§ 2782. Confidentiality and disclosure. 1. No person who obtains
confidential HIV related information in the course of providing any
health or social service or pursuant to a release of confidential HIV
related information may disclose or be compelled to disclose such
information, except to the following:

(a) the protected individual or, when the protected individual lacks
capacity to consent, a person authorized pursuant to law to consent to
health care for the individual;

(b) any person to whom disclosure is authorized pursuant to a release
of confidential HIV related information;

(c) an agent or employee of a health facility or health care provider
if (1) the agent or employee is permitted to access medical records, (2)
the health facility or health care provider itself is authorized to
obtain the HIV related information, and (3) the agent or employee
provides health care to the protected individual, or maintains or
processes medical records for billing or reimbursement;

(d) a health care provider or health facility when knowledge of the
HIV related information is necessary to provide appropriate care or
treatment to the protected individual, a child of the individual, a
contact of the protected individual or a person authorized to consent to
health care for such a contact;

(e) a health facility or health care provider, in relation to the
procurement, processing, distributing or use of a human body or a human
body part, including organs, tissues, eyes, bones, arteries, blood,
semen, or other body fluids, for use in medical education, research,
therapy, or for transplantation to individuals;

(f) health facility staff committees or accreditation or oversight
review organizations authorized to access medical records; provided that
such committees or organizations may only disclose confidential HIV
related information: (1) back to the facility or provider of a health or
social service; (2) to carry out the monitoring, evaluation, or service
review for which it was obtained; or (3) to a federal, state or local
government agency for the purposes of and subject to the conditions
provided in subdivision six of this section;

(g) a federal, state, county or local health officer when such
disclosure is mandated by federal or state law;

(h) an authorized agency in connection with foster care or adoption of
a child. Such agency shall be authorized to redisclose such information
only pursuant to this article or in accordance with the provisions of
subdivision eight of section three hundred seventy-two and section three
hundred seventy-three-a of the social services law;

(i) third party reimbursers or their agents to the extent necessary to
reimburse health care providers for health services; provided that,
where necessary, an otherwise appropriate authorization for such
disclosure has been secured by the provider;

(j) an insurance institution, for other than the purpose set forth in
paragraph (i) of this subdivision, provided the insurance institution
secures a dated and written authorization that indicates that health
care providers, health facilities, insurance institutions, and other
persons are authorized to disclose information about the protected
individual, the nature of the information to be disclosed, the purposes
for which the information is to be disclosed and which is signed by: (1)
the protected individual; (2) if the protected individual lacks the
capacity to consent, such other person authorized pursuant to law to
consent for such individual; or (3) if the protected individual is
deceased, the beneficiary or claimant for benefits under an insurance
policy, a health services plan, or an employee welfare benefit plan as
defined in 29 U.S.C. 1002(1), covering such protected individual;

(k) any person to whom disclosure is ordered by a court of competent
jurisdiction pursuant to section twenty-seven hundred eighty-five of
this article;

(l) an employee or agent of the department of corrections and
community supervision, in accordance with paragraph (a) of subdivision
two of section twenty-seven hundred eighty-six of this article, to the
extent the employee or agent is authorized to access records containing
such information in order to carry out the department's functions,
powers and duties with respect to the protected individual, pursuant to
section two hundred fifty-nine-a of the executive law;

(m) an employee or agent of the office of probation and correctional
alternatives or any local probation department, in accordance with
paragraph (a) of subdivision two of section twenty-seven hundred
eighty-six of this article, to the extent the employee or agent is
authorized to access records containing such information in order to
carry out the office's or department's functions, powers and duties with
respect to the protected individual, pursuant to articles twelve and
twelve-A of the executive law;

(n) a medical director of a local correctional facility as defined in
section forty of the correction law, in accordance with paragraph (a) of
subdivision two of section twenty-seven hundred eighty-six of this
article, to the extent the medical director is authorized to access
records containing such information in order to carry out his or her
functions, powers and duties with respect to the protected individual;

(o) an employee or agent of the commission of correction, in
accordance with paragraph (a) of subdivision two of section twenty-seven
hundred eighty-six of this article, to the extent the employee or agent
is authorized to access records containing such information in order to
carry out the commission's functions, powers and duties with respect to
the protected individual, pursuant to article three of the correction
law;

(p) an attorney appointed to represent a minor pursuant to the social
services law or the family court act, with respect to confidential HIV
related information relating to the minor and for the purpose of
representing the minor. If the minor has the capacity to consent, the
minor's attorney may not redisclose confidential HIV related information
without the minor's permission. If the minor lacks capacity to consent,
the minor's attorney may redisclose confidential HIV related information
for the sole purpose of representing the minor. This paragraph shall not
limit the ability of the minor's attorney to seek relief under section
twenty-seven hundred eighty-five of this chapter.

(q) an executor or an administrator of an estate shall have access to
the confidential HIV information of a deceased person as needed to
fulfill his or her responsibilities/duties as an executor or
administrator.

(r) qualified researchers for medical research purposes upon the
approval of a research protocol by a human research review committee
established and approved under the provisions of article twenty-four-A
of this chapter or by an institutional review board established and
approved under the provisions of 45 CFR part 46 or 42 USC 300 V-1, for
the purpose of reviewing and monitoring research involving human
subjects, provided that in no event shall any qualified researcher
disclose information tending to identify the subjects of the research.

(s) an employee or agent of the board of correction of the city of New
York, in accordance with paragraph (a) of subdivision two of section
twenty-seven hundred eighty-six of this article, to the extent the
employee or agent is authorized to access records containing such
information in order to carry out the board's functions, powers and
duties with respect to the protected individual, pursuant to the charter
of the city of New York.

2. A state, county or local health officer may disclose confidential
HIV related information when:

(a) disclosure is specifically authorized or required by federal or
state law; or

(b) disclosure is made pursuant to a release of confidential HIV
related information; or

(c) disclosure is requested by a physician pursuant to subdivision
four of this section; or

(d) disclosure is authorized by court order pursuant to the provisions
of section twenty-seven hundred eighty-five of this article.

3. No person to whom confidential HIV related information has been
disclosed pursuant to this article shall disclose the information to
another person except as authorized by this article, provided, however,
that the provisions of this subdivision shall not apply:

(a) to the protected individual; or

(b) to a natural person who is authorized pursuant to law to consent
to health care for the protected individual; or

(c) to a protected individual's foster parent as defined in section
three hundred seventy-one of the social services law and subject to
regulations promulgated pursuant to paragraph (a) of subdivision two of
section twenty-seven hundred eighty-six of this article, for the purpose
of providing care, treatment or supervision of the protected individual;
or

(d) a prospective adoptive parent as specified in section three
hundred seventy-three-a of the social services law and subject to
regulations promulgated pursuant to paragraph (a) of subdivision two of
section twenty-seven hundred eighty-six of this article with whom a
child who is the protected individual has been placed for adoption; or

(e) to a relative or other person legally responsible to whom a child
who is the protected individual is to be placed or discharged pursuant
to section ten hundred seventeen or ten hundred fifty-five of the family
court act and subject to regulations promulgated pursuant to paragraph
(a) of subdivision two of section twenty-seven hundred eighty-six of
this article, for the purpose of providing care, treatment or
supervision of the protected individual.

4. (a) A physician may disclose confidential HIV related information
under the following conditions:

(1) disclosure is made to a contact, to a public health officer for
the purpose of making the disclosure to said contact and pursuant to
section twenty-one hundred thirty of this chapter; or

(2) the physician believes disclosure is medically appropriate and
there is a significant risk of infection to the contact; and

(3) the physician has counseled the protected individual regarding the
need to notify the contact; and

(4) the physician has informed the protected individual of his or her
intent to make such disclosure to a contact, the physician's
responsibility to report the infected individual's case pursuant to
section twenty-one hundred thirty of this chapter and has given the
protected individual the opportunity to express a preference as to
whether disclosure should be made by the physician directly or to a
public health officer for the purpose of said disclosure. If the
protected individual expresses a preference for disclosure by a public
health officer, the physician shall honor such preference.

(5) If a physician chooses to make a notification pursuant to this
section, he or she shall report to the municipal health commissioner of
district health officer on his or her efforts to notify the contacts of
the protected individual. Such report shall be in a manner and on forms
prescribed by the commissioner and shall include the identity of the
protected individual and any contacts as well as information as to
whether the contacts were successfully notified.

(6) Within a reasonable time of receiving a report that a physician or
his or her designated agent did not notify or verify notification of
contacts provided by the protected individual, the health commissioner
or district health officer of the municipality from which the report
originates shall take reasonable measures to notify such contacts and
otherwise comply with the provisions of this chapter.

(b) When making such disclosures to the contact, the physician or
public health officer shall provide or make referrals for the provision
of the appropriate medical advice and counseling for coping with the
emotional consequences of learning the information and for changing
behavior to prevent transmission or contraction of HIV infection. The
physician or public health officer shall not disclose the identity of
the protected individual or the identity of any other contact. A
physician or public health officer making a notification pursuant to
this subdivision shall make such disclosure in person, except where
circumstances reasonably prevent doing so.

(c) A physician or public health officer shall have no obligation to
identify or locate any contact except as provided pursuant to title
three of article twenty-one of this chapter.

(d) A physician may, upon the consent of a parent or guardian,
disclose confidential HIV related information to a state, county, or
local health officer for the purpose of reviewing the medical history of
a child to determine the fitness of the child to attend school.

(e) A physician may disclose confidential HIV related information
pertaining to a protected individual to a person (known to the
physician) authorized pursuant to law to consent to health care for a
protected individual when the physician reasonably believes that: (1)
disclosure is medically necessary in order to provide timely care and
treatment for the protected individual; and (2) after appropriate
counseling as to the need for such disclosure, the protected individual
will not inform a person authorized by law to consent to health care;
provided, however, that the physician shall not make such disclosure if,
in the judgment of the physician: (A) the disclosure would not be in the
best interest of the protected individual; or (B) the protected
individual is authorized pursuant to law to consent to such care and
treatment. Any decision or action by a physician under this paragraph,
and the basis therefor, shall be recorded in the protected individual's
medical record.

5. (a) Whenever disclosure of confidential HIV related information is
made pursuant to this article, except for disclosures made pursuant to
paragraphs (a), (d) and (i) of subdivision one of this section or
paragraph (a) or (e) of subdivision four of this section, such
disclosure shall be accompanied or followed by a statement in writing
which includes the following or substantially similar language: "This
information has been disclosed to you from confidential records which
are protected by state law. State law prohibits you from making any
further disclosure of this information without the specific written
consent of the person to whom it pertains, or as otherwise permitted by
law. Any unauthorized further disclosure in violation of state law may
result in a fine or jail sentence or both. A general authorization for
the release of medical or other information is NOT sufficient
authorization for further disclosure." An oral disclosure shall be
accompanied or followed by such a notice within ten days.

(b) Except for disclosures made pursuant to paragraph (c) of
subdivision one of this section, or to persons reviewing information or
records in the ordinary course of ensuring that a health facility is in
compliance with applicable quality of care standards or any other
authorized program evaluation, program monitoring or service review, or
to governmental agents requiring information necessary for payments to
be made on behalf of patients or clients pursuant to contract or in
accordance to law, a notation of all such disclosures shall be placed in
the medical record of a protected individual, who shall be informed of
such disclosures upon request; provided, however, that for disclosures
made to insurance institutions such a notation need only be entered at
the time the disclosure is first made.

6. (a) The provisions of this subdivision shall apply where a provider
of a health or social service possesses confidential HIV related
information relating to individuals who are recipients of the service,
and a federal, state or local government agency supervises or monitors
the provider or administers the program under which the service is
provided.

(b) Confidential HIV related information relating to a recipient of
such service may be disclosed in accordance with regulations promulgated
pursuant to paragraph (a) of subdivision two of section twenty-seven
hundred eighty-six of this article to an authorized employee or agent of
such provider or government agency, when reasonably necessary for such
supervision, monitoring, administration, or provision of such service.
The term "authorized employee or agent", as used in this subdivision
shall only include any employee or agent who would, in the ordinary
course of business of the provider or government agency, have access to
records relating to the care of, treatment of, or provision of a health
or social service to the protected individual.

7. Nothing in this section shall limit a person's or agency's
responsibility or authority to report, investigate, or redisclose, child
protective and adult protective services information in accordance with
title six of article six and titles one and two of article nine-B of the
social services law, or to provide or monitor the provision of child and
adult protective or preventive services.

8. Confidential HIV related information shall be recorded in the
medical record of the protected individual. The provisions of this
section shall not prohibit the listing of acquired immune deficiency
syndrome, HIV related illness or HIV infection in a certificate of
death, autopsy report or related documents prepared pursuant to article
forty-one of this chapter or other applicable laws, ordinances, rules or
regulations relating to the documentation of cause of death, nor shall
this section be construed to modify any laws, ordinances, rules or
regulations relative to access to death certificates, autopsy reports or
such other related documents. Under no circumstances shall confidential
HIV related information be disclosable pursuant to article six of the
public officers law. Notwithstanding the foregoing, confidential HIV
information obtained pursuant to section 390.15 of the criminal
procedure law or section 347.1 of the family court act by either court
order or consent of the protected individual shall not be recorded in
the medical record of the protected individual unless he or she consents
to the recording of such information in a written statement containing
the relevant information specified in subdivision two of section two
thousand seven hundred eighty-one of this article.

9. Confidential HIV related information shall be disclosed upon the
request of the health care worker HIV/HBV advisory panel, established
pursuant to article twenty-seven-DD of this chapter, to the panel or its
designee only when reasonably necessary for the evaluation of a worker
who has voluntarily sought the panel's review.