N.Y. Comp. Codes R. & Regs. tit. 9, § 7064.8 – Confidentiality and disclosure.

(a) No person who obtains confidential HIV-related information in the course of providing any health or social service or pursuant to a release of confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:
1. (1) the protected individual or, when the protected individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual;
2. (2) any person to whom disclosure is authorized pursuant to a release of confidential HIV-related information in accordance with section 7064.7(a) of this Part;
3. (3) any agent or employee of a health facility or health care provider if:
  1. (i) the agent or employee is authorized to access medical records;
  2. (ii) the health facility or health care provider itself is authorized to obtain the HIV-related information; and
  3. (iii) the agent or employee provides health care to the protected individual, or maintains or processes medical records for billing or reimbursement.
4. (4) a health care provider or health facility, including a health care provider employed or health facility operated by the Department of Corrections and Community Supervision, when knowledge of the HIV-related information is necessary to provide appropriate care or treatment to the protected individual or a child of the individual;
5. (5) a health facility or health care provider, in relation to the procurement, processing, distributing or use of a human body or a human body part, including organs, tissues, eyes, bones, arteries, blood, semen, or other body fluids, for use in medical education, research, therapy, or for transplantation to individuals;
6. (6) health facility staff committees, or accreditation or oversight review organizations authorized to access medical records, provided that such committees or organizations may only disclose confidential HIV-related information:
  1. (i) back to the facility or provider of a health or social service;
  2. (ii) to carry out the monitoring, evaluation, or service review for which it was obtained; or
  3. (iii) to a Federal, State or local government agency for the purposes of and subject to the conditions provided in subdivision (e) of this section;
7. (7) a Federal, State, county or local health officer when such disclosure is mandated by Federal or State law;
8. (8) authorized agencies as defined by section 371(10) of the Social Services Law, and corporations incorporated or organized to receive children for adoption or foster care, in connection with foster care or adoption of a child. Such agency shall be authorized to redisclose such information only pursuant to the provisions of article 27-F of the Public Health Law or in accordance with the provisions of section 373-A of the Social Services Law;
9. (9) third-party reimbursers or their agents to the extent necessary to reimburse health care providers, including health facilities, for health services, provided that an otherwise appropriate authorization for such disclosure has been secured;
10. (10) an insurance institution, for other than the purpose set forth in paragraph (9) of this subdivision, provided the insurance institution secures a dated and written authorization that indicates that health care providers, health facilities, insurance institutions, and other persons are authorized to disclose information about the protected individual, the nature of the information to be disclosed, the purposes for which the information is to be disclosed and which is signed by:
  1. (i) the protected individual;
  2. (ii) if the protected individual lacks the capacity to consent, such other person authorized pursuant to law to consent for such individual; or
  3. (iii) if the protected individual is deceased, the beneficiary or claimant for benefits under an insurance policy, a health services plan, or an employee welfare benefit plan as authorized in article 27-F of the Public Health Law;
11. (11) to a funeral director upon taking charge of the remains of a deceased person when such funeral director has access in the ordinary course of business to HIV-related information on the death certificate of the deceased individual as authorized by Public Health Law section 4142;
12. (12) any person to whom disclosure is ordered by a court of competent jurisdiction pursuant to section 2785 of the Public Health Law;
13. (13) an employee or agent of the Division of Parole, Division of Probation and Correctional Alternatives or local probation department, or Commission of Correction, to the extent the employee or agent is authorized to access records containing such information in order to carry out his or her agency's functions, powers, and duties with respect to the protected individual, pursuant to each agency's regulations promulgated in accordance with article 27-F of the Public Health Law;
14. (14) a medical director of a local correctional facility in accordance with the policies and procedures of the correctional facility; and
15. (15) an employee or agent of a provider of health or social services, including but not limited to the Department of Corrections and Community Supervision and local correctional facilities, when reasonably necessary to provide supervision, monitoring or administration of services and when these employees or agents have access in the ordinary course of business to records relating to the care, treatment, or provision of a health or social service, and in accordance with such provider's regulations promulgated in accordance with article 27-F of the Public Health Law. Disclosure to an employee or agent of a local correctional facility pursuant to this paragraph shall be consistent with section 601 of the Correction Law and Part 7033 of this Title and shall be authorized only when such disclosure is necessary to:
  1. (i) enable the chief administrative officer to appropriately maintain custody and supervision of the protected person or provide for the safety and protection of the protected person or provide for the safety and protection of staff, other inmates, or the facility; and
  2. (ii) the medical director reasonably believes that without disclosure circumstances will exist creating a significant risk of contracting or transmitting HIV infection.
(b) A State, county or local health officer may disclose confidential HIV-related information when:
1. (1) disclosure is specifically authorized or required by Federal or State law; or
2. (2) disclosure is made pursuant to a release of confidential HIV-related information; or
3. (3) disclosure is requested by a physician pursuant to subdivision (e) of this section; or
4. (4) disclosure is authorized by court order pursuant to the provisions of section 2785 of the Public Health Law.
(c) A physician may disclose the confidential HIV-related information during contact notification pursuant to section 7064.10 of this Part.
(d) A physician may, upon the consent of a parent or guardian, disclose confidential HIV-related information to a State, county, or local health officer for the purpose of reviewing the medical history of a child to determine the fitness of the child to attend school.
(e) Confidential HIV-related information may be disclosed to a governmental agency or to authorized employees or agents of a governmental agency pursuant to the regulations of the governmental agency when the person providing health services is regulated by the governmental agency or when the governmental agency supervises or administers the health program or a social service program and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for supervision, monitoring, administration or provision of services. Such authorized employees or agency may include attorneys authorized by a government agency when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services.
(f) Confidential HIV-related information may be disclosed to authorized employees or agents of a person providing health or social services when such person is either regulated by a governmental agency or when a governmental agency administers the health or social service program, and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for supervision, monitoring, administration or provision of services and when such employee or agent has been authorized by law. Such authorized employees or agents may include attorneys authorized by persons providing health services when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services.
(g) A physician may disclose confidential HIV-related information pertaining to a protected individual to a person, known to the physician, authorized pursuant to law to consent to the health care for a protected individual when the physician reasonably believes that:
1. (1) disclosure is medically necessary in order to provide timely care and treatment for the protected individual; and
2. (2) after appropriate counseling as to the need for such disclosure the protected individual will not inform a person authorized by law to consent to health care; provided, however, that the physician shall not make such disclosure if, in the judgment of the physician:
  1. (i) the disclosure would not be in the best interest of the protected individual; or
  2. (ii) the protected individual is authorized pursuant to law to consent to such care and treatment.
3. (3) A physician's decision to disclose pursuant to this paragraph, and the basis for that decision, shall be recorded in the medical record.
(h) Nothing in this section shall limit a person's or agency's responsibility or authority to report, investigate, or redisclose, child protective and adult protective services information in accordance with title 6 of article 6 and titles 1 and 2 of article 9-B of the Social Services Law, or to provide or monitor the provision of child and adult protective or preventive services.
(i) Confidential HIV-related information shall not be disclosed to a health care provider or health care facility if the sole purpose of disclosure is infection control when such provider or facility is regulated under Public Health Law and required to implement infection control procedures pursuant to Department of Health regulation.
(j) Confidential HIV-related information shall not be disclosed to a health care provider or health care facility if the sole purpose of disclosure is infection control precautions when such provider or facility is regulated under Public Health Law and required to implement such precautions pursuant to Department of Health regulation. This restriction shall not limit access to HIV-related information by a health care provider's infection control personnel for purposes of fulfilling their designated responsibilities.
(k) Confidential HIV-related information disclosed pursuant to this subdivision shall be securely packaged and shall contain the redisclosure statement required by section 7064.7(b) of this Part.