N.Y. Comp. Codes R. & Regs. tit. 10 § 63.8 - Contact Notification Based on Reports of HIV and Related Diseases

This regulation states that when the contacts of those with HIV infection need to be notified according to the law, all information collected in the course of this notification is to be kept confidentially and is not to be disclosed except when a public health official deems it required for conducting epidemiological monitoring of the HIV/AIDS epidemic.  The regulation also allows disclosure to public health officials in other jurisdictions in the contact lives in a different jurisdiction that the protected individual.
 
The regulation requires that disclosures and notifications be made as follows:

• Physicians are required to indicate on the reporting form:
  • That they have conducted post-test counseling and an assessment of the risk from domestic violence
  • Whether they plan to notify contacts or have already notified them
    • If they choose to notify contacts, the results of the notification activities must be forwarded to the appropriate authorized public health official within 60 days of initial report
  • Whether they are making a referral for partner notification assistance to authorized public health officials
• The commissioner is required to forward these initial reports from physicians, including the names and addresses of the reported case and known contacts, and whether the provider has notified any of the contacts to the authorized public health official in the county where the contact resides
• Authorized public health officials who determine that they need to notify contacts must make a good faith effort to seek the cooperation of the protected individual to name the contacts s/he wish to have notified, to actually notify the known contacts, and to inform the public health official in the jurisdiction where additional contacts reside.  Authorized public health officials are not allowed to disclose information about the protected individual in this process.

 
The regulation requires that authorized public health officials monitor the safeness of notifying a contact when there is an indication of risk of domestic violence in order to ensure the security of the affected persons.  Authorized public health officials are further required to turn to guidelines devised by the commissioner of the department of health when conducting contact notification.  Authorized public health officials are required to respond to all requests by HIV-infected individuals and their health care providers for assistance with contact notification.  When authorized public health officials conduct contact notification, they are required to:

• Confirm that the protected person has received post-test counseling
• Keep all communication with protected person about contact notification confidential
• Consult with reporting physician and make a determination on whether to proceed with notifying known contacts if the protected individual cannot be contacted for post-test counseling or declines to be assessed for risk of domestic violence with respect to known contacts

 
The regulation requires that everyone who notifies contacts provide counseling or make referrals for counseling and testing.  The regulation also requires that all notifications be made in person, except when the circumstances reasonably prevent doing so.
 
If the protected person is deceased, if the physician knows of a known contact and the physician believes that s/he has not been notified, the physician is allowed to notify the contact or to request the authorized public health official to notify the contact without identifying the protected person.  The regulation states that a physician or authorized public health official will not be open to criminal sanction or civil liability for disclosure of HIV-related information to a contact or to a person consenting to health care for a contact lacking capacity to consent.  The regulation also states that the physicians and authorized public health officials will not be open to liability for failure to disclose such information to a contact as well.
 
The regulation further requires that municipal health commissioners provide HIV contact notification services, and that they forward summary data and all identifiable information related to the notification to the department of health after notification.  The regulation prohibits the maintenance of identifying information of contacts collected during notification process by authorized public health officials at the state and local level for more that three years after notification.
 
The regulation allows blood banks, organ procurement organizations and tissue banks to disclose HIV status of a donation to a donor’s provider for the purposes of notifying known contacts of a donor.  The regulation states that when a physician notifies contacts under the authority of N.Y. Pub. Health Law § 2782, the are required to follow the following rules:

• The physician may notify contacts or report to the authorized public health official for the purpose of notifying a contact without the protected person’s consent when:
  • The physician believes disclosure is medically appropriate and the contact faces a significant risk of infection, and
  • The protected person has been counseled to notify his/her contacts or the physician has made reasonable efforts to attempt to counsel the protected person, and
  • Domestic violence screening has been applied.
• The physician must inform the protected person of his/her intent to notify contacts and of his/her responsibility to report the case and contacts to the commissioner, and must further inform the protected person that s/he may convey a preference with respect to when contacts will be notifying by physician or authorized public health official, and that the protected person’s identity will remain confidential and will not be disclosed at the time of contact notification.
• If the protected person prefers that the authorized public health official handle the notification or if the protected person prefers that the physician handle the notifications but the physician chooses not to, the physician can inform the protected person of his/her decision to send the contact information to the authorized public health official in order to let them handle the notification.
• If the physician chooses to handle the notification, s/he is required to report the success/failure of his/her efforts to the authorized public health officials, and if the physician cannot confirm that notification has been completed, then the official has to make reasonable measures to inform the contact

 
The regulation allows physicians to disclose HIV-related information without a release to physicians of persons whom the protected person might have exposed to HIV under certain circumstances:

• When there is exposure to certain listed bodily fluids, and
• When the mentioned bodily fluids make contact with mucous membranes/non-intact skin/vascular system, and
• When exposure occurred to staff/employees/volunteers during performance of employment duties in
  • Medical/dental office, or
  • In a facility regulation by certain government agencies; or
  • Involved an emergency response employee, including firefighters, law enforcement officers and correctional officers
• When the incident report, if any, is on record with the supervisory staff, and
• When a request for HIV status is made to the provider of the source by the provider of the exposed person after the alleged exposure if a decision relating to post-exposure prophylactic treatment is being considered, and
• When the request is documented in the exposed person’s medical record, and
• When the source’s provider determines that a risk of transmission has occurred, the provider may release HIV status of the source.  The provider may consult with the municipal health commissioner or district health officer to determine whether a risk exists, and in that case, both the provider and local health officer must agree to disclose the HIV-related information, and when disclosing information to the exposed person, the source’s name must not be disclosed.

 
When an occupational exposure source patient is tested anonymously and is not deceased, comatose or otherwise unable to consent, the results of the anonymous test must be disclosed to the attending health care professional of the exposed person (without disclosing the identity of the source).  The disclosure is only allowed for the purpose of assisting the exposed person in deciding whether to obtain post-exposure medical treatment.  However, the regulation prohibits disclosure to the source person