Bill Text: NY A00230 | 2019-2020 | General Assembly | Introduced

Bill Title: Prohibits emergency service providers from selling patient health information without written consent.

Spectrum: Moderate Partisan Bill (Democrat 8-2)

Status: (Passed) 2019-10-07 - signed chap.358 [A00230 Detail]

Download: New_York-2019-A00230-Introduced.html

                STATE OF NEW YORK
                               2019-2020 Regular Sessions
                   IN ASSEMBLY
                                     January 9, 2019
          STECK, WEPRIN -- Multi-Sponsored by -- M.  of  A.  CROUCH,  MONTESANO,
          O'DONNELL -- read once and referred to the Committee on Health
        AN  ACT to amend the public health law, in relation to the protection of
          private patient information by ambulance services
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
     1    Section  1.  The  public health law is amended by adding a new section
     2  3006-a to read as follows:
     3    § 3006-a. Patient privacy. 1. As used in this section:
     4    (a) "Individual identifying information" means information identifying
     5  or tending to identify a patient.
     6    (b) "Marketing" means advertising, detailing, marketing, promotion, or
     7  any other activity that is intended to be  used  to  influence  business
     8  volume, sales or market share or evaluate the effectiveness of marketing
     9  practices  or marketing personnel, regardless of whether the beneficiary
    10  of the marketing is a governmental, for-profit, or not-for-profit  enti-
    11  ty.
    12    2. No ambulance service, advanced life support first response service,
    13  or  employee,  member  or  agent thereof shall disclose, sell, transfer,
    14  exchange, provide or use any individual identifying information  to  any
    15  person or entity for the purpose of marketing.
    16    3.  Notwithstanding  subdivision  two  of this section, and subject to
    17  otherwise applicable law, individual identifying information may be:
    18    (a) disclosed, sold, transferred or exchanged to:
    19    (i) the patient who is the subject of the  information,  or  a  person
    20  authorized to make health care decisions for the patient;
    21    (ii)  a  health  care  provider  providing  care  or  treatment to the
    22  patient, for the purpose of such care or treatment; or a health informa-
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.

        A. 230                              2
     1  tion system subject to regulations of the department, for the purpose of
     2  such care or treatment;
     3    (iii)  an  officer, inspector or investigator for a government health,
     4  licensing or law  enforcement  agency  acting  under  appropriate  legal
     5  authority;
     6    (iv)  a  person  authorized  by a court order or a subpoena to receive
     7  such information;
     8    (v) the patient's health plan, insurer, or third party  payer,  or  an
     9  agent  thereof,  for  the purpose of payment or reimbursement for health
    10  care services, including determining compliance with the terms of cover-
    11  age or medical necessity, or utilization review;
    12    (vi) a person or entity to whom, and for a purpose for which,  disclo-
    13  sure or transfer is otherwise explicitly authorized or required by law;
    14    (vii) a person or entity, for the purpose of conducting quality assur-
    15  ance  or  evaluating  the  performance of an ambulance service, advanced
    16  life support first response service, or any employee,  member  or  agent
    17  thereof;
    18    (viii)  a  person or entity acting as an employee or agent of a person
    19  or entity under any preceding paragraph of  this  subdivision,  for  the
    20  purpose of and consistent with that paragraph; or
    21    (ix) a government entity as provided by law; and
    22    (b)  used  by  such  ambulance  service,  advanced  life support first
    23  responder service, or employee, member or agent thereof,  for  training,
    24  promotion,  staff  recognition  or recruitment purposes, consistent with
    25  applicable law, provided the patient or a qualified person as defined by
    26  paragraph (G) of subdivision one of section eighteen of this chapter has
    27  provided consent to such use in a separate, stand-alone  document.  Such
    28  consent  shall  be  limited  to  the particular type or types of use and
    29  specific transaction or transactions for which such consent is given.
    30    4. Nothing in this section shall prohibit the collection, use,  trans-
    31  fer,  or sale of patient data by zip code, geographic region, or medical
    32  specialty for marketing purposes, providing it does not contain individ-
    33  ual identifying information.
    34    5. This section shall not prevent a person from  disclosing,  selling,
    35  transferring,  or exchanging for value his or her own individual identi-
    36  fying information, for any purpose; provided that the  information  does
    37  not  include  individual identifying information pertaining to any other
    38  person.
    39    6. This section does not prohibit  a  not-for-profit  or  governmental
    40  ambulance  service  or  advanced life support first response service, or
    41  agent thereof, from using a patient's  name  and  address  in  order  to
    42  contact  such  patient  or a family member at such address with requests
    43  for donations to such service; providing that such use shall not include
    44  disclosing any individual identifying information.
    45    7. No person or entity to whom or which individual identifying  infor-
    46  mation  is  disclosed,  sold,  transferred  or exchanged shall disclose,
    47  sell, transfer or exchange it to any person or entity other than for the
    48  lawful  purpose  for  which  it  was  disclosed,  sold,  transferred  or
    49  exchanged  to  the  person or entity, and without satisfactory assurance
    50  that the recipient will safeguard the records from  being  disclosed  or
    51  used for marketing purposes.
    52    8.  This section does not authorize any disclosure, sale, transfer, or
    53  exchange of individual identifying information  that  is  not  otherwise
    54  authorized or required by law.
    55    9. In addition to the commissioner's authority to enforce this section
    56  under section three thousand twelve of this article, the attorney gener-

        A. 230                              3
     1  al  shall  have  the  authority to bring an action to enforce compliance
     2  with this section without referral by the commissioner.
     3    § 2. This act shall take effect on the one hundred eightieth day after
     4  it  shall  have  become a law; provided that, effective immediately, the
     5  commissioner of health may  make  regulations  and  take  other  actions
     6  reasonably necessary to implement this act on such date.