N.Y. Comp. Codes R. & Regs. tit. 7, § 7.8 – Records control.

(a) The Deputy Commissioner/Director of Correctional Medical Standards shall develop and implement policies and procedures for persons authorized to obtain confidential HIV-related information pursuant to section 7.5(b)(3) through (8) inclusive of this Part to ensure that records are maintained securely, including records which are electronically stored, and used for the purpose intended.
(b) The Deputy Commissioner/Director of Correctional Medical Standards shall develop and implement procedures for handling requests by other parties for confidential HIV-related information.
(c) No employee or agent of the department who has access to confidential HIV-related information shall disclose such information to any other person unless such person also has access to confidential HIV-related information as described in section 7.5(b) of this Part.
(d) Each employee who is given authorized access to the health records of an identified person that includes confidential HIV-related information shall:
1. (1) be advised in writing by the supervisor that the employee shall not:
  1. (i) examine documents or computer data containing such HIV-related information unless required to do so in the course of his/her official duties and responsibilities;
  2. (ii) remove or copy any such documents or computer data unless he or she is acting within the scope of his or her assigned duties;
  3. (iii) discuss the content of any such documents or computer data with any person unless that person is authorized to have access to such documents or data.