N.Y. Comp. Codes R. & Regs. tit. 18, § 485.11 – Records and reports.

(a) The operator shall collect and maintain such information, records or reports as determined by the department to be necessary.
(b) Operators of facilities subject to the inspection and supervision of the department shall supply and provide access to such information and records in such form and at such times as the department shall determine.
(c) No substitution for department forms may be made without prior written approval of the department.
(d) The department may request from any other State department or State or local agency, including but not limited to the Department of Mental Hygiene, the Office of Children and Family Services and the Board of Social Welfare, and such other department or agency shall furnish such information as the department may require.
(e) Other State departments or State agencies may request such information as such department or agency may require for the proper discharge of its duties. Such departments and agencies shall safeguard the confidentiality of such information, records and reports in the same manner as the department.
1. (1) Officers, employees or designees of the department shall maintain the confidentiality of facts and information obtained as the result of submittal of any annual financial report, any inspection or investigation of a facility.
2. (2) Operators shall maintain the confidentiality of facts and information obtained and retained as part of individual resident records.
3. (3) No facts and information retained as part of individual resident records may be released to anyone other than the resident, the operator, his employees or agents, or an employee or designee of the department, without the written permission of the resident.
  (g) Confidentiality of HIV- and AIDS-related information.
4. (1) An operator or employee must not require that an applicant for employment, prospective resident, resident, volunteer or employee undergo an HIV-related test.
5. (2) An operator or employee must not require an applicant for employment, prospective resident, resident, volunteer or employee to disclose confidential HIV-related information.
6. (3) Confidential HIV-related information means any information, in the possession of a person who provides one or more health or social services or who obtains the information pursuant to a release of confidential HIV related information, concerning whether an individual has been the subject of an HIV related test, or has HIV infection, HIV related illness or AIDS, or information which identifies or reasonably could identify an individual as having one or more of such conditions, including information pertaining to such individual' contacts.
7. (4) AIDS means acquired immune deficiency syndrome, as may be defined from time to time by the centers for disease control of the United States public health service.
8. (5) HIV infection means infection with the human immunodeficiency virus or any other related virus identified as a probable causative agent of AIDS.
9. (6) HIV related illness means any illness that may result from or may be associated with HIV infection.
10. (7) HIV related test means any laboratory test or series of tests for any virus, antibody, antigen or etiologic agent whatsoever thought to cause or to indicate the presence of AIDS.
11. (8) There must be no discrimination based on handicap, as that term is defined in section 303.7 of this Part, in determining admission, retention or employability; nor shall there be any adverse action on that basis against an applicant for employment, prospective resident, resident, employee or volunteer.
12. (9) Confidential HIV related information may be disclosed by an operator or employee only in accordance with the procedures set forth in this Part and only when appropriate services cannot be provided without disclosure.
13. (10) Except as specified in paragraphs (14) and (15) of this subdivision, an operator, employee or volunteer who obtains confidential HIV related information concerning any applicant for employment, prospective resident, resident, employee or volunteer must not disclose that information without specific written authorization to release that information from:
  1. (i) the protected individual; or
  2. (ii) a person authorized by law to consent to health care for the individual.
14. (11) The authorization to release confidential HIV-related information must:
  1. (i) be dated;
  2. (ii) specify to whom disclosure is authorized;
  3. (iii) specify the purpose for the disclosure;
  4. (iv) specify the time period during which the release is effective;
  5. (v) specify that the information to be disclosed is confidential HIV information; and
  6. (vi) be signed by the protected individual or, if the individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual.
15. (12) A general authorization for the release of medical or other information cannot be used as an authorization to release confidential HIV-related information.
16. (13) Whenever an operator or employee discloses confidential HIV information, that person must:
  1. (i) enter a dated and signed notation of disclosure of HIV information in the protected individual' record; and
  2. (ii) within 10 days of the date of disclosure if the disclosure is oral, and simultaneously when disclosure is written, give a written statement to the person to whom the HIV information is disclosed which states:
    “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure.”
17. (14) Notwithstanding the requirements of this section, an operator may disclose confidential HIV related information to a health care provider or health facility when knowledge of the confidential HIV related information is necessary to provide appropriate care or treatment to the protected individual. No authorization for release of confidential HIV related information is required for such disclosure. However, the operator must follow the disclosure procedure specified in paragraph (13) of this subdivision.
18. (15) Notwithstanding the requirements of this section, an operator is obligated to release confidential HIV related information to authorized employees or agents of the department or social services districts when such information is reasonably necessary to supervise, monitor, or administer the facility and such employee or agent of the department or social services districts would, in the ordinary course of business have access to such records. Authorized employees and agents of the department or social services districts may obtain confidential HIV related information under this paragraph even though the adult care facility does not obtain the release specified in paragraph (10) of this subdivision. In addition, when information is released under this section by an adult care facility, the facility is not required to give the statement specified in paragraph (13) of this section to the employees or agents of the department or social services district nor is the facility required to indicate in any resident's record that the information was released.
(f) Confidentiality.