N.Y. Comp. Codes R. & Regs. tit. 14 § 505.7 - Confidentiality and Disclosure of HIV-related Information at Facilities Operated by Office of Mental Health

This regulation governs the disclosure of HIV-related information at facilities operated by the Office of Mental Health.  The regulation limits access to an individual’s clinical record, including HIV-related information, to the staff responsible for treating the individual, and prohibits any sort of public display to identify individuals with HIV.  The regulation then states that no person who has access to this information may disclose or be compelled to disclose in the information and then sets forth 13 exceptions for this:

1. When the protected individual asks for information, or in the case of a protected individual without capacity to consent, when the person in charge of protected individual’s health care decisions asks for the information
2. When a person authorized through release of HIV-related information asks for it
3. When an agent/employee of a health facility or provider asks for it, as long as the agent/employee is authorized to access medical records, the facility or provider is authorized to obtain the information, and the agent/employee actually provides health care for the individual or maintains the medical records for billing/reimbursement purposes
4. When a health care provider needs the information to treat the protected individual
5. When a health care provider or facility needs the information in relation to procurement, process, and distributing of a human body or organs for medical education, research or transplantation
6. When a health facility staff committee, or an accreditation or oversight review organization needs to access records for audit and evaluation purposes, as long as these organizations only disclose the confidential HIV-related information back to the facility or to a governmental agency as required for supervision of services
7. When federal or state law mandates disclosure to a governmental health officer
8. When authorized agencies and organizations under department of social services require the information for purposes of receiving children into foster care or adoption (in this case, re-disclosure of the information is covered by Article 27-F of Public Health Law and § 373-A of Social Services Law
9. When third-party reimbursers need the information to reimburse health care providers and facilities provided that the provider obtains authorization for such disclosure
10. When an insurance institution needs the information for purposes other than the purpose listed in (9), and has a written authorization with the nature of information to be disclosed, the purpose of disclosure and signed by the protected individual (in the case of an incapacitated individual, person authorized by law to consent may sign, and in the case of a deceased individual, the claimant or insurance beneficiary may sign)
11. When a court orders disclosure pursuant to N.Y. Pub. Health Law § 2785
12. When relevant regulations require disclosure to employees of the Division of Parole, Division of Probation and Correctional Alternatives, or Commission of Correction
13. When the relevant regulations require disclosure to the medical director of a local correctional facility

 
The regulation prohibits disclosure of confidential HIV-related information pursuant to a general release, and allows disclosures only when the protected individual signs a specific release form developed/approved by the Department of Health.  The regulation specifies that all written disclosure of this HIV-related information be accompanied with a statement prohibiting re-disclosure, and includes a model statement that can be used.  With respect to oral disclosures, the regulation requires that the facility send a written statement prohibiting re-disclosure within 10 days of oral disclosure.  The regulation states that the following disclosures don’t need to include a statement prohibiting re-disclosure:  disclosure by physician or public health officer to legal representative of protected individual, disclosure by a physician or public health officer to a “contact” of the individual, and disclosure by a physician to a person authorized to make health care decisions on behalf of the protected individual.
 
When a protected individual is being discharged from a program operated by the Office of Mental Health, the regulation allows a physician to disclose the individual’s HIV status to an appropriate person at the Office of Mental Health’s program that is assuming responsibility for the individual after conducting a specific evaluation of the individual.  The regulation states that this evaluation should include information about the individual’s condition, risk of HIV transmission, individual’s wishes with respect to disclosure, and the risks of discrimination against the individual.  The regulation requires that the physician discuss this evaluation with the individual, and then document this evaluation and discussion.  The regulation prohibits disclosure of the information in the evaluation and the fact that an evaluation was made if a decision is made not to disclose the individual’s HIV status.