1. (1) The disclosure of HIV related information is governed by article 27-F of the Public Health Law, 42 C.F.R. part II, the Health Insurance Portability and Accountability Act (HIPAA) and by this Part.
2. (2) Confidential HIV-related information must be recorded in the case record of the protected individual.

3. (3) HIV-related information may not be disclosed to staff of the provider except to:

   1. (i) a person to whom disclosure of confidential HIV-related information is specifically authorized pursuant to a written release; or
   2. (ii) an authorized staff of a health facility or health care provider in accordance with this Part and article 27F of the Public Health Law.
4. (4) All clients in addiction treatment programs must receive a written notice summarizing these confidentiality requirements.

5. (5) Confidential HIV-related treatment information may be recorded in the treatment/recovery plan of the protected individual.

   (b) Authorized disclosure.

6. (1) A written authorization to disclose HIV-related information must be in a form, compliant with any applicable Federal requirements, approved by the office and the Department of Health. The form consenting to release of HIV-related information must be signed by the protected individual, or if the protected individual lacks capacity to consent, by a person legally authorized to consent to health care for the individual.
7. (2) A notation of each authorized disclosure must be placed in the protected individual’s case record. The protected individual must be informed of any disclosures upon request.
8. (3) All written disclosures of confidential HIV-related information must be accompanied by a statement prohibiting re-disclosure.

9. (4) If oral disclosures are necessary they must be accompanied or followed as soon as possible, but no later than 10 days after the disclosure, by the required statement prohibiting re-disclosure.

   (c) Additional prohibitions.

   Confidential HIV-related information shall not be released pursuant to a subpoena. An order from a court of competent jurisdiction is required, pursuant to section 2785 of the Public Health Law and 42 CFR part II, when applicable.

(a) Confidentiality.