N.Y. Comp. Codes R. & Regs. tit. 18 § 360-8.1 - Confidentiality of HIV-Related Information in the Medical Assistance Program

This regulation applies to any person who obtains HIV-related information during the course of administering the Medical Assistance Program under the Department of Social Services.  The regulation generally requires that confidential HIV information only be used for the authorized purpose of administering the program, and refers to N.Y. Pub. Health Law § 2782 for guidance on whom such information can be disclosed to.  The regulation prohibits any adverse case actions against an applicant based on this HIV-related information, and makes all employees responsible for ensuring there is no discrimination against applicants based on this information.
 
The regulation limits access to only those employees who need to fulfill an official purpose, and further prohibits re-disclosure of such information obtained during the course of performing official duties.  The regulation allows for disclosure upon the service of a court order as described under N.Y. Pub. Health Law § 2785.  Further, the regulation allows disclosure when the protected individual has dated and signed a written release that specifically releases the confidential HIV-related information, names the person to whom the information is to be disclosed to and for what purpose, and specifies a time when the release expires.
 
The regulation provides a statement that needs to accompany every disclosure of such information, and states that every oral disclosure must be followed by a provision of a written version of the statement within 10 days.  The statement is not required when disclosure is made to the protected person himself/herself, or to the person legally authorized to consent to health care on the protected individual’s behalf, when the protected individual does not have the capacity to consent.
 
The regulation requires that the department of social services and the social services districts develop and implement policies to maintain confidentiality of this HIV-related information, and sets forth certain minimum requirements for these policies:

• That they include the responsibilities of staff to safeguard this information
• That they include procedures for safe record maintenance for both hard copy and electronically stored records
• That they include procedures for accessing and disclosing the information to make sure that only authorized persons have access for authorized purposes
• These policies must be effectively communication to social security officials, employees and agents