N.Y. Comp. Codes R. & Regs. tit. 10 § 63.6 - Confidentiality and Disclosure of Reports of HIV and Related Diseases

This regulation creates a number of exceptions for the general rule that no person who obtains confidential HIV-related information in the course of providing health or social service or because of a release may disclose or be compelled to disclose the information.  The exceptions are as follows:

• When you need to disclose to the protected person himself/herself, or when the protected individual lacks capacity to consent, a person authorized to make health care decisions on his or her behalf
• When disclosure is authorized by a specific release of confidential HIV-related information in accordance with law
• When disclosing to a an agent or employee of a health facility or health care provider, as long as:
  • agent of employee is authorized to access medical records,
  • the health facility or provider is authorized to obtain the HIV-related information, and
  • the agent/employee provides actual health care or maintains medical records for billing or reimbursement purposes.
• When disclosure is to a health care provider or facility
  • When knowledge is necessary to provider care to protected individual or child of the individual
  • When knowledge is necessary to provide appropriate treatment to a contact of the individual
  • When in relation to procurement, processing, distributing or use of a human body or body part for use in research, education, therapy or transplantation
• When disclosure is to a contact or person authorized to make health care decisions of a contact, as long as the disclosure is necessary for consent to health care
• When disclosure is to a health facility staff committee or accreditation or oversight review organization authorized to access medical records, as long as they only disclose confidential information back to facility or provider, to carry out monitoring and review, and to federal or state government agency for the following purposes:
  • H
• When disclosure is to a federal, state, county or local health officer and such disclosure is required by federal or state law, including for purposes of notifying the contacts of the protected individual
• When disclosure is to authorized agencies and corporations organized to receive children for adoption or foster care in connection with foster care or adoption of a child
• When third-party reimbursers need the information to reimburse health care providers and facilities provided that the provider obtains authorization for such disclosure
• When an insurance institution needs the information for purposes other than the purpose listed above and has a written authorization with the nature of information to be disclosed, the purpose of disclosure and signed by the protected individual (in the case of an incapacitated individual, person authorized by law to consent may sign, and in the case of a deceased individual, the claimant or insurance beneficiary may sign)
• When disclosure is to a funeral director taking charge of the remains of a deceased person, and the funeral director has access to HIV-related information on death certificate of the deceased individual in the ordinary course of business
• When disclosure is ordered by a court of competent jurisdiction in accordance with the law
• When relevant regulations require disclosure to employees of the Division of Parole, Division of Probation and Correctional Alternatives, or Commission of Correction
• When the relevant regulations require disclosure to the medical director of a local correctional facility
• When disclosure is to an employee/agent of the New York City Board of Corrections to ensure that the board can access records of inmates who die while in custody of the New York City Department of Corrections
• When disclosure is to a law guardian, legally appointed to represent a minor for the purpose of representing the minor
• When disclosure is to an executor or administrator of an estate of a deceased person in order to help him/her fulfill responsibilities and duties
• When disclosure is to authorized employees/agents, including authorized attorneys, of a provider of health or social services, as long as
  • the provider is supervised/regulated/administered by a government agency
  • the employees/agents have access to records in the ordinary course of business
  • the access is reasonably necessary for regulation/supervision/administration of services

 
The regulation further allows disclosure of HIV-related information by sate, county or local health officers in specific instances:

• When disclosure is specifically authorized or required by federal or state laws or regulations
• When disclosure is made in accordance with a release of confidential HIV-related information
• When a physician request's information about a contact of if disclosure is to a public health official in a contact's jurisdiction when the contact resides in another jurisdiction
• When disclosure is authorized by a court order according to N.Y. Pub. Health Law § 2785

 
The regulation allows a physician or his/her agent to disclose this confidential HIV-related information in a few instances:

• When disclosure is to a contact or to a public health officer for purpose of disclosing to a contact
• When disclosure is to a state/county/local health officer for purpose of reviewing the medical history of a child to determine fitness of the child to attend school, as long as the physician obtains consent from a parent or guardian to disclose
• When disclosure is to a person legally authorized to consent to the health care for a protected individual, as long as the physician reasonably believes that
  • Disclosure is medically necessary to provide care for the protected individual,
  • The protected information will not inform the person himself or herself, even after appropriate counseling, and
  • Disclosure is in the best interest of the protected individual or the protected individual is not legally authorized to consent to care and treatment

 
The regulation further restricts redisclosure of information by those to whom the confidential information has been disclosed pursuant to this regulation.  The regulation makes some exceptions to this rule as well:

• When redisclosure is to the protected individual himself/herself
• When redisclosure is to a person legally authorized to consent to health care of protected individual
• When redisclosure is to a protected individual's foster parent for purpose of providing care or treatment to protected individual
• When redisclosure is to a prospective adoptive parent with whom the child has been placed for adoption

 
The regulation clarifies that these rules are not to come in the way of a person or agency reporting or investigating with the purpose of providing child or adult protective services.  The regulation further prohibits disclosure of HIV-related information to a health care provider or facility for the sole purpose of implementing infection control precautions, because all regulated providers and facilities are required to implement such precautions with all individuals any way.  The regulation also prohibits disclosure of this information pursuant to a subpoena, and requires a court order under N.Y. Pub. Health Law § 2785 in order to compel disclosure.  The regulation carves out yet another exception, and allows disclosure upon request of the Health Care Worker HIV/HBV Advisory Panel, to the Panel or its designees when the Panel considers the information reasonably necessary for evaluation of a worker voluntarily seeking the Panel's review.