1. (1) It is the policy of OPWDD that any information about anyone applying for services or admitted and receiving services, is to be held in confidence. Any information obtained or to be disclosed is to be done so with the understanding that the information is confidential and is to be maintained exclusively for the purposes of program planning and the provision of competent and humane care to that individual. While the requirements of this section address the particular issues of access to person-specific HIV and AIDS information, it is the intent of OPWDD that no such information is to be discussed casually or capriciously. Such person-specific information should only be judiciously disclosed in accordance with law for the purposes of increasing the understanding of other care-givers about a person's needs and then only care-givers who have or will have responsibilities in addressing that person's needs.
2. (2) Each agency/facility and sponsoring agency for a family care home and its employees, volunteers, and contract agents and family care providers shall ensure the confidentiality of information in the possession of such agency/facility or sponsoring agency concerning whether that person admitted for service or anyone proposed for admission has been the subject of an HIV-related test (see glossary); or has HIV infection (see glossary), HIV-related illness (see glossary), or AIDS; or any information indicating a person's possible exposure to HIV.

3. (3) No one shall have access to HIV-related information (see glossary) unless he or she has access to clinical records in the ordinary course of business, has been trained in matters of confidentiality and related issues, and access to the HIV-related information is reasonably necessary under the following circumstances:

   1. (i) To provide for the appropriate care and treatment of a person as described in his or her program plan except when the sole purpose of accessing the information is to monitor or limit behaviors that could result in significant risk (see glossary) contacts; and the program planning team, in consultation with the person, has determined that he or she exhibits the capacity and willingness to manage his or her behaviors so that the monitoring or limitations are not necessary.
   2. (ii) In connection with an investigation of an alleged violation of a person's rights, including discrimination or abuse.
   3. (iii) To fulfill a specific statutory duty.
   4. (iv) In connection with a review of the quality of care rendered by an agency/facility or a family care provider.
   5. (v) To determine eligibility for services or reimbursement of services by OPWDD or the medical assistance program (Medicaid).

4. (4) Each agency/facility or sponsoring agency shall protect the confidentiality of HIV-related information, whether in the form of records or computer data, which is maintained by or is transferred to authorized parties as defined by paragraph (2) of this subdivision. Employees, volunteers and family care providers shall be informed of and provided with the following written requirements:

   1. (i) HIV-related information shall not be examined, removed or copied by any person unless authorized under paragraph (3) of this subdivision, 10 NYCRR Part 63, or article 27-F of the Public Health Law.
   2. (ii) HIV-related information shall not be disclosed to or discussed with any party unless such party is authorized to access such information pursuant to article 27-F of the Public Health Law, 10 NYCRR 63.5 or paragraph (2) of this subdivision, and there is a need to do so.
   3. (iii) The use of markers on the face of clinical files, lists posted on walls, or other codes or displays for the sole purpose of identifying persons with HIV infection is prohibited.

   4. (iv) All disclosures, oral or written, except as identified in subparagraph (v) of this paragraph, shall be accompanied by this statement:

      “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both.”

   5. (v) All disclosures, oral or written, shall be noted in the clinical record except:

      1. (a) Only initial disclosures to insurance institutions must be noted.

      2. (b) Notation is not required for disclosure to agents or health care providers (see glossary) or health care facilities (see glossary) if:

         1. (1) the agent or health care provider is authorized to access medical or clinical records;
         2. (2) the health care facility or health care provider is authorized to obtain the HIV-related information; and
         3. (3) the agent or health care provider provides general or specific health care to the protected individual, or maintains or processes medical records for billing or reimbursement.
      3. (c) Notation is not required for persons engaged in quality assurance, program monitoring or evaluation, nor for governmental agents acting pursuant to contract or law.
      4. (d) Confidential HIV-related information may be noted in a certificate of death, autopsy report or related documents prepared pursuant to Public Health Law, article 41 or other laws relating to documentation of cause of death.
      5. (e) A protected person shall be informed of disclosures of HIV information upon request of that person.
      6. (f) Confidential HIV-related information shall not be disclosable pursuant to Public Officers Law, article 6 (the Freedom of Information Law).
   6. (vi) Violation of these confidentiality provisions may lead to disciplinary action, including suspension or dismissal from employment, and civil or criminal liability.

5. (5) Each agency/facility and sponsoring agency shall implement and enforce a program that will prevent the transmission of HIV infection, should a caregiver be exposed to the virus. Such a program shall include requiring sound and appropriate health care practices in the care of all persons, including:

   1. (i) training for persons being served, staff, volunteers, and family care providers, on the use of protective equipment, preventive practices, and circumstances that constitute significant risk exposure;
   2. (ii) appropriate training, counseling, and supervision of persons regarding behaviors which pose a risk for HIV transmission. Contact notification, when appropriate, shall be conducted in accordance with Public Health Law, section 2782(4) and 10 NYCRR 63.7;
   3. (iii) training, counseling, and supervision of persons who may be in high risk sexual or other contact situations with others;
   4. (iv) the use of accepted protective practices to prevent skin and mucous membrane exposure to blood, other body fluids, or other significant risk body substances (see glossary);
   5. (v) the use of accepted preventive practices while handling instruments or equipment that may cause puncture injuries; and
   6. (vi) the provision, as appropriate, of personal protective equipment which is of appropriate quality and quantity.

6. (6) Each agency/facility and sponsoring agency shall implement and enforce a program for the management of anyone who is exposed to blood, other body fluids or other significant risk body substances. Such program shall include:

   1. (i) a system for voluntarily reporting all exposures thought to represent a circumstance for significant risk;

   2. (ii) availability of services for evaluating the circumstances of a reported exposure and providing appropriate follow-up of anyone who has been exposed, which includes:

      1. (a) medical and epidemiological assessment of anyone who is the source of the exposure, where that source is known and available;
      2. (b) if epidemiologically indicated, HIV counseling and testing of the source as permitted under article 27-F of the Public Health Law. Where the HIV status is not known to anyone who has been exposed, disclosure can be made only with the express written consent of the source or pursuant to court order; and
      3. (c) appropriate medical follow-up of anyone who has been exposed;
   3. (iii) assurances for protection of confidentiality for those involved in reported exposures.

7. (7) Each agency/facility or sponsoring agency shall ensure that no person being served or anyone proposed for services is discriminated against, abused or otherwise treated adversely because of his or her status as one who is the subject of an HIV-related test, or who is thought to be, or who is, HIV infected. Discrimination includes, but is not limited to, the denial of appropriate services, isolation or quarantine, or the restriction of rights as set forth in this Part, solely because the person or other party has or is thought to have HIV infection.

   (b) Standards of certification.

8. (1) The agency/facility or sponsoring agency has written policies/procedures for maintaining the confidentiality of HIV-related information.
9. (2) OPWDD shall verify that the agency/facility or sponsoring agency has implemented a mechanism and/or procedures for the prevention of the transmission of HIV infection and for the management of anyone thought to be exposed under significant risk circumstances.
10. (3) OPWDD shall verify that the agency/facility or sponsoring agency has not engaged in any instances of discrimination against persons who have or are thought to have an HIV-related illness.

11. (4) OPWDD shall verify that employees, volunteers and family care providers are aware of the requirements regarding the confidentiality of HIV-related information and are knowledgeable regarding:

    1. (i) procedures to prevent the transmission of an HIV-related illness; and
    2. (ii) procedures to manage persons or others who are exposed to blood, other body fluids or other significant risk body substances.

(a) Principles of compliance.