1. As used in this section, unless context requires otherwise:

1. (a) The term "consent" shall mean informed, affirmative, and voluntary authorization.
2. (b) The term "de-identified" shall mean that the information cannot identify or be made to identify or be associated with a particular individual, directly or indirectly, and is subject to technical safeguards and policies and procedures that prevent re-identification, whether intentionally or unintentionally, of any individual.
3. (c) The term "disclosure" shall mean release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information.
4. (d) The term "immigration authority" means any entity, officer, employee, or government employee or agent thereof charged with or engaged in enforcement of the federal Immigration and Nationality Act, including the United States Immigration and Customs Enforcement, United States Department of Homeland Security, or United States Customs and Border Protection, or agent, contractor, or employee thereof, or any successor legislation or entity.
5. (e) The term "law enforcement agent or entity" means any governmental entity or public servant, or agent, contractor or employee thereof, authorized to investigate, prosecute, or make an arrest for a criminal or civil offense, or engaged in any such activity, but shall not mean the department, the commissioner, a health district, a county department of health, a county health commissioner, a local board of health, a local health officer, the department of health and mental hygiene of the city of New York, or the commissioner of the department of health and mental hygiene of the city of New York.
6. (f) The term "personal information" shall mean information obtained from or about an individual, in connection with their registering for or receiving a vaccination, that directly or indirectly identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to a particular individual, household, or personal device. Information is reasonably linkable to an individual, household, or personal device if it can be used on its own or in combination with other reasonably available information, regardless of whether such other information is held by the vaccine navigator or vaccine provider, to identify an individual, household, or a personal device.
7. (g) The term "service attendant to the delivery of immunization" shall mean scheduling and billing for an immunization appointment, sending reminders about immunization, arranging transportation to or from a vaccine provider, or reporting to the department, the New York City department of health and mental hygiene, or other local health agency on whose behalf such vaccine navigator is performing such services.
8. (h) The term "use" shall mean, with respect to personal information, the sharing, employment, application, utilization, examination or analysis of such information within an entity that maintains such information.
9. (i) The term "vaccine navigator" shall mean any person that collects personal information from an individual in order to register that individual for immunization or to help that individual register for immunization, provided the department, a local public health agency, or a person that administers vaccines are not vaccine navigators if they only store vaccine recipient personal information in medical records protected under the federal Health Insurance Portability and Accountability Act of 1996, its implementing regulations, or section eighteen of this chapter.

2.

1. (a) Except as provided in paragraph (d) of this subdivision, absent consent from the individual seeking immunization, or if the individual lacks the capacity to make health care decisions, an individual authorized to consent to health care for the individual or the individual's legal representative, a vaccine navigator shall not use, disclose, or maintain personal information except as necessary to provide services attendant to the delivery of immunization.

2. (b) A vaccine navigator may request consent from an individual, or if the individual lacks the capacity to make health care decisions, an individual authorized to consent to health care for the individual or the individual's legal representative, to use, disclose, or maintain the individual's personal information for purposes other than services attendant to the delivery of immunization provided that:

   1. (i) a vaccine navigator shall not refuse to provide a service attendant to the delivery of immunization for an individual who does not provide such consent;
   2. (ii) a vaccine navigator shall not relate the price or quality of any service attendant to the delivery of immunization to the privacy protections afforded the individual, including by providing a discount or other incentive in exchange for such consent, provided that this paragraph does not prohibit the offering of incentives to individuals to get vaccinated; provided that such incentives shall not be conditioned on an individual's consent to additional uses, disclosures, or maintenance of their personal information except as necessary to provide the incentive; and
   3. (iii) a vaccine navigator shall clearly delineate what personal information is adequate, relevant, and necessary to provide a service attendant to the delivery of immunization by clearly and conspicuously indicating in any solicitation for the information that all other requests for personal information are optional.

3. (c) Except as provided in paragraph (d) of this subdivision:

   1. (i) No vaccine navigator may provide personal information or otherwise make personal information accessible, directly or indirectly, to a law enforcement agent or entity or immigration authority;
   2. (ii) No vaccine navigator may provide personal information or otherwise make personal information accessible, directly or indirectly, to any other individual or entity, except as explicitly authorized by this title; and
   3. (iii) Without consent under this subdivision, personal information and any evidence derived therefrom shall not be subject to or provided in response to any legal process or be admissible for any purpose in any judicial or administrative action or proceeding.

4. (d)

   1. (i) This section does not bar otherwise lawful disclosure, possession or use of information pertaining to services attendant to the delivery of immunization, including aggregate information, that is de-identified. Disclosure, possession or use under this subparagraph shall only be for a public health or public health research purposes.
   2. (ii) A person may only possess or use de-identified information pertaining to services attendant to the delivery of immunization if the person maintains technical safeguards and policies and procedures that prevent re-identification, whether intentional or unintentional, of any individual, as may be required by the commissioner (or the New York city commissioner of health and mental hygiene, in the case of information collected by or under authority of the New York city department of health and mental hygiene. The commissioner (or the New York city commissioner as the case may be) shall require safeguards, policies and procedures under this paragraph as the commissioner deems practicable.
   3. (iii) Disclosure, possession and use of de-identified information under this subdivision shall be only pursuant to approval by the commissioner (or the New York city commissioner of health and mental hygiene in the case of information collected by or under authority of the New York city department of health and mental hygiene) specifying the purpose, nature and scope of the disclosure, possession and use and measures to ensure that it will comply with this section and the terms of the approval.
   4. (iv) This section does not prevent disclosure of personal information sought for the purposes of investigations and prosecutions of allegations of computer tampering or billing fraud related to vaccination records, fraudulent statements related to an individual's vaccination status, an act of violence or attempted violence occurring at the site of a vaccination provider's or vaccine navigator's business, or medical malpractice, professional discipline, or defense of any claim brought against a vaccine navigator or provider. Disclosure for these purposes shall be subject to in camera review and approval by the court and, if the use is initiated by a party other than the individual whose registry information is sought, the information must be highly material and relevant for the purpose.
5. (e) A vaccine navigator that maintains personal information shall establish appropriate administrative, technical, and physical safeguards, policies, and procedures that ensure the security of that personal information. The safeguards, policies, and procedures must be appropriate to the volume and nature of the personal information maintained and the size, revenue, and sophistication of the vaccine navigator and must ensure that personal information is encrypted and protected at least as much as or more than other confidential information in the vaccine navigator's possession. The commissioner or, in the city of New York, the commissioner of the department of health and mental hygiene shall make regulations as reasonably necessary to require that personal information possessed, used, or under the control of a vaccine navigator shall be subject to technical safeguards, policies, and procedures for storage, transmission, use, and protection of the information. The regulations must take into account the different sizes, revenues and sophistications of different vaccine navigators, as well as the volume and nature of the personal information they maintain.
6. (f) Nothing in this section shall limit a vaccine navigator that has a pre-existing service provider-client, provider-patient, or familial relationship or a friendship with an individual from processing that individual's personal information as previously agreed to in the course of the pre-existing relationship.