1. (1) All requests for access to records should be addressed to:

   Privacy Compliance Officer

   Office of Mental Health

   44 Holland Avenue

   Albany, NY 12229

2. (2) The Deputy Director of Institutional Administration in each State-operated psychiatric facility is designated as Deputy Privacy Compliance Officer for nonclinical records in that psychiatric facility.
3. (3) The facility director in each State-operated psychiatric facility is designated as Deputy Privacy Compliance Officer for clinical records in that psychiatric facility.
4. (4) [Reserved]
5. (5) The Office of Mental Health shall accept requests for records and produce records during regular business hours, which are 8:30 a.m. to 4:30 p.m. each weekday. Whenever practicable, records shall be made available at a location most convenient to a data subject.

6. (6) All requests shall be made in writing, or orally after the applicant has demonstrated proof of identity.

   1. (i) When a request is made in person, or when records are made available in person following a request made by mail, the Office of Mental Health may require appropriate identification, such as a driver's license, an identifier assigned to the data subject by the Office of Mental Health, a photograph or similar information that confirms that the record sought pertains to the data subject.
   2. (ii) When a request is made by mail, the Office of Mental Health may require verification of a signature or inclusion of an identifier generally known only by a data subject, or similar appropriate identification.
   3. (iii) Proof of identity shall not be required regarding a request for a record accessible to the public pursuant to article 6 of the Public Officers Law, unless it is otherwise permissible to request such proof pursuant to article 6 of the Public Officers Law.
7. (7) A request shall reasonably describe the record sought. Whenever possible, the data subject should supply identifying information that assists the Office of Mental Health in locating the records sought. Requests based upon categories of information described in a notice of a system of records or a privacy impact statement shall be deemed to reasonably describe the record in question.

8. (8) The Privacy Compliance Officer and/or deputies are responsible for:

   1. (i) assisting a data subject in identifying and requesting a record if necessary; and
   2. (ii) describing the contents of systems of records either orally or in writing to enable a data subject to learn if a system of records includes a record identifiable to a data subject requesting such record.

9. (9) Within five business days of the receipt of a request for access, the Privacy Compliance Officer and/or deputies shall either:

   1. (i) provide access to the record;
   2. (ii) deny access, providing a written explanation of the reasons therefor and inform the data subject of the right to appeal such decision; or
   3. (iii) acknowledge the receipt of the request in writing, stating the approximate date when a decision shall be made regarding the request. This date shall not exceed 30 days from the date of acknowledgment.

10. (10) Upon request, the Privacy Compliance Officer shall also certify that:

    1. (i) a copy of a record sought is a true copy;
    2. (ii) the agency does not have possession of the record sought;
    3. (iii) the agency cannot locate the record sought after having made a diligent search; or
    4. (iv) the record sought cannot be retrieved by use of the description thereof, or by use of the name or other identifier of the data subject without the use of extraordinary search methods.

11. (11) Unless otherwise prescribed by statute:

    1. (i) There shall be no fee charged for:

       1. (a) inspection of records;
       2. (b) search for records; or
       3. (c) any certification pursuant to this Part.

    2. (ii) Copies of records shall be provided:

       1. (a) at a cost of 25 cents a page per photocopy up to 9 × 14 inches; or

       2. (b) upon payment of the actual cost of reproduction, if the record cannot be photocopied.

          (b) Amendment or correction of a record.

12. (1) Within 30 business days of a request from a data subject for amendment or correction of a record that is reasonably described and pertains to the data subject, the Privacy Compliance Officer and/or Deputy Privacy Compliance Officer shall:

    1. (i) make the amendment or correction in whole or in part and inform the data subject that upon request, such amendment or correction will be provided to any person or governmental unit to which the record or personal information has been or is disclosed pursuant to paragraph (d), (i) or (l) of subdivision (1) of section 96 of the Public Officers Law; or
    2. (ii) inform the data subject in writing of its denial of the request to amend or correct the record, including the reasons therefor and the right to appeal such denial.

13. (2) Nothing in this Part shall require the Office of Mental Health to grant access to, amend or correct any record not otherwise required by the Personal Privacy Protection Law, such as:

    1. (i) personal information to which he or she is specifically prohibited by statute from gaining access;
    2. (ii) patient records concerning mental disability or medical records where such access is not otherwise required by law;
    3. (iii) attorney's work product or material prepared for litigation before judicial, quasi-judicial or administrative tribunals; and
    4. (iv) public safety agency records.

(a) Requests for access to a record.