N.Y. Comp. Codes R. & Regs. tit. 9, § 367.5 – Confidentiality and disclosure.

(a) No person who obtains confidential HIV-related information in the course of providing probation services or pursuant to a release of confidential HIV-related information while providing such services may disclose or be compelled to disclose such information, except to the following:
1. (1) the protected individual or, when the protected individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual;
2. (2) any person to whom disclosure is authorized pursuant to a release of confidential HIV-related information in accordance with section 367.4(a) of this Part;
3. (3) authorized counseling or treatment programs providing contractual services to the probation department, when knowledge of the HIV-related information is necessary to provide appropriate treatment to the protected individual. Such agencies shall be authorized to redisclose such information only pursuant to the provisions of article 27-F of the Public Health Law;
4. (4) authorized agencies as defined by Social Services Law (section 371) and corporations that are incorporated or organized to receive children for adoption or foster care, in connection with foster care or adoption of a child. Such agencies shall be authorized to redisclose such information only pursuant to the provisions of article 27-F of the Public Health Law or in accordance with the provisions of section 373-A of the Social Services Law;
5. (5) any person to whom disclosure is ordered by a court of competent jurisdiction pursuant to article 27-F, section 2785 of the Public Health Law;
6. (6) an employee or agent of the Division of Parole, or Commission of Correction, authorized by law to access records to carry out functions, powers and duties with respect to the protected individual, in accordance with regulations promulgated by these agencies;
7. (7) a medical director of a local correctional facility in accordance with regulations promulgated by the Commission of Correction to the extent such individual is authorized to access records containing such information in order to carry out functions, powers, and duties with respect to the individual. Redisclosure by the medical director is prohibited except as permitted under Public Health Law, article 27-F and its implementing regulations; and
8. (8) any other persons specifically authorized in article 27-F, section 2782 of the Public Health Law.
(b) Confidential HIV-related information may be disclosed to probation department employees when such employees have access to records in the ordinary course of business and such information is reasonably necessary for supervision, monitoring, administration, or provision of other probation services. This subdivision permits disclosure to probation department employees in intrastate or interstate transfers of probation supervision for these specified purposes.
(c) Confidential HIV-related information may be disclosed to employees of the Division of Probation and Correctional Alternatives when such employees have access to records as a result of performing activities enumerated in section 367.11(a) of this Part.
(d) No person to whom confidential HIV-related information has been disclosed shall disclose the information to another person except as authorized by this Part, provided, however, that the provisions of this Part shall not apply to the protected individual or to a natural person who is authorized pursuant to law to consent to health care for the protected individual.
(e) Confidential HIV-related information shall not be released pursuant to a subpoena. A court order pursuant to Public Health Law, article 27-F section 2785 is required.
(f) Confidential HIV-related information shall not be disclosable pursuant to Public Officers Law, article 6, The Freedom of Information Law. Prior to disclosing confidential HIV-related information, supervisory consultation should be made to ensure access is authorized.