N.Y. Comp. Codes R. & Regs. tit. 14 § 309.5 - Disclosure of HIV-related Information in Facilities for Alcoholism

This regulation prohibits the use of general release forms for consenting to disclosure of HIV-related information.  It requires that specific consent to disclosure be obtained from the protected individual and that each release of the HIV-related information include the specific consent form.  The regulation requires that the Department of Health establish/approve the specific consent form.  The regulation states that any disclosure permitted by New York law, but not permitted by federal regulations are prohibited unless the facility seeking disclosure receives a court order saying otherwise.  The regulation states that the signed consent forms themselves are confidential pursuant to federal regulations. 
 
The regulation demands that facilities minimize the number of staff members who have access to the HIV-related information to those required by § 309.8.  The regulation requires that only qualified professional staff handle all requests for disclosure of HIV-related information, and that requests for disclosure from people outside the facility be accompanied with both a consent for disclosure of alcoholism and drug treatment information and a consent for disclosure of HIV-related information.  
 
The regulation states that all written disclosures of confidential HIV-related information must be accompanied by a statement prohibiting re-disclosure of the information.  The regulation provides the language that this statement must be modeled upon. The regulation states that no person who obtains this confidential information will be compelled to disclose this information, except for 13 exceptions set out by federal regulations: 

1. When the protected individual asks for the information or if the protected individual lacks the capacity to consent, a person authorized to consent to health care for the individual asks for the information
2. When disclosure is otherwise allowed in this part of the regulation
3. When an agent or employee of the facility is authorized to receive this information
4. When a health care provider needs this HIV-related information to provide care and treatment for the protected individual or child of individual
5. When a health care provider or facility needs the information in relation to procurement, process, and distributing of a human body or organs for medical education, research or transplantation
6. When an accreditation or oversight review organization needs to access records for audit and evaluation purposes, as long as these organizations only disclose the confidential HIV-related information back to the facility or to a governmental agency as required for supervision of services
7. When disclosure to a federal, state county or local health official is mandated by federal or state law
8. When authorized agencies and organizations under department of social services require the information for purposes of receiving children into foster care or adoption (in this case, re-disclosure of the information is covered by Article 27-F of Public Health Law and § 373-A of Social Services Law)
9. When third-party reimbursers need the information to reimburse health care providers and facilities provided that the provider obtains authorization for such disclosure
10.  When an insurance institution needs the information for purposes other than the purpose listed in (9), and has a written authorization with the nature of information to be disclosed, the purpose of disclosure and signed by the protected individual (in the case of an incapacitated individual, person authorized by law to consent may sign, and in the case of a deceased individual, the claimant or insurance beneficiary may sign)
11. When a court orders disclosure pursuant to N.Y. Pub. Health Law § 2785
12. When relevant regulations require disclosure to employees of the Division of Parole, Division of Probation and Correctional Alternatives, or Commission of Correction
13. When the relevant regulations require disclosure to the medical director of a local correctional facility

The regulation allows a physician to disclose confidential HIV-related information during contact notification to address potential exposure.  Physicians of children may, with the consent of parent/guardian, disclosure confidential HIV-related information to a state, county or local health officer to determine the child’s fitness to attend school.
 
The regulation further allows disclosure amongst governmental agency employees authorized to view this information in the course of their duties when access is necessary for supervision and provision of services.  The regulation clearly states that none of these rules preclude a person or agency’s authority or responsibility to report child protective and adult protective services information.  The regulation specifically prohibits disclosure of confidential HIV-related information to a health care provider or facility for the purpose of infection control.  The regulation also prohibits disclosure of HIV-related information in response to a subpoena, and states that a court order is required for disclosure.