(b) Confidential HIV- and AIDS-related information shall be received by, made available to, or retained only by the following and only to the extent necessary to carry out the express functions, powers and duties of the commission:

1. (1) members of the commission or, as set forth in a written authorization specifically issued for the purpose, their designees;
2. (2) counsel to the commission or, as necessary to carry out the express functions, powers and duties of the commission, assistant counsels to the commission;
3. (3) members of the medical review board and commission staff acting on behalf of such board as necessary in order to carry out the express functions, powers and duties of the board; and

4. (4) members of the citizens' policy and complaint review council and commission staff acting on behalf of such council as necessary in order to carry out the express functions, powers and duties of the council.

   (c) Redisclosure by the commission.

5. (1) All written disclosures of confidential HIV information must be accompanied by a statement prohibiting redisclosure. The statement shall include the following language or substantially similar language: “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure. Disclosure of confidential HIV information that occurs as the result of a general authorization for the release of medical or other information will be a violation of the State law and may result in a fine or jail sentence or both.”
6. (2) If oral disclosures are necessary, they must be accompanied or followed as soon as possible, but no later than 10 days, by the statement required by paragraph (1) of this subdivision.
7. (3) The statement required by paragraphs (1) and (2) of this subdivision is not required for release to the protected person or to his or her legal representative, for releases made by a physician or public health officer to a contact, or for releases made by a physician to a person authorized pursuant to law to consent to the health care of the protected person when the person has been counselled and the disclosure is medically necessary pursuant to Public Health Law, section 2782(4)(e). For disclosures of confidential HIV-related information from the patient's medical record to persons who are permitted access to the information pursuant to section 7064.8(a)(3), (4), (6), (7), (9) and (10) and (e) and (f) of this Title, it shall be sufficient for the statement required by paragraphs (1) and (2) of this subdivision to appear in the medical record itself.