Confidentiality of records - 35 Pa. Stat. Ann. § 7607

No individual who obtains confidential HIV-related information in the course of providing any health or social service may disclose, or be compelled to disclose the information except to the following persons:

• The subject;
• The physician who ordered the test, or the physician's designee;
• Any person specifically designated in the subject’s written consent;
• An agent, employee or medical staff member of a health care provider, provided that the individual is involved in the medical care or treatment of the subject;
• A peer review organization or committee;
• Individual providers involved in the care of the subject with an HIV-related condition or a positive test, when knowledge of the condition is necessary to provide care or treatment, or providers consulted to determine diagnosis and treatment of the individual;
• An insurer, to the extent necessary to reimburse health care providers or to make any payment of a claim submitted pursuant to an insured's policy;
• The department and persons authorized to gather, transmit or receive vital statistics;
• The department and local boards and departments of health as authorized to prevent the spread of infectious diseases;
• A person allowed access to the information pursuant to a court order;
• A funeral director responsible for the acceptance and preparation of the deceased subject;
• Employees of county mental health/mental retardation agencies, county children and youth agencies, county juvenile probation departments, county or state facilities for delinquent youth, and contracted residential providers of the above-named entities receiving or contemplating residential placement of the subject, who are generally authorized to receive medical information, are responsible for ensuring that the subject receives appropriate health care, and have a need to know the HIV-related information in order to ensure such care is provided.

Each disclosure made with a subject’s written consent must be accompanied by the following written statement:  

• “This information has been disclosed to you from records protected by Pennsylvania law. Pennsylvania law prohibits you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or is authorized by the Confidentiality of HIV-Related Information Act. A general authorization for the release of medical or other information is not sufficient for this purpose.”

No person to whom confidential HIV-related information has been disclosed may further disclose that information to another person, except as authorized above.