N.Y. Comp. Codes R. & Regs. tit. 14 § 309.10 - Intra-Division Confidentiality in Division for Alcoholism and Alcohol Abuse

This regulation strictly limits access to information relating to identified person receiving services, particularly HIV-related information, and allows access only in connection to six activities: investigation of alleged violation of patient’s rights, review of quality of care rendered, when necessary to determine eligibility of services, for approved scientific or epidemiologic studies and research which will not maintain/disclose identifying information, when necessary to fulfill explicit requirements set forth by the law, when necessary to deliver services to the protected individuals.
 
When an employee or agent of the division gains access for one of the allowed purposes, s/he is prohibited form disclosing such information to another employee unless they are independently allowed access as well.  The regulation requires that supervisors of organizational units with personnel who can access personal information prepare and submit a description of the unit’s protocol for maintaining confidentiality of such information to the records access office.  The regulation sets forth some minimum requirements for the protocol: procedures to ensure that letters and documents are only accessible to authorized personnel and inaccessible to everyone else, training program for all employees authorized to access information teaching them how to protect information, and measures to protect the confidentiality of information that is transferred to authorized personnel in other divisions or state agencies.
 
The regulation requires that supervisees advise all employees with access to personal information in writing that they are not allowed to examine documents containing such information unless required to perform his/her duties, that they may not remove or copy any such documents unless within scope of duties, and that they are not allowed to discuss the content of such documents with any person unless that person has access to the information as well.  The employees, in return, are required to sign a statement attesting that they understand the restrictions and that any violation may lead to disciplinary action, or even arrest and criminal prosecution under New York State law.