N.Y. Comp. Codes R. & Regs. tit. 18, § 491.19 – Records and reports.

(a) Operators of shelters for adults, small-capacity shelters and shelters for adult families shall collect and maintain such information, records or reports as determined by the office to be necessary.
(b) Operators of shelters for adults, small-capacity shelters and shelters for adult families shall supply and provide access to such information and records in such form and at such times as the office shall determine.
(c) No substitute for office forms may be made without prior written approval of the office.
(d) The office may request from any other State or local agency including, but not limited to, the office of Children and Family Services, the office of Mental Health, and the Department of Health, and such other State or local agency shall furnish, such information as the office may require for the proper performance of its duties.
(e) Other State offices or agencies may request such information as that office or agency may require for the proper discharge of its duties. Such offices and agencies shall safeguard the confidentiality of such information, records and reports in the same manner as the office.
1. (1) Officers or employees of the office shall maintain the confidentiality of facts and information obtained as the result of any inspection or investigation of a facility.
2. (2) Operators must maintain the confidentiality of facts and information obtained and retained as part of individual resident records. No facts and information retained as part of individual resident records may be released to anyone other than the resident, the next of kin or authorized representatives of the resident, or an employee or designee of the office without the written permission of the resident, provided that confidential HIV-related information concerning residents must be maintained in accordance with section 491.20 of this Part.
3. (3) Operators must maintain confidential HIV-related information concerning employees, volunteers, applicants for employment and prospective residents in accordance with section 491.20 of this Part.
  (g) Resident records.
4. (1) Resident records shall be maintained in a manner which assures resident privacy and accessibility to staff to use in the provision of routine and emergency services.
5. (2) The operator shall maintain personal data which includes resident identification and identification of next of kin or representative, if known.
6. (3) The operator shall maintain documentation of the status of any resident’s accounts and of valuables held in custody for the resident.
  (h) Facility records.
7. (1) The operating certificate issued by the office pursuant to section 491.4 of this Part must be conspicuously posted in a publicly accessible area within the facility, and the operational plan approved by the office must be maintained at the facility and made available for review and inspection by facility residents and visitors.
8. (2) The operator shall maintain complete, accurate and current records which document operation and maintenance of the facility in accord with applicable laws, regulations, and codes.
9. (3) These records shall be maintained in the facility, unless written authorization is given by the office for record retention in another location, and shall be available for review and inspection by office staff and designees.
10. (4) At a minimum, the operator shall maintain:
  1. (i) resident records as required in subdivision (g) of this section;
  2. (ii) resident records required elsewhere in these regulations, including daily census reports and incident reports;
  3. (iii) program records, including service procedures, agreements with external service providers, emergency plans and records of evacuation drills;
  4. (iv) records of maintenance of the physical plant and environmental standards;
  5. (v) staff records, including personnel procedures, job descriptions for the administrator and resident services staff, current staffing schedules and payment records; and
  6. (vi) certificates or reports issued by local and other State jurisdictions related to the facility operations. Such certificates shall be posted if required; otherwise, such certificates or reports shall be kept on file and readily accessible for office review.
    (i) Forms.
    Records that must be retained by the operator of a shelter for adults, a small-capacity shelters or a shelter for adult families, and records that must be submitted by the operator of such a facility to the office, shall be maintained on forms and in a manner prescribed by the office.
(f) Confidentiality.