N.Y. Comp. Codes R. & Regs. tit. 18, § 900.20 – Confidentiality of HIV- and AIDS-related information.

(a) An operator or employee of a shelter for families must not require that an applicant for employment, volunteer, prospective resident, resident or employee be tested for HIV.
(b) An operator or employee of a shelter for families must not require an applicant for employment, volunteer, prospective resident, resident or employee to disclose confidential HIV-related information.
(c) Confidential HIV-related information means any information, in the possession of a person who provides one or more health or social services or who obtains the information pursuant to a release of confidential HIV-related information, concerning whether an individual has been the subject of an HIV-related test, or has HIV infection, HIV-related illness or AIDS, or information which identifies or reasonably could identify an individual as having one or more of such conditions, including information pertaining to such individual's contacts. The terms HIV-related test, HIV infection, HIV-related illness and AIDS are defined in section 360-8.1 of this Title.
(d) The HIV status of an applicant for employment, prospective resident, resident, volunteer or employee cannot be used as the sole basis to deny admission, retention or employability.
(e) Confidential HIV-related information may be disclosed by an operator, employee or volunteer only in accordance with the procedures set forth in this section and only as necessary to provide appropriate services to a resident.
1. (1) The operator of a shelter for families must maintain the confidentiality of individual resident records, and not release information in a resident record to anyone other than the resident, next of kin or authorized representative of the resident, an employee or designee of the office or employees of the facility providing social services without the resident’s written permission, provided that confidential HIV-related information concerning residents must be maintained in accordance with this section.
2. (2) The operator of a shelter for families must maintain confidential HIV-related information concerning employees, volunteers, applicants for employment and prospective residents in accordance with this section.
(f)
(g) An operator, volunteer or employee of a shelter for families who obtains confidential HIV-related information concerning any prospective resident, resident, applicant for employment, employee or volunteer may disclose that information to a health care provider or health facility when knowledge of the confidential HIV-related information is necessary to provide appropriate care or treatment to the protected individual. Except as specified in subdivision (k) of this section, in all other circumstances, an operator, volunteer, or employee who obtains confidential HIV-related information concerning any applicant for employment, prospective resident, resident, employee or volunteer must not disclose that information without specific written authorization to release that information from:
1. (1) the protected individual; or
2. (2) a person authorized by law to consent to health care for the individual.
(h) The authorization to release HIV-related information must:
1. (1) be dated;
2. (2) specify to whom disclosure is authorized;
3. (3) specify the purpose for the disclosure;
4. (4) specify the time period during which the release is effective;
5. (5) specify that the information to be disclosed is confidential HIV-related information; and
6. (6) be signed by the protected individual or, if the individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual.
(i) A general authorization for the release of medical or other information cannot be used as an authorization to release confidential HIV-related information.
(j) Whenever an operator, volunteer or employee of a shelter for families discloses confidential HIV-related information, that person must:
1. (1) enter a dated and signed notation of disclosure of confidential HIV-related information in the protected individual's record; and
2. (2) within 10 days of the date of disclosure, when disclosure is oral, or simultaneously, when disclosure is written, give a written statement to the person to whom the confidential HIV-related information is disclosed which states:
  This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure.
(k) Notwithstanding the requirements of this section, an operator of a shelter for families or an employee or volunteer of such a facility is obligated to release confidential HIV-related information to authorized employees or agents of the office or a social services district when such information is reasonably necessary to supervise, monitor, or administer the facility and such employee or agent of the office or a social services district would, in the ordinary course of business have access to such records. Authorized employees and agents of the office or a social services district may obtain confidential HIV-related information under this subdivision even though the facility does not obtain the release specified in subdivision (h) of this section. In addition, when information is released under this section by a shelter for families, the facility is not required to give the statement specified in subdivision (j) of this section to the employees or agents of the office nor is the facility required to indicate in any resident’s record that the information was released.