Confidentiality and Disclosure Requirements for Confidential HIV Information – N.Y. Pub. Health Law § 2782

Persons that validly obtain confidential HIV information about a “protected individual” may only disclose the information as follows: 

• To the protected individual or, if they lack capacity, their authorized representative. 
• To persons authorized by a confidentiality release.
• To employees or agents of health care facilities that are authorized to obtain HIV information, authorized to access medical records, and either provides health care to the protected individual or uses medical records for the purpose of billing and reimbursement.
• To health providers or facilities that need HIV information to provide proper treatment for the protected individual, their child, their sex partner, or a person whom they have shared needles with. 
• To health providers or facilities that need the information in relation to the distribution and use of human organs and tissues for research, education, therapy, or transplantation.
• To health facility committees, accreditation organizations, and review organizations that have authorization to access medical records. However, these committees and organizations may only disclose the HIV information they receive (1) to the health facility or provider that was the source of the information; (2) in order to monitor, evaluate, or review services; or (3) to a government entity in regards to the oversight of state or federal programs. 
• To health officers as required by state or federal law.
• To agencies that provide foster care or adoption services. 
• To entities that reimburse health care providers for services so long as providers obtain any necessary authorization.
• To insurance organizations so long as the organizations obtain a “dated and written authorization” signed by the protected individual, their authorized representative, or, if the protected individual is deceased, their beneficiary. 
• To persons named in a court order.
• To employees or agents of the department of corrections, office of probation and correctional alternatives, local probation department, commission of correction, and medical director of a local correctional facility that have authorization to access HIV information “in order to carry out [their] functions, powers and duties with respect to the protected individual…” 
• To an attorney representing a minor “pursuant to the social services law or family court act” that needs the information to properly represent the minor. The attorney may disclose such HIV information as necessary, but must obtain the minor’s consent if they have capacity to consent. 
• To an estate executor or administrator that needs the information to perform their duties.

State, county, and local health officers may disclose HIV information as follows:

• When authorized by state or federal law.
• When authorized by a confidentiality release.
• When a physician requests that they notify a contact. 
• When authorized by a court.

Physicians may disclose HIV information as follows:

• Physicians may disclose a protected individual’s HIV information to a sex partner or needle partner (“contact”) of the individual and to a health officer as required by § 2130. 
• If a “physician believes disclosure is medically appropriate and there is significant infection to the contact,” the physician must counsel the protected individual about the need to inform their contact, inform the individual of their obligation to report the HIV information to the local health officer, and give the protected individual the opportunity to state their preference of whether the physician or a local health officer ultimately notifies their contact. 
• Physicians that perform contact tracing must report to the municipal health commissioner the name of the protected individual, the names of their contacts, and the success of the contact tracing.  The commissioner must attempt to notify any contacts that physicians failed to notify. 
• Physicians and health officers must notify contacts in person, if possible, and refer the contact to HIV counseling. Physicians and health officers may not disclose the identity of the protected individual when notifying a contact.
• Physicians may disclose a child’s HIV information to a health officer that needs to information to determine the child’s fitness for school. The child’s parent or guardian must consent to such disclosure. 
• Physicians may disclose HIV information to a person authorized to consent to health care if disclosure is necessary to treat the protected individual and the protected individual refuses to consent to the disclosure. However, physicians may not make such disclosure if the protected individual has capacity to consent to treatment or disclosure is not in the protected individual’s best interests. A physician’s decision to disclose information under such circumstances must be documented in the protected individual’s medical record. 

Persons that permissibly disclose confidential HIV information must accompany the disclosure with a written notice regarding the confidential nature of the information, the prohibition on further disclosure, and the potential sanctions for violating the confidentiality. If disclosure occurred orally, the disclosing party must sent this notice within 10 days. 

Providers of health or social services funded by the federal or state government may disclose service beneficiaries’ confidential HIV information, as specified by regulation, to agents or employees of providers or government agencies for purposes relating to the  “supervision, monitoring, administration, or provision” of these services. 

Confidential HIV information must be placed in the medical records of protected individuals. However, protected individuals must consent to the inclusion of HIV information in their medical record if the information they were tested in regards to a sexual offense as provided in § 390.15 or § 347.1. 

New York does not prohibit listing HIV or AIDs on a death certificate or autopsy report. Persons cannot obtain confidential HIV information using the Freedom of Information Act. 

A health care worker HIV/HBV advisory panel may obtain confidential HIV information “when reasonably necessary for the evaluation of a worker that has voluntarily sough the panel’s review.