N.Y. Comp. Codes R. & Regs. tit. 18, § 360-8.1 – Confidentiality of HIV- and AIDS-related information.

(1) acquired immune deficiency syndrome, as may be defined from time to time by the Centers for Disease Control of the United States Public Health Service.
(2) HIV infection means infection with the human immunodeficiency virus or any other related virus identified as a probable causative agent of AIDS.
(3) HIV related illness means any illness that may result from or may be associated with HIV infection.
(4) HIV related test means any laboratory test or series of tests for any virus, antibody, antigen or etiologic agent whatsoever thought to cause or to indicate the presence of AIDS.
(5) Confidential HIV related information means any information, in the possession of a person who provides one or more health or social services or who obtains the information pursuant to a release of confidential HIV related information, concerning whether an individual has been the subject of an HIV related test, or has HIV infection, HIV related illness or AIDS, or information which identifies or reasonably could identify an individual as having one or more of such conditions, including information pertaining to such individual's contacts.
(6) Health or social service means any public or private care, treatment, clinical laboratory test, counseling or educational service for adults or children, and acute chronic, custodial, residential, outpatient, home or other health care provided pursuant to the Public Health Law or the Social Services Law; public assistance or care as defined in article one of the Social Services Law; employment-related services, housing services, foster care, shelter, protective services, day care, or preventive services provided pursuant to the Social Services Law; services for the mentally disabled as defined in article one of the Mental Hygiene Law; probation services, provided pursuant to article twelve of the Executive Law; parole services, provided pursuant to article twelve-B of the Executive Law; correctional services, provided pursuant to the Correction Law; and detention and rehabilitative services provided pursuant to article nineteen-G of the Executive Law.
(7) Person includes any natural persons, partnership, association, joint venture, trust, public or private corporation, or State or local government agency.
(8) Capacity to consent means an individual's ability, determined without regard to the individual's age, to understand and appreciate the nature and consequences of a proposed health care service, treatment or procedure, or of a proposed disclosure of confidential HIV-related information, as the case may be, and to make an informed decision concerning the service, treatment, procedure or disclosure.
(b) Applicability.
This section applies to any person who obtains or receives confidential HIV related information in the course of administering the medical assistance program (MA) and implements article 27-F of the Public Health Law. Any use or disclosure of such confidential HIV related information made on or after February 1, 1989 is subject to the terms of this section.
(c) Standard of use and disclosure.
Confidential HIV related information can be used or disclosed only for a purpose which is directly connected with the administration of the MA program and consistent with the limitations of section 2782 of the Public Health Law relating to persons to whom or entities to which confidential HIV related information may be disclosed. As applied to this section, such a purpose may include supervision, monitoring, administration or provision of MA care, services and supplies. Any adverse case action taken against an applicant for or recipient of MA must be based solely upon the terms and conditions of eligibility and the furnishing of care, services and supplies as established by the Social Services Law and this Title. All social services district officials, employees and their agents are responsible for ensuring that no discrimination or abuse occurs against an applicant for or recipient of MA about whom confidential HIV related information is maintained.
(d) Access to confidential HIV related information.
No social services district official, employee or agent will have access to confidential HIV related information except as necessary for the fulfillment of a purpose which is related to an official duty of such official, employee or agent and is directly connected with the administration of the MA program.
(e) Redisclosure of confidential HIV related information.
No social services district official, employee or agent to whom confidential HIV related information has been disclosed can disclose such information to any other person except as authorized under subdivisions (c) and (d) of this section.
(f) Disclosure of confidential HIV related information under legal process.
Confidential HIV related information must be disclosed for purposes of judicial administration only upon service of a court order for disclosure made pursuant to section 2785 of the Public Health Law.
(g) Disclosure of confidential HIV related information pursuant to a release.
(1) Confidential HIV related information may be disclosed pursuant to a release. A release is a written authorization for disclosure of confidential HIV related information which satisfies the following conditions. The release:
1. (i) is signed by the person who is the subject of the confidential HIV related information or, if such person lacks capacity to consent, a person authorized pursuant to law to consent to health care for the person lacking capacity;
2. (ii) is dated and specifies the time period during which the release is to be effective; and
3. (iii) specifies to whom disclosure is authorized and the purpose for such disclosure.
(2) A general authorization for release of medical or other information does not satisfy the requirements of this subdivision and confidential HIV related information cannot be disclosed in response to a general release.
(h) Statement accompanying disclosure.
(1) Any written disclosure of confidential HIV related information must be accompanied by a statement in writing which includes the following or substantially similar language: “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure.”
(2) Any oral disclosure of confidential HIV related information must be accompanied or followed as soon as possible, but no later than 10 days, by the statement in writing required by paragraph (1) of this subdivision.
(3) The statement in writing provided for in paragraph (1) of this subdivision is not required to accompany or follow a disclosure of confidential HIV related information made to the person who is the subject of the confidential HIV related information or, if such person lacks capacity to consent, a person authorized pursuant to law to consent to health care for the person lacking capacity.
(i) Policy and procedures for maintaining confidentiality.
The department and social services districts must develop and implement policies and procedures to maintain the confidentiality of HIV related information. Such policies and procedures must be effectively communicated to social services officials, employees and agents and must include, but not be limited to, the following:
(1) responsibilities of staff to safeguard confidential HIV related information;
(2) procedures for secure record maintenance of confidential HIV related information, including electronically stored records; and
(3) procedures for accessing and disclosure of confidential HIV related information to assure that only authorized persons gain access to such information for permissible purposes.

(a) Definitions.