N.Y. Comp. Codes R. & Regs. tit. 10, § 63.4
(b) Reports, including names and addresses of the protected individual, all contact and locating information and other information including demographic, and identifying information as may be specified by the commissioner, shall be made in a manner and format as prescribed by the commissioner. For the requesting provider and facility, the following information shall be included: provider and facility name, complete provider and facility address and telephone number, and provider and facility National Provider Identification. Information reported shall also include names and addresses, if available, of contacts, including spouses, known to the physician or other person authorized to order diagnostic tests or make medical diagnoses, or provided to them by the protected individual, and the date each contact was notified if contact notification has already been done; and information, in relation to each reported contact, required by an approved domestic violence screening protocol. After receiving the report, the commissioner or designated representative may request the individual making the report or the person who ordered the diagnostic tests to provide additional information as may be required for the epidemiologic investigation, case finding and analysis of HIV infection, HIV-related illness and acquired immune deficiency syndrome (AIDS) and to implement Public Health Law article 21, title III. Notwithstanding this subdivision, test results from New York State approved anonymous test sites shall not be reported to the commissioner unless the test subject chooses to supply identification and convert the anonymous test result to a confidential test result.
(c) Confidentiality.
Such reports and additional information maintained by the commissioner or designated representative, including all information generated by contact notification and domestic violence screening activities, shall be kept confidential as required by Public Health Law, article 21, title III, and shall not be disclosed except when in the judgment of the public health official, necessary to other authorized public health officials for conducting accurate and complete epidemiological monitoring of the HIV/AIDS epidemic and for conducting contact notification activities, except that information may be disclosed to public health officials in other jurisdictions when necessary to notify the contact or for purposes of de-duplication; no information about the protected individual will be released to any person in the contact notification process. Reports and information may be used in the aggregate in programs approved by the commissioner:
(a)