N.Y. Comp. Codes R. & Regs. tit. 10, § 63.6 – Confidentiality and disclosure.

(a) No person who obtains confidential HIV-related information in the course of providing any health or social service or pursuant to a release of confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:
1. (1) the protected individual or, when the protected individual lacks capacity to consent, a qualified person under section 18 of the Public Health Law, a person the protected individual has authorized to access records relating to the provision of health care under General Obligations Law article 5, title 15, or person authorized pursuant to law to consent to health care for the individual;
2. (2) any person to whom disclosure is authorized pursuant to a release of confidential HIV- related information in accordance with section 63.5(a) of this Part;
3. (3) an agent or employee of a health facility or health care provider if:
  1. (i) the agent or employee is authorized to access medical records;
  2. (ii) the health facility or health care provider itself is authorized to obtain the HIV- related information; and
  3. (iii) the agent or employee provides health care to the protected individual, or maintains or processes medical records for billing or reimbursement;
    (4)
  4. (i) a health care provider or health facility when knowledge of the HIV-related information is necessary to provide appropriate care or treatment to the protected individual or a child of the individual;
  5. (ii) a health care provider or health facility when knowledge of HIV-related information is necessary to provide appropriate care or treatment to a contact or exposed individual, provided the requirements in section 63.8(m) of this Part are followed for disclosures involving exposures in risk situations;
  6. (iii) in circumstances where consent for health care is necessary, disclosure may also be made to a person authorized to consent to health care for such contact or for such protected individual, provided that if disclosure is to a person authorized to consent to the health care of a contact or to a contact when such contact has been exposed to HIV under circumstances which present a risk of transmission, the requirements in section 63.8(m) of this Part must be followed;
4. (5) a health facility or health care provider, in relation to the procurement, or use of a human body or a human body part, including organs, tissues, blood, semen, or other body fluids, for use in medical education, research, therapy, or for transplantation to individuals;
5. (6) health facility staff committees, or accreditation or oversight review organizations authorized to access medical records, provided that such committees or organizations may only disclose confidential HIV-related information:
  1. (i) back to the facility or provider of a health or social service;
  2. (ii) to carry out the monitoring, evaluation, or service review for which it was obtained; or
  3. (iii) to a Federal, State or local government agency for the purposes of and subject to the conditions provided in subdivision (e) of this section;
6. (7) a Federal, State, county or local health officer when such disclosure is mandated by Federal or State law, including reporting and contact notification processes authorized pursuant to article 21, title III, or pursuant to article 27-F;
7. (8) authorized agencies as defined by Social Services Law, section 371 and corporations incorporated or organized to receive children for adoption or foster care, in connection with foster care or adoption of a child. Such agency shall be authorized to redisclose such information only pursuant to the provisions of article 27-F of the Public Health Law or in accordance with the provisions of Social Services Law, section 373-A and regulations promulgated thereunder;
8. (9) third-party reimbursers or their agents to the extent necessary to reimburse health care providers, including health facilities, for health services, provided that, an otherwise appropriate authorization for such disclosure has been secured;
9. (10) an insurance institution, for other than the purpose set forth in paragraph (9) of this subdivision, provided the insurance institution secures a dated and written authorization that indicates that health care providers, health facilities, insurance institutions, and other persons are authorized to disclose information about the protected individual, the nature of the information to be disclosed, the purposes for which the information is to be disclosed and which is signed by:
  1. (i) the protected individual;
  2. (ii) if the protected individual lacks the capacity to consent, such other person authorized pursuant to law to consent for such individual; or
  3. (iii) if the protected individual is deceased, the beneficiary or claimant for benefits under an insurance policy, a health services plan, or an employee welfare benefit plan as authorized in article 27-F of the Public Health Law;
10. (11) to a funeral director upon taking charge of the remains of a deceased person when such funeral director has access in the ordinary course of business to HIV-related information on the death certificate of the deceased individual, as authorized by Public Health Law, section 4142;
11. (12) any person to whom disclosure is ordered by a court of competent jurisdiction pursuant to Public Health Law, section 2785;
12. (13) an employee or agent of the Division of Probation and Correctional Alternatives, Division of Parole, Commission of Correction, or any local probation department, to the extent the employee or agent is authorized to access records containing such information in order to carry out functions, powers and duties with respect to the protected person and in accordance with regulations promulgated pursuant to Public Health Law, article 27-F;
13. (14) a medical director of a local correctional facility in accordance with regulations promulgated pursuant to article 27-F to the extent the medical director is authorized to access records to carry out his/her functions relating to the protected person. Redisclosure by the medical director is prohibited except as permitted under Public Health Law, article 27-F, article 21, title III and implementing regulations;
14. (15) an employee or agent of the New York City Board of Corrections so that the board may continue to access records of inmates who die while in the custody of the New York City Department of Corrections when necessary for the board to carry out its duties, functions, and powers with respect to the protected individual, pursuant to the New York City charter; or
15. (16) a law guardian, appointed to represent a minor pursuant to the Social Services Law or the Family Court Act, for the purpose of representing that minor. If the minor has the capacity to consent, the law guardian may not redisclose confidential HIV-related information without the minor's permission. If the minor lacks capacity to consent, the law guardian may redisclose confidential HIV-related information for the purpose of representing the minor;
16. (17) an executor or administrator of an estate of a deceased person as needed to fulfill his or her responsibilities/duties as an executor or administrator; or
17. (18) qualified researchers for medical research purposes upon the approval of a research protocol by a human research review committee established and approved under the provisions of article 24-A of the Public Health Law or by an institutional review board established and approved under applicable provisions of Federal law, for the purpose of reviewing and monitoring research involving human subjects, provided that in no event shall any qualified researcher disclose information tending to identify the subjects of the research.
(b) A State, county or local health officer may disclose confidential HIV-related information when:
1. (1) disclosure is specifically authorized or required by Federal or State law including, but not limited to, Public Health Law, article 21, title III and Public Health Law, article 27-F; or
2. (2) disclosure is made pursuant to a release of confidential HIV-related information; or
3. (3) disclosure of information regarding a contact is requested by a physician pursuant to section 63.8 of this Part; or if the contact resides outside the jurisdiction of the authorized public health official, the official shall inform the public health official in the contact's jurisdiction in order to confidentially inform such contact; or
4. (4) disclosure is authorized by court order pursuant to the provisions of Public Health Law, section 2785.
(c) A physician or his/her agent may disclose the confidential HIV-related information to a contact and to a public health officer for the purpose of making a disclosure to the contact.
(d) A physician or his/her agent may, upon the consent of a parent or guardian, disclose confidential HIV- related information to a State, county, or local health officer for the purpose of reviewing the medical history of a child to determine the fitness of the child to attend school.
(e) Confidential HIV-related information of a protected person may be disclosed to authorized employees or agents of a governmental agency pursuant to the regulations of the governmental agency when the person providing health or social services is regulated, supervised or monitored by the governmental agency or when the governmental agency administers the health program or a social service program and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for regulation, supervision, monitoring, administration or provision of services. Such authorized employees or agents may include attorneys authorized by a government agency when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services. Such authorized employees or agents may also include public health officers as needed for conducting epidemiological or surveillance investigations pursuant to applicable law, rule or regulation. Such surveillance or investigational data shall also be disclosed by the public health officer to the State Department of Health as required by the State Sanitary Code or this Part.
(f) Confidential HIV-related information of a protected person may be disclosed to authorized employees or agents of a provider of health or social services when such provider is either regulated, supervised or monitored by a governmental agency or when a governmental agency administers the provider's health or social service program, and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for regulation, supervision, monitoring, administration or provision of services. Such authorized employees or agents may include attorneys authorized by persons providing health services when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services.
(g) A physician or his/her agent may disclose confidential HIV-related information pertaining to a protected individual to a person, known to the physician or his/her agent, authorized pursuant to law to consent to the health care for the protected individual when the physician reasonably believes that:
1. (1) disclosure is medically necessary in order to provide timely care and treatment for the protected individual; and
2. (2) after appropriate counseling as to the need for such disclosure the protected individual will not inform a person authorized by law to consent to health care; provided, however, that the physician shall not make such disclosure if, in the judgment of the physician:
  1. (i) the disclosure would not be in the best interest of the protected individual; or
  2. (ii) the protected individual is authorized pursuant to law to consent to such care and treatment. A physician's decision to disclose pursuant to this paragraph, and the basis for that decision shall be recorded in the medical record.
(h) No person to whom confidential HIV-related information has been disclosed shall disclose the information to another person except as authorized by law, (including, but not limited to, disclosure authorized by PHL article 21, title III), except that this provision shall not apply to:
1. (1) the protected individual;
2. (2) a natural person who is authorized pursuant to law to consent to health care for the protected individual;
3. (3) a protected individual's foster parent, subject to Department of Social Services regulations, for the purpose of providing care, treatment or supervision to the protected individual; or
4. (4) a prospective adoptive parent, subject to Department of Social Services regulations, with whom a child has been placed for adoption.
(i) Nothing in this section shall limit a person's or agency's responsibility or authority to report, investigate, or redisclose child protective and adult protective services information in accordance with title 6 of article 6 and titles 1 and 2 of article 9-B of the Social Services Law, or to provide or monitor the provision of child and adult protective or preventive services.
(j) Confidential HIV-related information shall not be disclosed to a health care provider or health care facility for the sole purpose of implementing infection control precautions when such provider or facility is regulated under the Public Health Law and required to implement such precautions with all individuals pursuant to this Title. This restriction shall not limit access to HIV-related information by a facility's infection control personnel for purposes of fulfilling their designated responsibilities in the facility.
(k) Confidential HIV-related information shall not be released pursuant to a subpoena. A court order pursuant to Public Health Law, section 2785 is required for release of confidential HIV-related information.
(l) Confidential HIV-related information shall be disclosed upon the request of the Health Care Worker HIV/HBV Advisory Panel (see Public Health Law article 27-DD) to the panel or its designee(s) only when the panel considers the information reasonably necessary for the evaluation and monitoring of a worker who has voluntarily sought the panel's review.