N.Y. Comp. Codes R. & Regs. tit. 14 § 1072.4 - Disclosure of HIV-Related Information by Providers of Substance Abuse Services

The regulation states that the identity and records of clients in substance abuse programs are confidential pursuant to applicable federal and state law and regulations, including 42 C.F.R. Part 2 ("Part 2"). The regulation states that when a disclosure about a client is allowed by Part 2, the disclosure must be in compliance with N.Y. Pub. Health Law § 2782, N.Y. Comp. Codes R. & Regs. tit. 10 § 63.5, and the following regulations:

• Confidential information must be entered into the protected individual's medical record
• Within a program, confidential information must not be disclosed to administrators or staff unless:
  • The person seeking disclosure has a written release from the protected individual specifically releasing confidential HIV-related information to the person
  • The disclosure is to an agent of employee of a health facility if the health facility is authorized to obtain the information (whenever the information is necessary to provide care/treatment to protected individual), the agent/employee is authorized to access medical records and the agent/employee provides health care to the protected individual or maintains medical records.
• A specific written release disclosing such information must be in a format approved by the division of substance abuse services and the department of health and which meets the requirements of Part 2.  The form must be signed by the individual or a person authorized to do so on his/her behalf.
• Each authorized disclosure must be noted in the record of the individual, and whenever the individual requested, s/he must be informed of the disclosures.
• All written disclosures must include a statement with language (specified in the regulation) prohibiting re-disclosure, and oral disclosures must be accompanied by the statement in writing within 10 days.
• All clients in these programs must receive a notice in writing explaining these confidentiality requirements.