N.Y. Comp. Codes R. & Regs. tit. 7, § 7.7 – Contact notification.

(a) A physician employed by the department or rendering professional services at the request of the department or facility of the department may disclose HIV-related information, without the protected person's consent, to a contact or to a public health officer when:
1. (1) the physician reasonably believes disclosure is medically appropriate and a significant risk of infection exists; and
2. (2) the protected person has been counseled to notify his/her contacts and the physician reasonably believes the protected person will not inform the contacts.
(b) The physician must inform the protected person of the physician's intent to disclose and the physician must comply with the protected person's choice of whether the physician or a public health officer will attempt to notify the contact. All notifications shall be in person except where circumstances reasonably prevent doing so.
(c) The identity of the protected person shall not be disclosed to the contact.
(d) When a public health officer is requested to notify contacts, the officer shall meet, when possible, with the protected party to counsel and verify information prior to any notification of such person's contacts.
(e) The person notifying the contact shall provide or make referrals for the provision of appropriate medical advice and counseling for coping with the emotional consequences of learning the information and for changing behavior to prevent transmission or contraction of HIV infection.
(f) If a protected person dies and the physician reasonably believes the protected person had not informed his/her contacts and reasonably believes disclosure is medically appropriate and that a significant risk of infection exists, the physician may notify the contact or request the public health officer to notify the contact. All such notifications shall be in person, except where circumstances reasonably prevent doing so and the identity of the deceased shall not be disclosed.
(g) A physician shall have no obligation to identify, locate or notify any contact.