(a) Staff of an authorized agency as defined by paragraphs (a) and (b) of section 371(10) of the Social Services Law must comply with the following standards relating to access to and disclosure of confidential HIV related information.

1. (1) Each authorized agency is responsible for formulating a written management plan to ensure that required safeguards are implemented and enforced to restrict the disclosure of confidential HIV related information concerning children in its care. This management plan must be available for review by the department and must include:

   1. (i) procedures consistent with section 2782.6 of the Public Health Law to ensure that documents containing confidential HIV related information are accessible only to an authorized employee or agent of the authorized agency when disclosure is reasonably necessary for the supervision, monitoring, administration or provision of services provided by such agencies. For the purpose of this section, an authorized employee or agent means an employee or agent who, in the ordinary course of business of the authorized agency, has access to records relating to the care of, treatment of, or provision of services to the person; and
   2. (ii) measures to ensure that confidential HIV related information stored electronically is protected from access by unauthorized persons; and
   3. (iii) a plan for training agency staff regarding HIV infection, confidentiality of HIV related information, and protection of persons at significant risk in accordance with subdivision (c) of this section.
2. (2) Such authorized employees or agents must be provided with a written statement warning of penalties for unauthorized disclosure as follows: “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure.”
3. (3) Redisclosure of confidential HIV related information by an authorized agency is not permitted except in a manner consistent with article 27-F of the Public Health Law, section 373-a of the Social Services Law and section 357.3(b) of this Title.

4. (4) Confidential HIV related information included in the child's health history must be provided to:

   1. (i) another authorized agency to whom the care of the child is transferred;
   2. (ii) the foster parents who have responsibility for the child's care;
   3. (iii) the prospective adoptive parents as defined in section 421.1 of this Title or adoptive parents of the child;
   4. (iv) the biological parents when the child is discharged to such parents and such disclosure is authorized by section 2782 of the Public Health Law;
   5. (v) a child discharged to his or her own care.

5. (5) Confidential HIV related information is defined in section 360-8.1 of this Title.

   (b)

6. (1) Foster parents may redisclose confidential HIV-related information concerning a foster child boarded out or placed with such parents to persons or entities other than those set forth in article 27-F of the Public Health Law only:

   1. (i) when redisclosure is for the purpose of providing care, treatment or supervision of the foster child; or
   2. (ii) upon specific written authorization signed by the commissioner of the social services district or such commissioner's designated representative in accordance with article 27-F of the Public Health Law. Such authorization must be maintained in the child's uniform case record.

7. (2) Any disclosure of confidential HIV-related information by a foster parent, except as authorized by article 27-F of the Public Health Law, must be accompanied by a statement in writing which includes the following or substantially similar language:

   “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure.”

   (c) Training of Staff.

   Each authorized responsible for the care of HIV infected children, and for maintaining the confidentiality of records for such children, must provide initial training within 90 days of promulgation of these regulations, and thereafter at least annually, to all staff persons authorized to have access to any files and records, written or electronic, containing information on HIV infected children. As new staff with such access are added to agency personnel, initial training must be provided within 45 days of employment. Such training must include, but is not limited to:

8. (1) a review of State law and department regulations related to confidentiality of HIV information, including, but not limited to:

   1. (i) the necessity for written authorization for redisclosure on a case by case assessment;
   2. (ii) the list of specific persons to whom HIV related information in the child's health history must be provided in accordance with Social Services Law 373-a and Section 357.3(b) of this Title; and
   3. (iii) the provision of the required warning statement of penalties for redisclosure in accordance with section 405.3(g)(16) of this Title.
9. (2) a review of the agency's written management plan for maintaining security of records;
10. (3) information on factors which constitute significant risk of contracting or transmitting HIV infection as defined by the State Department of Health regulations 10 NYCRR Part 63.9. Such factors include the presence of significant risk body substances, principally blood and semen, and the circumstances which result in transmission of such substances;

11. (4) hygienic measure recommended for the protection of persons caring for an HIV infected child and for protection of HIV infected children from unnecessary exposure to additional infections. Such measures include:

    1. (i) standard accepted practices for cleanliness and infection control;
    2. (ii) the use of preventive barriers where indicated, specifically if the caretaker's skin has open wounds or abrasions, or if there is presence of blood; and

12. (5) current research information concerning HIV infection which includes, but is not limited to, the evidence that HIV disease is not transmitted by casual or in ordinary home and family care of children.

    (d) Law guardian.

    When requested by a law guardian, an authorized agency must disclose confidential HIV-related information concerning a foster child to the law guardian if the law guardian is appointed to represent the foster child pursuant to the Social Services Law or the Family Court Act and the information is for the purpose of representing the foster child. A law guardian appointed to represent a child may redisclose confidential HIV-related information only with the consent of the child if the child has capacity to consent. If the child lacks capacity to consent, the law guardian may redisclose confidential HIV-related information for the sole purpose of representing the child.