(b) No person who obtains confidential HIV-related information in the course of providing any health or social service or pursuant to a release of confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:

1. (1) the protected individual or, when the protected individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual;
2. (2) any person to whom disclosure is authorized pursuant to a release of confidential HIV-related information;

3. (3) an agent or employee of a health facility or health care provider if:

   1. (i) the agent or employee is authorized to access medical records;
   2. (ii) the health facility or health care provider itself is authorized to obtain the HIV-related information; and
   3. (iii) the agent or employee provides health care to the protected individual, or maintains or processes medical records for billing or reimbursement;
4. (4) a health care provider or health facility when knowledge of the HIV-related information is necessary to provide appropriate care or treatment to the protected individual or a child of the individual;
5. (5) a health facility or health care provider, in relation to the procurement, processing, distributing or use of a human body or a human body part, including organs, tissues, eyes, bones, arteries, blood, semen, or other body fluids, for use in medical education, research, therapy, or for transplantation to individuals;

6. (6) health facility staff committees, or accreditation or oversight review organizations authorized to access medical records, provided that such committees or organizations may disclose confidential HIV-related information only:

   1. (i) back to the facility or provider of a health or social service;
   2. (ii) to carry out the monitoring, evaluation, or service review for which it was obtained; or
   3. (iii) to a Federal, State or local government agency for the purposes of supervising, monitoring or administering such facility;
7. (7) a Federal, State, county or local health officer when such disclosure is mandated by Federal or State law;
8. (8) authorized agencies as defined by Social Services Law, section 371 and corporations incorporated or organized to receive children for adoption or foster care, in connection with foster care or adoption of a child. Such agency shall be authorized to redisclose such information only pursuant to the provisions of article 27-F of the Public Health Law or in accordance with the provisions of section 373-A of the Social Services Law;
9. (9) third-party reimbursers or their agents to the extent necessary to reimburse health care providers, including health facilities, for health services, provided that, where necessary, an otherwise appropriate authorization for such disclosure has been secured by the provider;

10. (10) an insurance institution, for other than the purpose set forth in paragraph (9) of this subdivision, provided the insurance institution secures a dated and written authorization which indicates that health care providers, health facilities, insurance institutions, and other persons are authorized to disclose information about the protected individual, the nature of the information to be disclosed, the purposes for which the information is to be disclosed, and which is signed by:

    1. (i) the protected individual;
    2. (ii) if the protected individual lacks the capacity to consent, such other person authorized pursuant to law to consent for such individual; or
    3. (iii) if the protected individual is deceased, the beneficiary or claimant for benefits under an insurance policy, a health services plan, or an employee welfare benefit plan as authorized in article 27-F of the Public Health Law;
11. (11) any person to whom disclosure is ordered by a court of competent jurisdiction pursuant to section 2785 of the Public Health Law;
12. (12) an employee or agency of the Division of Parole, Division of Probation and Correctional Alternatives, or Commission of Correction, in accordance with regulations promulgated by those agencies; and
13. (13) a medical director of a local correctional facility in accordance with regulations promulgated by the facility operator. Redisclosure by the medical director is prohibited except as permitted under Public Health Law, article 27-F and its implementing regulations.

(c) No confidential HIV-related information shall be disclosed pursuant to a general release. Disclosure is permitted for HIV-related information pursuant to a specific release form which has been developed or approved by the Department of Health. The release must be signed by the protected individual, or if the protected individual lacks capacity to consent, by a person authorized pursuant to law to consent to health care for the individual.

1. (1) All written disclosures of confidential HIV-related information must be accompanied by a statement prohibiting redisclosure. The statement shall include the following language or substantially similar language: “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure.”
2. (2) If oral disclosures are necessary, they must be accompanied or followed as soon as possible, but no later than 10 days, by the statement required in paragraph (1) of this subdivision. All disclosures, oral or written, shall be recorded in the individual's record.
3. (3) The statement required by paragraphs (1) and (2) of this subdivision is not required for release to the protected person or to his or her legal representative, for releases made by a physician or public health officer to a contact, or for releases made by a physician to a person authorized pursuant to law to consent to the health care of the protected person when the person has been counseled and the disclosure is medically necessary pursuant to Public Health Law, section 2782(4)(e).