N.Y. Comp. Codes R. & Regs. tit. 9, § 6660.11 – Disclosure.

(a) Except as otherwise provided in this Part, no identifying information of any resident or complainant may be disclosed, unless the resident, complainant, or the resident representative communicates informed consent or the disclosure is required by court order.
(b) Except as otherwise provided in this Part, an ombudsman may not disclose information regarding a complaint to another agency in order for such agency to substantiate the facts for regulatory, protective services, law enforcement, or other purposes unless the goals of a resident or resident representative are for regulatory, protective services or law enforcement action, and the ombudsman determines that the resident or resident representative has communicated informed consent. The ombudsman must assist the resident or resident representative in contacting the appropriate agency and/ or disclose the information for which the resident has provided consent to the appropriate agency for such purposes.
(c) In order to comply with the wishes of the resident, (or, in the case where the resident is unable to communicate informed consent, the wishes of the resident representative), the ombudsman shall not report suspected abuse, neglect or exploitation of a resident when a resident or resident representative has not communicated informed consent to such report except as set forth in this section.
(d) For purposes of subdivisions (a) through (c) of this section, communication of informed consent may be made in writing, including through the use of auxiliary aids and services. Alternatively, communication may be made orally or visually, including through the use of auxiliary aids and services, and such consent must be documented contemporaneously by the ombudsman.
(e) If a resident is unable to communicate informed consent, an ombudsman may refer the matter and disclose resident-identifying information to the appropriate agency or agencies for regulatory oversight; protective services; access to administrative, legal, or other remedies; and/or law enforcement action, if:
1. (1) the resident has no resident representative or the ombudsman determines that the resident representative is not acting in the best interest of the resident;
2. (2) the ombudsman has reasonable cause to believe that an action, inaction or decision may adversely affect the health, safety, welfare, or rights of the resident;
3. (3) the ombudsman has no evidence indicating that the resident would not wish a referral to be made;
4. (4) the ombudsman has reasonable cause to believe that it is in the best interest of the resident to make a referral; and
5. (5) the ombudsman obtains the approval of the State ombudsman.
(f) If an ombudsman personally witnesses suspected abuse, gross neglect, or exploitation of a resident, the ombudsman shall seek communication of informed consent from such resident to disclose resident-identifying information to appropriate agencies.
1. (1) Where such resident is able to communicate informed consent, or has a resident representative available to provide informed consent, the ombudsman shall follow the direction of the resident or resident representative.
2. (2) Where the resident is unable to communicate informed consent, and has no resident representative available to provide informed consent, the ombudsman shall open a case with the ombudsman as the complainant, follow the ombudsman program’s complaint resolution procedures, and shall refer the matter and disclose identifying information of the resident to the management of the facility in which the resident resides and/or to the appropriate agency or agencies for substantiation of abuse, gross neglect, or exploitation in the following circumstances:
  1. (i) the ombudsman has no evidence indicating that the resident would not wish a referral to be made;
  2. (ii) the ombudsman has reasonable cause to believe that disclosure would be in the best interest of the resident; and
  3. (iii) the ombudsman obtains the approval of the State ombudsman.
(g) Where State ombudsman approval is needed for the disclosure of a resident’s identifying information, the State ombudsman will approve or disapprove such a disclosure within five business days of the date of the request.
(h) Even with consent for disclosure, except pursuant to court order, an ombudsman shall not disclose to any person outside of the ombudsman program any information obtained from a resident’s personal or medical records to which the resident would not otherwise have had the right of access. This restriction shall not prevent an ombudsman from advising a resident of the status or progress of an investigation or from referring such complaint to any agency which licenses, investigates or regulates the facility in which the patient or resident resides or has resided in accordance with the disclosure procedures enumerated in this section.
(i) Any individual, when acting in his or her official capacity as an ombudsman, shall be exempt from the mandatory reporting of abuse, neglect, exploitation, or maltreatment, notwithstanding any law to the contrary. However, an ombudsman may report abuse, neglect, exploitation, or maltreatment in accordance the Older Americans Act of 1965, as amended and the regulations promulgated thereunder as well as rules and regulations found in this Part.