1.

1. (a) All contact tracing information shall be kept confidential by any contact tracer and contact tracing entity, and may not be disclosed except as necessary to carry out contact tracing or a permitted purpose.
2. (b) Where a contact tracer or contact tracing entity discloses contact tracing information for a permitted purpose, the contact tracer or contact tracing entity shall make a record of the disclosure, including to whom it was made, which shall be part of the contact tracing information.

2.

1. (a) An individual may waive the confidentiality provided for by this section, only by a written, informed and voluntary waiver, in plain language and in a language understandable to the individual making the waiver, and not part of any other document. The waiver shall state the scope and limit of the waiver. If an individual lacks the capacity to make a waiver, an individual authorized to consent to health care for the individual, or the individual's legal representative, may make the waiver. However, a waiver of confidentiality is not required to be written if it is solely for the purpose of arranging or providing support for the individual who is the subject of the contact tracing information.
2. (b) A waiver of confidentiality under this section shall only apply for the purpose of arranging or providing support if the individual who is the subject of the contact tracing information provides voluntary informed consent to the arranging or providing of the support.

4.

1. (a) This section does not bar otherwise-lawful disclosure, possession or use of contact tracing information, including aggregate contact tracing information, that is de-identified. Disclosure, possession or use under this subdivision shall only be for a public health or public health research purpose.
2. (b) A person or entity may only possess or use de-identified contact tracing information if the person or entity maintains technical safeguards and policies and procedures that prevent re-identification, whether intentional or unintentional, of any individual, as may be required by the commissioner (or the New York city commissioner of health and mental hygiene in the case of contact tracing information collected by or under authority of the New York city department of health and mental hygiene or the New York city health and hospitals corporation). The commissioner (or the New York city commissioner as the case may be) shall require safeguards, policies and procedures under this paragraph as the commissioner deems practicable.
3. (c) Disclosure, possession and use of de-identified contact tracing information under this subdivision shall be only pursuant to approval by the commissioner (or the New York city commissioner of health and mental hygiene in the case of contact tracing information collected by or under authority of the New York city department of health and mental hygiene or the New York city health and hospitals corporation) specifying the purpose, nature and scope of the disclosure, possession and use and measures to ensure that it will comply with this section and the terms of the approval.

7.

1. (a) The commissioner (or the New York city commissioner of health and mental hygiene in the case of contact tracing information collected by or under authority of the New York city department of health and mental hygiene or the New York city health and hospitals corporation) shall make regulations to require that contact tracing information possessed, used or under the control of a contact tracer or contact tracing entity shall be subject to technical safeguards and policies and procedures for storage, transmission, use and protection of the information. The regulations shall prevent possession, use or disclosure of the contact tracing information not permitted by this title, and shall be at least as or more protective than the safeguards, policies and procedures the commissioner (or the New York city commissioner as the case may be) provides for other confidential information.
2. (b) This paragraph applies where contact tracing information is possessed or controlled by a contact tracer or contact tracing entity that is a non-governmental individual or entity employed by or under contract with a governmental entity, or an agent thereof. Within thirty days of collecting or receiving the contact tracing information, the non-governmental individual or entity shall (i) remove information from its possession or control and deliver it to the appropriate governmental contact tracing entity, retaining no copy of it; (ii) expunge the information from its possession or control; or (iii) de-identify the information. However, the expungement or de-identification of particular contact tracing information may be postponed for up to fifteen days while the contact tracer or contact tracing entity is actively engaged in contact tracing using that information, provided that the principal individual or contact individual to whom it pertains gives voluntary informed consent. The disclosure, possession and use of the de-identified contact tracing information shall be subject to subdivision four of this section.