Effective June 1, 2005
10 NYCRR

AIDS TESTING AND CONFIDENTIALITY OF HIV-RELATED INFORMATION

[PART 63 OF 10 NYCRR
AIDS TESTING AND CONFIDENTIALITY OF HIV-RELATED INFORMATION:
PDF file size 80 KB]

(a) "HIV-infection" means infection with the human immunodeficiency viruses that are the cause of AIDS or as the term may be defined from time to time by the Centers for Disease Control and Prevention of the United States Public Health Service.

(b) "AIDS" means acquired immune deficiency syndrome, as may be defined from time to time by the Centers for Disease Control and Prevention of the United States Public Health Service.

(c) "HIV-related illness" means any clinical illness that may result from or be associated with HIV infection.

(d) "HIV-related test" means any laboratory test or series of tests for any virus, antibody, antigen or etiologic agent whatsoever, thought to cause or to indicate the presence of HIV infection, HIV-related illness or AIDS.

(e) "Capacity to consent" means an individual's ability, determined without regard to the individual's age, to understand and appreciate the nature and consequences of a proposed health care service, treatment, or procedure, or of a proposed disclosure of confidential HIV-related information, and to make an informed decision concerning the service, treatment, procedure or disclosure.

(f) "Protected individual" means a person who is the subject of an HIV related test or who has been diagnosed as having HIV infection, AIDS or HIV-related illness.

(g) "Confidential HIV-related information" means any information, in the possession of a person who provides health or social services or who obtains the information pursuant to a release of confidential HIV-related information, concerning whether an individual has been the subject of an HIV related test, or has HIV infection, HIV-related illness or AIDS, or information which identifies or reasonably could identify an individual as having one or more of such conditions, including information pertaining to such individual's contacts.

(h) "Health or social service" means any care, treatment, clinical laboratory test, counseling or educational service for adults or children, and acute, chronic, custodial, residential, outpatient, home or other health care; public assistance, including disability payments available pursuant to the Social Security Act; employment-related services, housing services, foster care, shelter, protective services, day care, or preventive services; services for the mentally disabled; probation services; parole services; correctional services; detention and rehabilitative services; and the activities of the Health Care Worker HIV/HBV Advisory Panel (see Public Health Law Article 27-DD), all as defined in section 2780(8) of the Public Health Law.

(i) "Health facility" means a hospital as defined in section 2801 of the Public Health Law, blood bank, organ procurement organization, tissue bank, clinical laboratory, or facility providing care or treatment to persons with a mental disability.

(j) "Health care provider" or "provider" means any physician, nurse, licensed or certified provider of diagnostic medical services, including a nurse practitioner, a midwife and physician assistant, provider of services for the mentally disabled or other person involved in providing medical, nursing, counseling, or other health care or mental health service including those associated with, or under contract to, a health maintenance organization or medical services plan. Diagnostic providers include physicians, nurse practitioners, physician assistants and midwives who are authorized to order diagnostic tests and to make clinical diagnoses.

(k) "Contact" means an identified spouse or sex partner of the protected individual or a person identified as having shared hypodermic needles or syringes with the protected individual, or a person whom the protected individual may have exposed to HIV under circumstances that present a risk of transmission of HIV, as noted in subdivision (m) of section 63.8 of this Part.

(l) "Contact tracing" shall mean the process of notifying known contacts of protected individuals as reported by the physician or as disclosed by the protected individuals themselves, and of seeking the cooperation of protected individuals to name contacts, as described in section 63.8 of this Part. For the purposes of this Part, the terms "contact notification", "partner notification", "partner assistance" and "partner counseling and referral services" shall be synonymous with "contact tracing". In all cases of contact tracing authorized in this Part, the name or other identifying information regarding the protected person shall not be disclosed to contacts and the name of contacts shall not be disclosed to other contacts.

(m) "Person" includes any natural person, partnership, association, joint venture, trust, public or private corporation or state or local government agency.

(n) "Release of confidential HIV-related information" means a written authorization for disclosure of confidential HIV-related information which is signed by the protected individual, or if the protected individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual. Such release shall be dated and shall specify to whom disclosure is authorized, the purpose for such disclosure and the time period during which the release is to be effective. A general authorization for the release of medical or other information shall not be construed as a release of confidential HIV-related information, unless such authorization specifically indicates its dual purpose as a general authorization and an authorization for the release of confidential HIV- related information and complies with this definition.

(o) "Insurance institution" means any corporation, association, partnership, reciprocal exchange, interinsurer, fraternal benefits society, agent, broker or other entity in the business of providing health, life and disability coverage including, but not limited to, any health maintenance organization, medical service plan, or hospital plan which:

(1) is engaged in the business of insurance;

(2) provides health services coverage plans; or

(3) provides benefits under, administers, or provides services for, an employee welfare benefit as defined in 29 U.S.C. 1002(1).

(p) "Municipal health commissioner" shall mean, for purposes of this Part, a county health commissioner, except, in New York City, the term shall mean the New York City health commissioner. Such county health commissioner and New York City health commissioner shall conduct reporting, counseling and contact notification activities consistent with guidelines acceptable to the commissioner in compliance with Article 21, Title III and Article 27-F of the Public Health Law.

(q) "District health officer" shall mean, for the purposes of this Part, the commissioner or his/her designee.

(r) For the purposes of this Part, "commissioner" shall mean the New York State Commissioner of Health.

(s) For the purposes of this Part, "authorized public health official" shall mean New York State Commissioner of Health, a municipal health commissioner or a district health officer, or their designee.

(a) Except as noted in paragraph (b)(2) below, no physician or other person authorized pursuant to law may order an HIV-related test without first obtaining written informed consent. A physician or other person authorized pursuant to law to order an HIV-related test to be used for patient care shall provide to the laboratory the name and address of the person who is the source of the specimen and other such information as specified by the commissioner.

(1) Informed consent shall include providing pre-test counseling to the person to be tested or, if such person lacks capacity to consent, to the person lawfully authorized to consent to health care for such person. In situations in which a person other than the test subject consents for the test, pre-test counseling shall also be provided to the test subject to the extent that the person responsible for ordering the test deems that the test subject will benefit from counseling. Pretest counseling shall include:

(i) explanations regarding the nature of HIV infection and HIV related illness, an explanation of the HIV-related test, including a description of the procedure to be followed, meaning of the test results, including preliminary positive results obtained prior to confirmation, if applicable, and the benefits of taking the test, including the importance and benefits of early diagnosis and medical intervention;

(ii) an explanation that discrimination problems may result from disclosure of confidential HIV-related information and that legal protections exist which prohibit discrimination (NYC and NYS Human Rights Law) and unauthorized disclosures (PHL Article 27-F and/or Article 21, Title III);

(iii) information on preventing exposure or transmission of HIV infection, including behavior which poses a risk of HIV transmission;

(iv) an explanation that the test is voluntary, that consent may be withdrawn at any time, information on the benefits of testing and or early treatment, information that HIV reporting is required by law and that such information must be kept confidential and will be used for the purposes of epidemiologic monitoring of the HIV/AIDS epidemic, that persons who test positive will be requested to cooperate in contact notification efforts, that known contacts will be reported by the physician or other person authorized to order a diagnostic test to the health department for the purposes of contact notification as needed, and that anonymous testing is available including the location and telephone numbers of anonymous test sites, and that for the purpose of insurance coverage, confidential, as opposed to anonymous testing is required; and

(v) information regarding psychological and emotional consequences of receiving the test result;

(b)(1) Written informed consent must be executed on a form developed by the department or on another form approved specifically by the department. At the time at which informed consent is obtained, the subject must be offered a copy of the informed consent form or a document that provides all pertinent information contained on the informed consent form.

(2) Informed consent is not required in the following situations:

(i) for court-ordered testing pursuant to Civil Practice Law and Rules Section 3121;

(ii) when testing without informed consent is otherwise specifically authorized or required by state or federal law;

(iii) for testing related to procuring, processing, distributing or use of a human body or human body part, including organs, tissues, eyes, bones, arteries, blood, semen or other body fluids for use in medical research or therapy, or for transplantation to persons, provided that if the test results are communicated to the tested person, post-test counseling is required;

(iv) for research if the testing is performed in a manner by which the identity of the test subject is not known and may not be retrieved by the researcher;

(v) for testing of a deceased person to determine cause of death or for epidemiological purposes; and

(vi) for comprehensive newborn testing pursuant to PHL section 2500-f.

(c) A physician or other person authorized pursuant to law to order an HIV-related test shall certify on a laboratory requisition form that informed consent has been obtained, except when not required pursuant to section 63.3(b)(2). In approved anonymous testing sites, authorized employees or agents of the department may order HIV-related tests and certify that they obtained informed consent in approved anonymous testing sites.

(d) In addition to an explanation of the test result, the person who orders the test shall be responsible for ensuring that post-test counseling or referrals as appropriate with respect to a positive, indeterminate/inconclusive, negative test result and preliminary positive results obtained pursuant to Subpart 58-8, if applicable, shall be provided to the person who consented to the test. Blood banks and tissue banks may report results as specified in sections 58-2.23 and 52-3.6, respectively. In situations in which a person other than the test subject consents for the test, post-test counseling and referrals should also be provided to the test subject, to the extent the person responsible for ordering the test deems that the test subject will benefit from counseling. Such post-test counseling and referrals shall include specific referral information and shall address:

(1)(i) coping emotionally with the test results;

(ii) discrimination issues relating to employment, housing, public accommodations, health care and social services;

(iii) information on the ability to release or revoke the release of confidential HIV-related information; and

(iv) information on preventing exposure to or transmission of HIV infection; and

(2) for persons who test positive, post-test counseling shall, in addition, address:

(i) that HIV reporting is required by law for the purposes of epidemiologic monitoring of the HIV/AIDS epidemic;

(ii) that contacts should be notified to prevent transmission, and to allow early access of exposed persons to HIV counseling and testing, health care, and prevention services, and a description of notification options and assistance available to the protected individual;

(iii) an assessment of the risk of domestic violence in conformance with a domestic violence screening protocol developed by the commissioner pursuant to law;

(iv) that known contacts, including a known spouse, will be reported and that protected persons will also be requested to cooperate in contact notification efforts of known contacts and may name additional contacts they wish to have notified with the assistance of the provider or authorized public health officials;

(v) that the protected individual's name or other information about them is not disclosed to any person during the contact notification process;

(vi) information on the availability of medical services and the location and telephone numbers of treatment sites, information on the use of HIV chemotherapeutics for propyhlaxis and treatment and peer group support, access to prevention services and assistance, if needed, in obtaining any of these services; and

(vii) a discussion of perinatal transmission.

(e) Nothing in this Part or Part 58 shall be construed to prohibit a person from directly ordering an HIV test on a specimen taken from his/her own body and directly receiving the results of such HIV test. The test must be performed by a laboratory using a specimen collection kit which has been approved for home HIV specimen collection by the U.S. Food and Drug Administration and which is available without a prescription.

(f) In situations when HIV-related testing is intended to aid in clinical disease monitoring, e.g., HIV nucleic acid (RNA or DNA) detection tests, pre- and post-test counseling may be tailored to the needs of the patient.

(a)(1) All initial determinations or diagnoses of Human Immunodeficiency Virus (HIV) infection, HIV-related illness and Acquired Immune Deficiency Syndrome (AIDS) shall be reported to the commissioner by physicians and other persons authorized to order diagnostic tests or make medical diagnoses or their agents as soon as possible after post-test counseling but no later than 21 days after the provider's receipt of a positive laboratory result or after diagnosis, whichever is sooner.

(2) All determinations or diagnoses of HIV, HIV-related illness and AIDS shall be reported to the commissioner by blood banks as defined in Article 5, Title V of the Public Health Law, by tissue banks and organ procurement organizations as defined by Article 43-B of the Public Health Law as soon as possible after post-test counseling but no later than 21 days after receipt of a confirmed positive laboratory result or after diagnosis, whichever is sooner. Such banks and organizations shall report confirmed positive HIV antibody test results.

(3) Pathologists, coroners and medical examiners or other persons determining from examination of a corpse or from the history of the events leading to death, that at the time of death the individual was apparently affected with HIV infection, HIV-related illness or AIDS shall also make such report to the commissioner within 21 days after receipt of a test result or determination.

(4)(i) Laboratories performing diagnostic tests shall report to the Commissioner cases of initial determinations or diagnoses of HIV infection, HIV-related illness and AIDS on a schedule to be specified by the Commissioner. Laboratories shall report the following: confirmed positive HIV antibody test results, HIV nucleic acid (RNA or DNA) detection test results, all CD4 lymphocyte counts unless the test was known to be performed for reasons other than HIV infection or HIV-related illness, HIV subtype and antiviral drug resistance testing in a format designated by the Commissioner, and the results of other tests as may be determined by the Commissioner to indicate a diagnosis of HIV infection, HIV-related illness or AIDS.

(ii) For the purposes of laboratory reporting, initial diagnosis shall mean the first such test noted in (i) above which is performed on a specimen submitted after the effective date of these regulations.

(b) Reports, including names and addresses of the protected individual, contact information and other information as may be specified by the commissioner, shall be made in a manner and format as prescribed by the commissioner. Information reported shall also include names and addresses, if available, of contacts, including spouses, known to the physician or other person authorized to order diagnostic tests or make medical diagnoses, or provided to them by the protected person, and the date each contact was notified if contact notification has already been done; and information, in relation to each reported contact, required by an approved domestic violence screening protocol. After receiving the report, the commissioner or his/her authorized representative may request the individual making the report or the person who ordered the diagnostic tests to provide additional information as may be required for the epidemiologic investigation, case finding and analysis of HIV infection, HIV-related illness and Acquired Immune Deficiency Syndrome (AIDS) and to implement Article 21, Title III. Notwithstanding this subdivision, test results from New York State approved anonymous test sites shall not be reported to the commissioner unless the test subject chooses to supply identification and convert the anonymous test result to a confidential test result.

(c) Confidentiality. Such reports and additional information maintained by the commissioner or his/her designated representative, including all information generated by contact notification and domestic violence screening activities, shall be kept confidential as required by Public Health Law, Article 21, Title III, and shall not be disclosed except when in the judgment of the public health official, necessary to other authorized public health officials for conducting accurate and complete epidemiological monitoring of the HIV/AIDS epidemic and for conducting contact notification activities, except that contact names and locating information may be disclosed to public health officials in other jurisdictions when necessary to notify the contact; no information about the protected individual will be released to any person in this process.

(a) No confidential HIV-related information, including such information as related to domestic violence screening, shall be disclosed pursuant to a general release except to insurance companies as noted in section 63.6(a)(9). Disclosure is permitted for HIV-related information pursuant to a specific release form for a limited time period which has been developed or approved by the Department. The release must be signed by the protected individual, or if the protected individual lacks capacity to consent, by a person authorized pursuant to law to consent to health care for the individual.

(b) All written disclosures of confidential HIV information must be accompanied by a statement prohibiting redisclosure. The statement shall include the following language or substantially similar language: "This information has been disclosed to you from confidential records which are protected by state law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of state law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not, except in limited circumstances set forth in this part, sufficient authorization for further disclosure. Disclosure of confidential HIV information that occurs as the result of a general authorization for the release of medical or other information will be in violation of the state law and may result in a fine or a jail sentence or both."

(c) If oral disclosures are necessary, they must be accompanied or followed as soon as possible, but no later than 10 days, by the statement required by subdivision (b).

(d) The statement required by subdivisions (b) and (c) is not required for release to the protected person or when a person lacks the capacity to consent, to a person authorized pursuant to law to consent to health care for the person, for releases made by a physician or their agent or public health officer to a contact; or for releases made by a physician or their agent to a person authorized pursuant to law to consent to the health care of the protected person when the person has been counseled and has refused to disclose and the disclosure is medically necessary. For disclosures of confidential HIV-related information from the patient's medical record to persons who are permitted to access this information pursuant to sections 63.6(a)(3), (4), (5), (6), (7), (9) and (10) and 63.6(e) and (f), it shall be sufficient for the statement required by subdivisions (b) and (c) to appear as part of the medical record when a medical record is disclosed.

(a) No person who obtains confidential HIV-related information in the course of providing any health or social service or pursuant to a release of confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:

(1) the protected individual or, when the protected individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual;

(2) any person to whom disclosure is authorized pursuant to a release of confidential HIV-related information in accordance with section 63.5(a);

(3) an agent or employee of a health facility or health care provider if (i) the agent or employee is authorized to access medical records; (ii) the health facility or health care provider itself is authorized to obtain the HIV-related information; and (iii) the agent or employee provides health care to the protected individual, or maintains or processes medical records for billing or reimbursement;

(4)(i) a health care provider or health facility when knowledge of the HIV-related information is necessary to provide appropriate care or treatment to the protected individual or a child of the individual;

(ii) a health care provider or health facility when knowledge of HIV-related information is necessary to provide appropriate care or treatment to a contact, provided the requirements in subdivision (m) of section 63.8 are followed for disclosures involving exposures in risk situations;

(iii) in circumstances when consent for health care is necessary, disclosure may also be made to a person authorized to consent to health care for such contact or for such protected individual, provided that if disclosure is to a person authorized to consent to the health care of a contact or to a contact when such contact has been exposed to HIV under circumstances which present a risk of transmission, the requirements in subdivision (m) of section 63.8 must be followed;

(5) a health facility or health care provider, in relation to the procurement, processing, distributing or use of a human body or a human body part, including organs, tissues, blood, semen, or other body fluids, for use in medical education, research, therapy, or for transplantation to individuals;

(6) health facility staff committees, or accreditation or oversight review organizations authorized to access medical records, provided that such committees or organizations may only disclose confidential HIV-related information:

(i) back to the facility or provider of a health or social service;

(ii) to carry out the monitoring, evaluation, or service review for which it was obtained; or

(iii) to a federal, state or local government agency for the purposes of and subject to the conditions provided in paragraph (e) of this section;

(7) a federal, state, county or local health officer when such disclosure is mandated by federal or state law, including reporting and contact notification processes authorized pursuant to Article 21, Title III, or pursuant to Article 27-F;

(8) authorized agencies as defined by Social Services Law, Section 371 and corporations incorporated or organized to receive children for adoption or foster care, in connection with foster care or adoption of a child. Such agency shall be authorized to redisclose such information only pursuant to the provisions of Article 27-F of the Public Health Law or in accordance with the provisions of Social Services Law Section 373-A and regulations promulgated thereunder;

(9) third party reimbursers or their agents to the extent necessary to reimburse health care providers, including health facilities, for health services, provided that, an otherwise appropriate authorization for such disclosure has been secured;

(10) an insurance institution, for other than the purpose set forth in paragraph (9) of this subdivision, provided the insurance institution secures a dated and written authorization that indicates that health care providers, health facilities, insurance institutions, and other persons are authorized to disclose information about the protected individual, the nature of the information to be disclosed, the purposes for which the information is to be disclosed and which is signed by:

(i) the protected individual;

(ii) if the protected individual lacks the capacity to consent, such other person authorized pursuant to law to consent for such individual; or

(iii) if the protected individual is deceased, the beneficiary or claimant for benefits under an insurance policy, a health services plan, or an employee welfare benefit plan as authorized in Article 27-F of the Public Health Law;

(11) to a funeral director upon taking charge of the remains of a deceased person when such funeral director has access in the ordinary course of business to HIV-related information on the death certificate of the deceased individual, as authorized by Public Health Law Section 4142;

(12) any person to whom disclosure is ordered by a court of competent jurisdiction pursuant to Public Health Law Section 2785;

(13) an employee or agent of the Division of Probation and Correctional Alternatives, Division of Parole, Commission of Correction, or any local probation department, to the extent the employee or agent is authorized to access records containing such information in order to carry out functions, powers and duties with respect to the protected person and in accordance with regulations promulgated pursuant to Public Health Law Article 27-F;

(14) a medical director of a local correctional facility in accordance with regulations promulgated pursuant to Article 27-F to the extent the medical director is authorized to access records to carry out his/her functions relating to the protected person. Redisclosure by the medical director is prohibited except as permitted under Public Health Law Article 27-F, Article 21, Title III and implementing regulations;

(15) an employee or agent of the New York City Board of Corrections so that the board may continue to access records of inmates who die while in the custody of the New York City Department of Corrections when necessary for the board to carry out its duties, functions, and powers with respect to the protected individual, pursuant to the New York City charter; or

(16) a law guardian, appointed to represent a minor pursuant to the social services law or the family court act, for the purpose of representing that minor. If the minor has the capacity to consent, the law guardian may not redisclose confidential HIV related information without the minor's permission. If the minor lacks capacity to consent, the law guardian may redisclose confidential HIV-related information for the purpose of representing the minor.

(b) A state, county or local health officer may disclose confidential HIV-related information when:

(1) disclosure is specifically authorized or required by federal or state law including, but not limited to Public Health Law, Article 21, Title III and Public Health Law, Article 27-F; or

(2) disclosure is made pursuant to a release of confidential HIV related information; or

(3) disclosure of information regarding a contact is requested by a physician pursuant to section 63.8 of this Part; or if the contact resides outside the jurisdiction of the authorized public health official, the official shall inform the public health official in the contact's jurisdiction in order to confidentially inform such contact; or

(4) disclosure is authorized by court order pursuant to the provisions of Public Health Law Section 2785.

(c) A physician or his/her agent may disclose the confidential HIV-related information to a contact and to a public health officer for the purpose of making a disclosure to the contact.

(d) A physician or his/her agent may, upon the consent of a parent or guardian, disclose confidential HIV-related information to a state, county, or local health officer for the purpose of reviewing the medical history of a child to determine the fitness of the child to attend school.

(e) Confidential HIV-related information of a protected person may be disclosed to authorized employees or agents of a governmental agency pursuant to the regulations of the governmental agency when the person providing health or social services is regulated, supervised or monitored by the governmental agency or when the governmental agency administers the health program or a social service program and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for regulation, supervision, monitoring, administration or provision of services. Such authorized employees or agents may include attorneys authorized by a government agency when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services. Such authorized employees or agents may also include public health officers as required for conducting epidemiological or surveillance investigations pursuant to the State Sanitary Code or this Part. Such surveillance or investigational data shall also be disclosed by the public health officer to the State Department of Health as required by the State Sanitary Code or this Part.

(f) Confidential HIV-related information of a protected person may be disclosed to authorized employees or agents of a provider of health or social services when such provider is either regulated, supervised or monitored by a governmental agency or when a governmental agency administers the provider's health or social service program, and when such employees or agents have access to records in the ordinary course of business and when access is reasonably necessary for regulation, supervision, monitoring, administration or provision of services. Such authorized employees or agents may include attorneys authorized by persons providing health services when access occurs in the ordinary course of providing legal services and is reasonably necessary for supervision, monitoring, administration or provision of services.

(g) A physician or his/her agent may disclose confidential HIV-related information pertaining to a protected individual to a person, known to the physician or his/her agent, authorized pursuant to law to consent to the health care for the protected individual when the physician reasonably believes that:

(1) disclosure is medically necessary in order to provide timely care and treatment for the protected individual; and

(2) after appropriate counseling as to the need for such disclosure the protected individual will not inform a person authorized by law to consent to health care; provided, however, that the physician shall not make such disclosure if, in the judgment of the physician:

(i) the disclosure would not be in the best interest of the protected individual; or

(ii) the protected individual is authorized pursuant to law to consent to such care and treatment. A physician's decision to disclose pursuant to this paragraph, and the basis for that decision shall be recorded in the medical record.

(h) No person to whom confidential HIV information has been disclosed shall disclose the information to another person except as authorized by law, (including, but not limited to, disclosure authorized by PHL Article 21, Title III), except that this provision shall not apply to:

(1) the protected individual;

(2) a natural person who is authorized pursuant to law to consent to health care for the protected individual;

(3) a protected individual's foster parent, subject to Department of Social Services regulations, for the purpose of providing care, treatment or supervision to the protected individual; or

(4) a prospective adoptive parent, subject to Department of Social Services regulations, with whom a child has been placed for adoption.

(i) Nothing in this section shall limit a person's or agency's responsibility or authority to report, investigate, or redisclose child protective and adult protective services information in accordance with title six of article six and titles one and two of article nine-b of the Social Services Law, or to provide or monitor the provision of child and adult protective or preventive services.

(j) Confidential HIV-related information shall not be disclosed to a health care provider or health care facility for the sole purpose of implementing infection control precautions when such provider or facility is regulated under the Public Health Law and required to implement such precautions with all individuals pursuant to this Title. This restriction shall not limit access to HIV-related information by a facility's infection control personnel for purposes of fulfilling their designated responsibilities in the facility.

(k) Confidential HIV-related information shall not be released pursuant to a subpoena. A court order pursuant to Public Health Law section 2785 is required for release of confidential HIV-related information.

(l) Confidential HIV related information shall be disclosed upon the request of the Health Care Worker HIV/HBV Advisory Panel (see Public Health Law Article 27-DD) to the Panel or its designee(s) only when the Panel considers the information reasonably necessary for the evaluation and monitoring of a worker who has voluntarily sought the Panel's review.

(a) Confidential HIV-related information shall be recorded in the medical record such that it is readily accessible to provide proper care and treatment.

(b) All disclosures of confidential HIV-related information must be noted in the record, except:

(1) only initial disclosures to insurance institutions must be noted;

(2) notation is not required for disclosure to agents or employees of health facilities or health care providers authorized under section 63.6(a)(3);

(3) notation is not required for persons engaged in quality assurance, program monitoring or evaluation, nor for governmental payment agents acting pursuant to contract or law.

(c) Confidential HIV-related information shall be noted, as appropriate, in a certificate of death, autopsy report or related documents prepared pursuant to Public Health Law, Article 41 or other laws relating to documentation of cause of death.

(d) The protected person shall be informed of disclosures of HIV information upon request of the protected person.

(e) Confidential HIV-related information shall not be disclosable pursuant to Public Officers Law, Article 6 (the Freedom of Information Law).

(a) When contact notification is conducted based on the mandated reporting of cases of HIV infection, HIV-related illness and AIDS and the reporting of known contacts of such cases, and/or provided by the protected individual, all information collected in the course of these contact notification activities, including screening to assess risk of domestic violence, shall be kept confidential as required by Public Health Law, Article 21, Title III, and shall not be disclosed except when in the judgment of the public health official necessary to other authorized public health officials for conducting accurate and complete epidemiological monitoring of the HIV/AIDS epidemic and for conducting contact notification activities except that contact names and locating information may be disclosed to public health officials in other jurisdictions when necessary to notify the contact; no information about the protected individual will be released to any person in this process. Disclosures and notifications shall be made as follows:

(1) Physicians and other persons required to report as provided for in section 63.4 must indicate on the reporting form whether they have conducted post-test counseling and an assessment of the risk of domestic violence in conformance with a domestic violence screening protocol developed by the commissioner, whether they plan to undertake contact notification activities, have completed notification of contacts or are making a referral for partner notification assistance to authorized public health officials. If the physician or other mandated reporter chooses to conduct notification, the results of those activities, including information specified by the commissioner on forms supplied by the commissioner, or their equivalent, must be forwarded to the appropriate authorized public health official within 60 days of the initial report, pursuant to section 63.4.

(2) The commissioner shall forward initial reports from physicians and other mandated reporters, including the names and addresses of the reported case and of the known contacts, and/or contacts provided by the protected person, the status of provider initiated contact notification activities and the determination of risk of domestic violence, if any, to the authorized public health official in the county where the reported case resides.

(3) Consistent with guidelines acceptable to the commissioner in conformance with Article 21 of the Public Health Law, authorized public health officials, upon determination that the reported case, reported contacts, or any other case merits contact notification in order to protect the public health, shall make a good faith effort to seek the cooperation of the protected individual to name contacts they wish to have notified, to notify the known contacts and to inform the public health official in the jurisdiction where any additional contacts reside, when necessary to notify such contacts. No information about the protected individual will be released to any person in this process.

(b) Authorized public health officials shall consider the following as important factors in determining the priority for which cases merit contact notification in order to protect the public health:

(1) reported contacts, including spouses known to the reporting physician or other diagnostic provider, or who the protected person wishes to have notified, unless the provider certifies that these known contacts have already been notified; and

(2) protected persons who are newly diagnosed with HIV infection.

(c) In cases which merit contact notification, if an indication of risk of domestic violence has been identified, pursuant to a protocol acceptable to the commissioner, the authorized public health official, in consultation with the reporting physician, must be satisfied in his/her professional judgment that reasonable arrangements, efforts or referrals to address the safety of affected persons have been made if and when the notification is to proceed. Such consultation shall also consider information, if available, requested from the protected person, or from a domestic violence service provider pursuant to a signed release.

(d) Authorized public health officials shall conduct contact notification activities consistent with guidelines acceptable to the commissioner which will recognize the special needs of adolescents, individuals in residential and institutional settings, and other vulnerable populations.

(e) Authorized public health officials will respond to all requests from HIV infected individuals and their health care providers for assistance in notifying contacts.

(f) When contact notification is conducted by authorized public health officials, such officials shall:

(1) confirm that post-test counseling of the protected person is completed;

(2) when communication with the protected person is necessary, communicate with the protected person in a confidential, private and safe manner to seek cooperation in contact notification activities, to verify the information about the identity or location of known contacts, to conduct or confirm a screen for domestic violence and if applicable, to make referrals regarding domestic violence, prior to any notification of contacts. If communication cannot be made in a confidential, private and safe manner, it shall be deferred until these requirements can be met; and

(3) in circumstances where the protected individual cannot be contacted for post-test counseling or declines to be assessed for risk of domestic violence in relation to known contacts, the authorized public health official shall make the determination of whether to proceed with notification of known contacts, in consultation with the reporting physician.

(g) All persons notifying contacts shall provide counseling or make referrals or appointments for counseling and testing as appropriate. Such counseling must address coping emotionally with potential exposure to HIV, domestic violence issues, an explanation regarding the nature of HIV infection and HIV-related illness, availability of anonymous and confidential testing, information on preventing exposure or transmission of HIV infection, information regarding discrimination problems that might occur as a result of disclosure of HIV-related information, and legal protections against such disclosures. All notifications shall be in person, except where circumstances reasonably prevent doing so, e.g., at the request of the contact.

(h) If a protected person is now deceased, contacts (e.g., spouse) are known to the physician and the physician believes the protected person had not informed such contacts, the physician or his/her agent may notify such contacts or shall request the authorized public health official to notify the contacts, without identifying the protected individual to the contact.

(i) A physician or authorized public health official shall have no obligation to identify or locate any contact, except as provided pursuant to Public Health Law Article 21, Title III. No criminal sanction or civil liability shall arise against a physician, his/her employer or designated agent, health facility, health care provider or authorized public health official for the disclosure of confidential HIV-related information to a contact or to a person consenting to health care for the contact when in compliance with Article 27-F, or for the failure to disclose such information to a contact or to a person consenting to health care for the contact.

(j) Municipal health commissioners must provide HIV contact notification services and shall forward to the department, summary data and all identifiable information related to notification activities upon completion of such activity unless otherwise determined by the commissioner. Information identifying the contact collected in the course of contact notification activities by authorized public health officials shall not be maintained at the state or local level for more than one year following completion of such activity.

(k) For the purposes of notifying contacts under Public Health Law section 2782(1)(d), blood transfusion and organ and tissue transplantation present a risk of HIV transmission. Notifying contacts potentially exposed to HIV through tissues, organs, or transfused blood under a federally mandated recipient notification program or guidelines acceptable to the commissioner shall be sufficient to meet the notification requirements of Article 21, Title III and Article 27-F. Blood banks, organ procurement organizations, and tissue banks may disclose the HIV status of a donation to a donor's provider for the purposes of notifying known contacts of a donor.

(l) When contact notification is initiated by a physician not related to reporting mandates or Article 21, Title III, but based on authority to notify an identified spouse, sex partner, hypodermic needle and syringe partner under Public Health Law section 2782(4), physicians or their agents and authorized public health officials may conduct contact notification as follows:

(1) a physician or his/her agent may, without the protected person's consent, notify such contact or report such contact to the authorized public health official for the purpose of notifying a contact when:

(i) the physician believes disclosure is medically appropriate and a significant risk of infection may exist to the contact; and

(ii) the protected person has been counseled to notify his/her contacts or the physician has taken all reasonable efforts to attempt to counsel the person; and

(iii) domestic violence screening in accordance with the screening protocol has been applied;

(2) the physician must inform the protected person of the physician's intent to notify such contacts and of their responsibility to report the case and such contacts to the commissioner, and inform the protected person that he/she may express a preference whether contact notification shall be made by the physician or authorized public health official, and that the protected individual's name or other information about them is not disclosed to any person during the contact notification process;

(3) if the protected person's preference is for the authorized public health official to notify contacts or if the protected person's preference is for the physician to notify contacts but the physician chooses not to do so, he/she shall notify the protected person of his/her decision to contact the authorized public health official and shall forward names and addresses of the case and contacts to the authorized public health official, who shall take reasonable measures to notify such contacts. If the protected person's preference is for the physician to notify contacts and the physician elects to do so, the physician or his/her agent may then notify contacts; and

(4) the physician must report to the authorized public health official regarding the success or failure of such efforts, including the names and addresses of the cases and contacts. If contacts have not been notified or notification cannot be verified by the physician or his/her agent, public health officers shall take reasonable measures to inform the contact as set forth in subdivisions (b) through (g) of section 63.8.

(m) When the requirements of this section have been met, physicians and other diagnostic providers may disclose HIV-related information to physicians or other diagnostic providers of persons whom the protected individual may have exposed to HIV under the circumstances noted below that present a risk of transmission of HIV, except that disclosures related to exposures of emergency response employees governed by federal law shall continue to be governed by such law:

(1) the incident must involve exposure to blood, semen, vaginal secretions, tissue or the following body fluids: cerebrospinal, amniotic, peritoneal, synovial, pericardial and pleural; and

(2) a person has contact with the body substances, as noted in paragraph (1) above, of another to mucus membranes (e.g., eyes, nose, mouth), non-intact skin (e.g., open wound, skin with a dermatitis condition, abraded areas) or to the vascular system. Examples of such contact may include needlesticks, puncture wound injuries and direct saturation or permeation of non-intact skin by potentially infectious substances. These circumstances shall not include those delineated in subdivision (d) of section 63.10; and

(3) the exposure incident occurred to staff, employees or volunteers in the performance of employment or professional duties:

(i) in a medical or dental office; or

(ii) in a facility regulated, authorized or supervised by the Department of Health, Office of Mental Health, Office of Mental Retardation and Developmental Disabilities, Office of Children and Family Services, Office of Alcoholism and Substance Abuse Services, Department of Correctional Services; or

(iii) involved an emergency response employee, paid or volunteer, including an emergency medical technician, a firefighter, a law enforcement officer (e.g., police, probation, parole officer) or local correctional officer or medical staff; and

(4) an incident report documenting the details of the exposure, including witnesses to the incident, if any, is on record with supervisory staff; and

(5) a request for disclosure of HIV status is made to the provider of the source or to the medical officer designated by the facility by the exposed person or by the provider of the exposed person as soon as possible after the alleged exposure if a decision relating to the initiation or continuation of post-exposure prophylactic treatment is being considered; and

(6) the medical provider of the exposed person or the medical officer designated by the facility reviews, investigates and evaluates the incident and certifies that:

(i) the information is necessary for immediate decisions regarding initiation or continuation of post-exposure prophylactic treatment for the exposed person; and

(ii) the exposed person's status is either HIV negative or unknown and that if the person's status is unknown, the person has consented to an HIV test; and

(iii) if such test result becomes known as positive prior to the receipt of the source's HIV status, no disclosure of the source's HIV status will be made to the person; and

(7) documentation of the request is placed in the medical record of the exposed person; and

(8) if the provider of the source or the medical officer designated by the facility determines that a risk of transmission has occurred or is likely to have occurred in the reasonable exercise of his/her professional judgment, the provider or medical officer may release the HIV status of the source, if known. The provider or medical officer may consult with the municipal health commissioner or district health officer to determine whether a risk of transmission exists. If consultation occurs, both the provider and the local health officer must be in agreement if the HIV information is to be disclosed. In the disclosure process the name of the source shall not be provided to the exposed person. Redisclosure of the HIV status of the source is prohibited except when made in conformance with Public Health Law Article 21, Title III.

(a) initial employee education and annual inservice education of employees regarding the legal prohibition against unauthorized disclosure in Public Health Law Article 27-F and provisions of Article 21, Title III. A list of all employees who have had such training must be maintained by health care providers and health facilities. Health care providers and health facilities contracting with others for services in which HIV-related information may be disclosed to such contractors, must document evidence that such contractors have been informed of the confidentiality and disclosure requirements of this Part;

(b) maintenance of a list of job titles and the specific employee functions within those titles for which employees are authorized to access such information. This list shall describe the limits of such access to information and must be provided to the employees during employee education sessions;

(c) a requirement that only full-time or part-time employees, contractors and medical, nursing or health-related students who have received such education on HIV confidentiality, or can document that they have received such education or training, shall have access to confidential HIV-related information while performing the authorized functions listed under paragraph (2).

(d) protocols for ensuring that records, including records which are stored electronically, are maintained securely and used for the purpose intended;

(e) procedures for handling requests by other parties for confidential HIV-related information;

(f) protocols prohibiting employees/agents/contractors from discriminating against persons having or suspected of having HIV infection; and

(g) review of the policies and procedures on at least an annual basis.

(a) The three factors necessary to create a significant risk of contracting or transmitting HIV infection are:

(1) the presence of a significant risk body substance;

(2) a circumstance which constitutes significant risk for transmitting or contracting HIV infection; and

(3) the presence of an infectious source and a non-infected person.

(b) "Significant risk body substances" are blood, semen, vaginal secretions, breast milk, tissue and the following body fluids: cerebrospinal, amniotic, peritoneal, synovial, pericardial, and pleural.

(c) Circumstances which constitute "significant risk of transmitting or contracting HIV infection" are:

(1) sexual intercourse (vaginal, anal, oral) which exposes a non-infected individual to blood, semen or vaginal secretions of an infected individual;

(2) sharing of needles and other paraphernalia used for preparing and injecting drugs between infected and non-infected individuals;

(3) the gestation, birthing or breast feeding of an infant when the mother is infected with HIV;

(4) transfusion or transplantation of blood, organs, or other tissues from an infected individual to an uninfected individual, provided such blood, organs or other tissues have not tested conclusively for antibody or antigen and have not been rendered non-infective by heat or chemical treatment;

(5) other circumstances not identified in paragraphs (1) through (4) during which a significant risk body substance (other than breast milk) of an infected individual contacts mucous membranes (e.g., eyes, nose, mouth), non-intact skin (e.g., open wound, skin with a dermatitis condition, abraded areas) or the vascular system of a non-infected person. Such circumstances include, but are not limited to needlestick or puncture wound injuries and direct saturation or permeation of these body surfaces by the infectious body substance.

(d) Circumstances that involve "significant risk" shall not include:

(1) exposure to urine, feces, sputum, nasal secretions, saliva, sweat, tears or vomitus that does not contain blood that is visible to the naked eye;

(2) human bites where there is no direct blood to blood, or blood to mucous membrane contact;

(3) exposure of intact skin to blood or any other body substance;

(4) occupational settings where individuals use scientifically accepted barrier techniques and preventive practices in circumstances which would otherwise pose a significant risk and such barriers are not breached and remain intact.