N.Y. Public Health Law § 2183 – Immunity passports

1. Any covered entity that requires proof of COVID-19 immunization shall permit the use of physical immunity passports. No covered entity may require digital, electronic, or smartphone-based proof of immunity.
2. Any covered entity that requires the use of an immunity passport shall delete any personal information derived from the immunity passport about the individual to whom the immunity passport pertains within twenty-four hours of receiving it, except that where a covered entity has an ongoing relationship with an individual, the covered entity may store the fact that the individual has received a COVID-19 vaccine, as well as a copy of the individual's immunity passport, provided that:
1. (a) the covered entity first obtains the individual's informed, affirmative, and voluntary consent to store such information, and
2. (b) the covered entity stores any copy of an individual's immunity passport and any personal information derived from the immunity passport as if they were subject to the confidentiality requirements of title I of the Americans with Disabilities Act 42 U.S.C. 12112(d) and its implementing regulations, 29 CFR 1630.14.
3. An immunity passport provider shall not use or disclose personal information derived from an immunity passport beyond what is adequate, relevant, and necessary to identify an individual as having received a COVID-19 vaccine or a COVID-19 test result and shall not collect, access, receive, capture, store, maintain, use, or disclose personal information pertaining to where or when an individual uses an immunity passport.
4.
1. (a) Except as provided in this subdivision, no covered entity or immunity passport provider may:
  1. (i) provide personal information derived from an immunity passport or otherwise make such personal information accessible, directly or indirectly, to a law enforcement agent or entity or immigration authority;
  2. (ii) provide such personal information or otherwise make such personal information accessible, directly or indirectly, to any other individual or entity except as explicitly authorized by this section.
2. (b) Except as provided in this subdivision, personal information derived from an immunity passport, and any evidence derived therefrom, shall not be subject to or provided in response to any legal process or be admissible for any purpose in any judicial or administrative action or proceeding.
3. (c) Personal information derived from an immunity passport, and any evidence derived therefrom, may be disclosed for the purposes of investigations and prosecutions of allegations of computer tampering or fraudulent statements related to an individual's vaccination status. Disclosure for these purposes shall be subject to in camera review and approval by the court and, if the use is initiated by a party other than the individual whose personal information is sought, the information must be highly material and relevant for the purpose.
5. The commissioner shall make regulations as reasonably necessary to ensure that individuals who are medically contraindicated from receiving the COVID-19 vaccine are nonetheless able to obtain reasonable accommodations to enable them to access the services of a covered entity, in a manner that does not impose an undue hardship on the covered entity or present a direct threat that cannot be addressed by a reasonable accommodation.
6. Nothing in this section requires a covered entity to require proof of COVID-19 immunity or to independently verify the information contained in an immunity passport.
7. Nothing in this section shall be construed to limit a covered entity's obligations under the Americans with Disabilities Act, article fifteen of the executive law, the civil rights law, or any other federal, state, or local anti-discrimination law.
8. Nothing in this section shall be construed to affect the practices of a health care provider, as defined in section eighteen of this chapter, a hospital or nursing home as defined in article twenty-eight of this chapter, a health practitioner as defined in section twenty-one hundred sixty-four of this chapter, a facility, as defined in section 33.13 of the mental hygiene law, or a correctional health service governed by the department of corrections and community supervision, the rules of the board of correction in the city of New York, or a county board of correction, with respect to records concerning their patients' vaccinations.