N.Y. Public Health Law § 3371-A – Disclosure of certain records, reports, and information to another state

1. The commissioner is authorized to disclose records, reports and information filed pursuant to sections thirty-three hundred thirty-one and thirty-three hundred thirty-three of this article: (a) to another state's controlled substance monitoring program or other authorized agency with which the department has established an interoperability agreement, pursuant to judicial subpoena or court order in a criminal investigation or proceeding in that state;
(b) to another state's agency, department, or board with which the department has established an interoperability agreement and which is authorized to regulate, license, register or otherwise supervise a person who is authorized by law to deal in controlled substances, in the course of any investigation or proceeding by or before such agency, department or board;
(c) to another state's controlled substance monitoring program or other authorized agency with which the department has established an interoperability agreement to inform a practitioner in another state that a patient may be under treatment with a controlled substance by another practitioner; or
(d) to another state's controlled substance monitoring program or other authorized agency with which the department has established an interoperability agreement to inform a pharmacy in another state that a person who presents or has presented a prescription for one or more controlled substances at the pharmacy may have also obtained controlled substances at another pharmacy where the circumstances indicate a possibility of drug abuse or diversion, potential harm to the person, or similar grounds under regulations of the commissioner.
2. Records, reports, and information disclosed under the provisions of this section shall be in accordance with regulations promulgated by the commissioner and shall include, but not be limited to:
1. (a) the authentication of the person requesting such information;
2. (b) an attestation from the person requesting the information that he or she has authority to request and receive such information, and that such information will only be used consistent with the purpose of the request for such information;
3. (c) a statement of the purpose of the request for such information; and
4. (d) ensuring that such information is, or will be, transmitted in a secure manner.
3. Every agreement under subdivision one of this section shall:
1. (a) require reciprocity with the department on the part of every other party to the agreement;
2. (b) guarantee protection for the confidentiality of information disclosed at least as strong as the protections that would apply to the information when in the possession of the department, including remedies for breaches of confidentiality; and
3. (c) be subject to renewal not less frequently than every two years.