N.Y. Comp. Codes R. & Regs. tit. 18 § 485.11 - Records and Reports Maintained by Operator of Adult-Care Facility

The regulation requires that operators of adult-care facilities maintain records and reports as specified by the department of health, and that these records are subject to inspection by the department and certain other governmental entities.  The regulation requires that the officers/employees of the department maintain the information obtained through annual financial reports, any inspection or investigation of a facility confidential.  The regulation requires the operators of these facilities to keep the information retained as part of individual residential records confidential as well, and further states that no facts retained in individual resident records may be released without a written release to anyone other than the resident himself/herself, the operator of the facility, employees of the facility, employees of the department of health.
 
The regulation specifically sets down certain rules to govern the confidentiality of HIV-related information:

• The regulation prohibits operators/employees from requiring that applicants for employment/residents/volunteers/employees undergo HIV testing
• The regulation prohibits operators/employees from requiring that applicants for employment/residents/volunteers/employees disclose confidential HIV-related information
  • The regulation goes on to define "confidential HIV-related information," "AIDS," "HIV infection," "HIV related illness."
• The regulation prohibits any discrimination or adverse actin on the basis of HIV status towards any applicants for employment, residents, volunteers, or employees
• The regulation allows disclosure of confidential HIV-related information only to operators/employees only when needed to perform their duties and when disclosure is made in adherence with this regulation
• The regulation only allows operators/employers to disclose confidential HIV-related information related to applicants for employment, employees, residents, prospective residents or volunteers when they receive a specific written authorization (a general release cannot be used as authorization) to release that information signed by the protected individual or the person authorized to consent to health care on behalf of the protected individual.  The regulation requires that this written authorization be dated, specify to whom disclosure is authorized, the purpose for the disclosure, the time period of disclosure and the fact that the information is confidential HIV information
• The regulation requires that whenever an operator/employee discloses confidential HIV information, s/he is required to note the disclosure in the protected individual’s record.  The regulation also provides the language that needs to be in a statement preventing re-disclosure of information; this statement needs to given to the person to whom disclosure is being made.
• The regulation sets forth certain exceptions to the rules stated above:
  • An operator may disclose confidential HIV related information to a health care provider/facility when disclosure is necessary to provide care/treatment to the protected individual.  In this case no authorization for release is required, but the operator must still enter the disclosure into the individual’s record, and provide the statement preventing re-disclosure.
  • An operator is obligated to release such confidential information to authorized employees of the department of social services or social services districts when necessary to supervise or administer the facility and the employee would have access to such records in the ordinary course of business.  The facility operator is not required to enter the disclosure into the protected individual’s record, or to provide the statement preventing re-disclsoure.