not bar an individual who is associated with
 a law enforcement entity or immigration authority from acting only as  a
 [principal]  CASE  individual  or contact individual.   THIS SUBDIVISION
 DOES NOT PREVENT A LAW ENFORCEMENT AGENT OR ENTITY FROM ASSISTING  IN  A

 S. 900                              5
 
 PERMITTED USE UNDER PARAGRAPH (B) OF SUBDIVISION ELEVEN OF SECTION TWEN-
 TY-ONE HUNDRED EIGHTY OF THIS TITLE.
   6.  No  contact tracer [or], contact tracing entity OR DESIGNATED NON-
 GOVERNMENTAL ENTITY may provide contact tracing  information  to  a  law
 enforcement agent [or], entity or immigration authority, OR ANY INDIVID-
 UAL  OR  ENTITY  OTHER  THAN  THE  CONTACT  TRACING ENTITY FROM WHICH IT
 RECEIVED THE INFORMATION, EXCEPT AS EXPLICITLY AUTHORIZED BY THIS TITLE.
 Without consent under subdivision two of this section,  contact  tracing
 information  and  any evidence derived therefrom shall not be subject to
 or provided in response to any legal process or be  admissible  for  any
 purpose in any judicial or administrative action or proceeding. However,
 this  subdivision does not restrict providing information, relating to a
 specified [principal] CASE individual or contact individual,  where  and
 only to the extent necessary for a permitted purpose.
   7.  (a)  CONTACT TRACING ENTITIES SHALL ESTABLISH APPROPRIATE ADMINIS-
 TRATIVE, TECHNICAL AND PHYSICAL SAFEGUARDS, POLICIES AND PROCEDURES THAT
 ENSURE THE SECURITY OF CONTACT TRACING INFORMATION  UNDER  THE  ENTITY'S
 JURISDICTION.    THE  SAFEGUARDS,  POLICIES  AND  PROCEDURES MUST ENSURE
 CONTACT TRACING INFORMATION IS ENCRYPTED AND PROTECTED AT LEAST AS  MUCH
 AS OR MORE THAN OTHER CONFIDENTIAL INFORMATION UNDER THE ENTITY'S JURIS-
 DICTION.    ALL  STORAGE  OF  CONTACT TRACING INFORMATION SHALL MEET THE
 REQUIREMENTS OF THIS TITLE. The  commissioner  (or  the  New  York  city
 commissioner of health and mental hygiene in the case of contact tracing
 information collected by or under authority of the New York city depart-
 ment of health and mental hygiene or the New York city health and hospi-
 tals  corporation)  shall  make  regulations  AS REASONABLY NECESSARY to
 require that contact tracing information possessed, used  or  under  the
 control  of  a contact tracer or contact tracing entity shall be subject
 to technical safeguards [and],  policies  and  procedures  for  storage,
 transmission,  use  and  protection of the information.  The regulations
 shall prevent possession, use  or  disclosure  of  the  contact  tracing
 information  not  permitted  by  this title, and shall be at least as or
 more protective than the safeguards, policies and procedures the commis-
 sioner (or the New York city commissioner as the case may  be)  provides
 for other confidential information.
   (b)  This  paragraph  applies  [where  contact  tracing information is
 possessed or controlled by a contact tracer or  contact  tracing  entity
 that  is  a  non-governmental  individual or entity employed by or under
 contract with a governmental entity, or an agent thereof] TO  A  CONTACT
 TRACER  OR  CONTACT TRACING ENTITY THAT IS A NON-GOVERNMENTAL INDIVIDUAL
 OR ENTITY EMPLOYED BY OR UNDER CONTRACT WITH A GOVERNMENTAL  ENTITY,  OR
 AN AGENT THEREOF.  Within [thirty] SIXTY days of collecting or receiving
 the  contact  tracing  information, the [non-governmental individual or]
 entity shall (i) remove information from its possession or  control  and
 deliver  it  to the appropriate governmental contact tracing entity OR A
 DESIGNATED NON-GOVERNMENTAL ENTITY SPECIFIED BY THE GOVERNMENTAL CONTACT
 TRACING ENTITY, retaining no copy of it; (ii)  expunge  the  information
 from  its  possession  or control; or (iii) de-identify the information.
 However, the expungement  or  de-identification  of  particular  contact
 tracing  information  may  be postponed for up to fifteen days AFTER THE
 INITIAL SIXTY DAY PERIOD while the contact  tracer  or  contact  tracing
 entity  is  actively  engaged in contact tracing using that information,
 provided that the [principal] CASE individual or contact  individual  to
 whom  it  pertains  gives  voluntary informed consent.   The disclosure,
 possession and use of  the  de-identified  contact  tracing  information
 shall be subject to subdivision four of this section.

 S. 900                              6
 
   §  2182.  Regulations. The commissioner shall make regulations [imple-
 menting] AS REASONABLY NECESSARY TO IMPLEMENT this title.
   §  2.   This act  shall  take  effect on the same date and in the same
 manner as a chapter of the laws of 2020, amending  the public health law
 relating to the confidentiality of  contact  tracing  information,    as
 proposed  in  legislative  bills  numbers  S.8450-C and A.10500-C, takes
 effect.