N.Y. Comp. Codes R. & Regs. tit. 14, § 635-12.2 – General provider obligations.

(a) This Subpart applies to all services, whether or not they are preexisting services. However, a limited exception to the applicability of certain sections of this Subpart has been made in the case of some individuals who are applying for or receiving supported employment services or respite services (see section 635-12.12 of this Subpart).
(b) Each provider shall establish fee schedules for services it provides in accordance with section 635-12.9 of this Subpart.
(c) Each provider shall have written policies/procedures in place to protect the privacy of personal financial information concerning individuals requesting or receiving services and other liable parties.
1. (1) Providers shall designate staff who are authorized to obtain and access personal financial information.
2. (2) Providers may only disclose personal financial information obtained about the individual and liable parties to entities as necessary for the individual to obtain and maintain benefits and to OPWDD.
(d) Each provider shall require that the individual and liable parties comply with the requirements of this Subpart.