(b) No person who obtains confidential HIV-related information in the course of providing any health or social service or pursuant to a release of confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:

1. (1) the protected individual or, when the protected individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual;
2. (2) any person to whom disclosure is authorized pursuant to a release of confidential HIV-related information in accordance with the regulations of the Department of Health set forth at 10 NYCRR section 63.4(a);

3. (3) an agent or employee of a health facility or health care provider if:

   1. (i) the agent or employee is authorized to access medical records;
   2. (ii) the health facility or health care provider itself is authorized to obtain the HIV-related information; and
   3. (iii) the agent or employee provides health care to the protected individual, or maintains or processes medical records for billing or reimbursement;
4. (4) a health care provider or health facility when knowledge of the HIV-related information is necessary to provide appropriate care or treatment to the protected youth or a child of the youth;
5. (5) a health facility or health care provider, in relation to the procurement, processing, distributing or use of a human body or a human body part, including organs, tissues, eyes, bones, arteries, blood, semen, or other body fluids, for use in medical education, research, therapy, or for transplantation to individuals;

6. (6) health facility staff committees, or accreditation or oversight review organizations authorized to access medical records, provided that such committees or organizations may only disclose confidential HIV-related information:

   1. (i) back to the facility or provider of a health or social services;
   2. (ii) to carry out the monitoring, evaluation, or service review for which it was obtained; or
   3. (iii) to a Federal, State or local government agency for the purposes of and subject to the conditions provided in paragraph (19) of this subdivision;
7. (7) a Federal, State, county or local health officer when such disclosure is mandated by Federal or State law;
8. (8) authorized agencies as defined by Social Services Law, section 371 and corporations incorporated or organized to receive youth for adoption or foster care, in connection with foster care or adoption of a youth. Such agency shall be authorized to redisclose such information only pursuant to the provisions of article 27-F of the Public Health Law or in accordance with the provisions of section 373-A of the Social Services Law;
9. (9) third-party reimbursers or their agents to the extent necessary to reimburse health care providers, including health facilities, for health services, provided that, where necessary, an otherwise appropriate authorization for such disclosure has been secured by the provider;

10. (10) an insurance institution, for other than the purpose set forth in paragraph (9) of this subdivision, provided the insurance institution secures a dated and written authorization that indicates that health care providers, health facilities, insurance institutions, and other persons are authorized to disclose information about the protected individual, the nature of the information to be disclosed, the purposes for which the information is to be disclosed and which is signed by:

    1. (i) the protected individual;
    2. (ii) if the protected individual lacks the capacity to consent, such other person authorized pursuant to law to consent for such individual; or
    3. (iii) if the protected individual is deceased, the beneficiary or claimant for benefits under an insurance policy, a health services plan, or an employee welfare benefit plan as authorized in article 27-F of the Public Health Law;
11. (11) any person to whom disclosure is ordered by a court of competent jurisdiction pursuant to section 2785 of the Public Health Law;
12. (12) an employee or agent of the Division of Parole, Division of Probation and Correctional Alternatives, or Commission of Correction, in accordance with regulations promulgated by those agencies;
13. (13) a medical director of a local correctional facility in accordance with regulations promulgated by the facility operator. Redisclosure by the medical director is prohibited except as permitted under Public Health Law, article 27-F and its implementing regulations;
14. (14) a physician may disclose the confidential HIV-related information during contact notification pursuant to Public Health Law, article 27-F;
15. (15) a physician may, upon the informed consent of a youth or, if the youth lacks the capacity to consent, other person qualified to give consent on behalf of the youth, disclose confidential HIV-related information to a State, county, or local health officer for the purpose of reviewing the medical history of a youth to determine the fitness of the youth to attend school;
16. (16) confidential HIV-related information may be disclosed to a governmental agency or to authorized employees or agents of a governmental agency when the person providing health services is regulated by the governmental agency or when the governmental agency administers a health or social services program and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for supervision, monitoring, administration or provision of services. Such authorized employees or agents may include attorneys authorized by a government agency when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services;
17. (17) confidential HIV-related information may be disclosed to authorized employees or agents of a person providing health services when such person is either regulated by a governmental agency or when a governmental agency administers a health or social services program, and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for supervision, monitoring, administration or provision of services and when such employee or agent has been authorized by the division pursuant to this Part. Such authorized employees or agents may include attorneys authorized by persons providing health services when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services;
18. (18) no person to whom confidential HIV-related information has been disclosed shall disclose the information to another person except as authorized by this Part; provided, however that the provisions of this Part shall not apply to the protected youth or a natural person who is authorized pursuant to law to consent to health care for the protected individual;
19. (19) nothing in this section shall limit a person's or agency's responsibility or authority to report, investigate, or redisclose, child protective and adult protective services information in accordance with title 6 of article 6 and titles 1 and 2 of article 9-B of the Social Services Law, or to provide or monitor the provision of child and adult protective or preventive services;
20. (20) confidential HIV-related information shall not be disclosed to a health care provider or health care facility if the sole purpose of disclosure is infection control when such provider or facility is regulated under the Public Health Law and required to implement infection control procedures pursuant to Department of Health regulations;
21. (21) confidential HIV information shall not be released pursuant to a subpoena. A court order pursuant to Public Health Law, section 2785 is required;

22. (22) where a youth has obtained personal confidential HIV-related information from an alternate anonymous testing site, sexually transmitted disease clinic or the youth's private physician, the youth may choose not to disclose any information to the division. However, all youth must be informed that disclosing such information confidentially with selected division staff may help him or her to manage the stress associated with HIV infection and also assist in planning for appropriate services in the community upon release. The test results will not be disclosed to any other person unless the youth, or other person authorized to give consent, gives prior written consent, pursuant to section 164.6 of this Part or unless disclosed pursuant to paragraph (23) of this subdivision. Youth must also be informed that once a positive test result is disclosed, it will be shared confidentially with a limited number of people directly involved with the youth's care and planning for care, as set forth below. These people will be limited to the following:

    1. (i) the facility's medical staff caring for the youth (i.e., physician's assistant, nurse, and the supervising physician of the physician's assistant or primary care physician serving the youth where the facility lacks other medical staff);
    2. (ii) the facility director or, as applicable, the youth's foster parents and the division staff responsible for supervision of the youth's foster care case; and
    3. (iii) the director of the division's Bureau of Health and Recreation Services;
23. (23) if, in the judgment of the facility health staff and facility director or, as applicable, the division staff responsible for supervision of the youth's foster care case, the results must be disclosed to additional party(ies), including the youth's parent(s) or guardian(s), the facility director or foster care case supervisor shall consult with the director of the Bureau of Health and Recreation Services. The director of the bureau must concur with the facility director or the division staff responsible for supervision of the youth's foster care case, if the information is to be disclosed to others not approved by the youth. In such cases the criterion used for overriding the youth's objections shall be that further disclosure of the information is critically important for the youth's physical or mental well-being, and that such benefit may not otherwise be obtained. At no time will confidential HIV-related information be disclosed in violation of Public Health Law, article 27-F. Any decision or action taken pursuant to this paragraph and the basis for such decision or action shall be recorded in the youth's medical file;
24. (24) where a youth who has acquired HIV-related information through a division employed physician or physician's assistant or through a physician maintained to serve division youth, either on a contract or fee-for-service basis, the youth must be advised that such information will be disclosed as set forth in paragraphs (22) and (23) of this subdivision; and
25. (25) where such access is necessary in furtherance of the duties of the Division's Office of Counsel, confidential HIV-related information may be disclosed to the Division's Office of Counsel and the New York State Attorney General's office.