Bill Text: NY A01253 | 2021-2022 | General Assembly | Introduced

---

Bill Title: Relates to the confidentiality of contact tracing information.

Spectrum: Partisan Bill (Democrat 4-0)

Status: (Introduced - Dead) 2021-02-08 - substituted by s900 [A01253 Detail]

Download: New_York-2021-A01253-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                          1253

                               2021-2022 Regular Sessions

                   IN ASSEMBLY

                                     January 7, 2021
                                       ___________

        Introduced  by  M.  of  A.  GOTTFRIED  --  read once and referred to the
          Committee on Health

        AN ACT to amend the public health law, in relation to the confidentiali-
          ty of contact tracing information

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section  1.  Sections 2180, 2181 and 2182 of the public health law, as
     2  added by a chapter of the laws of 2020, amending the public  health  law
     3  relating  to  the  confidentiality  of  contact  tracing information, as
     4  proposed in  legislative  bills  numbers  S.8450-C  and  A.10500-C,  are
     5  amended to read as follows:
     6    §  2180.  Definitions. As used in this title the following terms shall
     7  have the following meanings:
     8    1. "Contact tracing" means COVID-19 case investigation and identifica-
     9  tion of [principal] case individuals and contact individuals.
    10    2. (a) "Contact tracer" and "contact tracing entity" means an individ-
    11  ual or entity employed by or under contract  with  the  state,  a  local
    12  government,  a  state or local governmental entity, or an agent thereof,
    13  to conduct contact  tracing,  engage  in  contact  tracing,  or  receive
    14  contact tracing information.
    15    (b)  A  contact  tracer  or contact tracing entity shall not include a
    16  service provider that is a non-governmental entity that is  employed  by
    17  or  under  contract  with  a contact tracing entity or an agent thereof,
    18  that receives, transmits, maintains, stores, or  hosts  contact  tracing
    19  information  at  the  direction  of  a contact tracer or contact tracing
    20  entity so long as such service provider's access to the  information  is
    21  exclusively  limited  to  the  maintenance  of  the  information and the
    22  contact tracer or contact tracing entity has the ability to  delete  and
    23  manage  contact  tracing  information  as provided by this chapter, law,
    24  rules or regulations.  A service provider under this paragraph shall  be
    25  referred  to in this title as a "designated non-governmental entity."  A

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD07194-01-1
        A. 1253                             2

     1  service provider that does not meet the requirements of  this  paragraph
     2  and  would  otherwise  be  subject  to paragraph (a) of this subdivision
     3  shall be a contact tracing entity.
     4    3.  "Contact  tracing information" means any information that includes
     5  or can reveal the identity of any [principal] case individual or contact
     6  individual,  and  any  COVID-19-related  information  or  test  results,
     7  received  or collected for the purpose or in the course of contact trac-
     8  ing.
     9    4. "Contact individual" means an individual who has or may  have  come
    10  in  contact  with  a  [principal] case individual or who has or may have
    11  been exposed to and possibly infected with COVID-19.
    12    5. "[Principal] Case individual" means an individual with a  confirmed
    13  or probable diagnosis of COVID-19.
    14    6. "COVID-19" means infection with or the disease caused by the severe
    15  acute respiratory syndrome coronavirus 2 (SARS-CoV-2).
    16    7.  "Immigration  authority"  means  any entity, officer, employee, or
    17  government employee or agent thereof charged with or engaged in enforce-
    18  ment of the federal  Immigration  and  Nationality  Act,  including  the
    19  United States Immigration and Customs Enforcement, United States Depart-
    20  ment   of  Homeland  Security,  or  United  States  Customs  and  Border
    21  Protection, or agent, contractor or employee thereof, or  any  successor
    22  legislation or entity.
    23    8.  "De-identified" means, in relation to contact tracing information,
    24  that the information cannot identify or be made to identify or be  asso-
    25  ciated  with  a  particular  individual,  directly  or indirectly and is
    26  subject to technical safeguards and policies and procedures that prevent
    27  re-identification, whether  intentionally  or  unintentionally,  of  any
    28  individual.
    29    9.  "Law enforcement agent or entity" means any governmental entity or
    30  public servant, or agent, contractor or employee thereof, authorized  to
    31  investigate,  prosecute,  or  make  an  arrest  for  a criminal or civil
    32  offense (except a designated civil offense),  or  engaged  in  any  such
    33  activity,  but shall not mean the department, the commissioner, a health
    34  district, a county department of health, a county health commissioner, a
    35  local board of health, a local health officer, the department of  health
    36  and  mental  hygiene of the city of New York, or the commissioner of the
    37  department of health and mental hygiene of the city of  New  York.    As
    38  used  in  this  subdivision,  "designated  civil  offense" means a civil
    39  offense or offenses designated by the commissioner (or the  commissioner
    40  of the New York city department of health and mental hygiene in the case
    41  of  contact  tracing  information collected by or under authority of the
    42  New York city department of health and mental hygiene or  the  New  York
    43  city health and hospitals corporation).
    44    10. "Support" means resources or services provided to an individual to
    45  enable  such  individual  to  safely  quarantine  or  isolate, including
    46  grocery, meal or pharmacy delivery, laundry  services,  child  or  elder
    47  care,  pet walking, assistance with telephone, internet, or other commu-
    48  nication services or devices, health and mental health  services,  legal
    49  services,  provision  of  appropriate  living  space for individuals who
    50  cannot isolate or quarantine at home, and income replacement.  "Support"
    51  may  also  include  support  provided  to other individuals for whom the
    52  individual commonly provides those resources or services.
    53    11. "Permitted purpose" means:
    54    (a) disclosure to appropriate health care providers or their personnel
    55  for the purpose of the clinical diagnosis,  care  or  treatment  of  the
    56  [principal]  case individual or contact individual who is the subject of
        A. 1253                             3

     1  the information, where an emergency exists  and  the  individual  is  in
     2  immediate  need  of  medical  attention and an attempt to secure consent
     3  would result in delay of treatment which would increase the risk to  the
     4  individual's life or health;
     5    (b)  facilitating  a  legally-authorized public health-related action,
     6  [in relation to a specified principal individual or contact individual,]
     7  where and only to the extent necessary to protect the public  health  in
     8  relation to COVID-19; or
     9    (c)  [the  investigation,  prosecution  or defense of a civil or legal
    10  action for] use or disclosure of contact tracing information to pursue a
    11  legal action in relation to a violation of  this  title;  provided  that
    12  disclosure  shall  be  subject  to  in camera review and approval by the
    13  court, and, if the use is initiated by a party other than  the  [princi-
    14  pal]  case  individual  or  contact individual who is the subject of the
    15  contact tracing information, the information must be highly material and
    16  relevant for the purpose.
    17    § 2181. COVID-19 contact tracing; confidentiality. 1.  (a) All contact
    18  tracing information shall be kept confidential  by  any  contact  tracer
    19  [and], contact tracing entity, or designated non-governmental entity and
    20  may not be disclosed except as necessary to carry out contact tracing or
    21  a  permitted  purpose. A designated non-governmental entity may only act
    22  in relation to contact tracing information as explicitly  authorized  by
    23  this title.
    24    (b) Where a contact tracer or contact tracing entity discloses contact
    25  tracing  information  for  a  permitted  purpose,  the contact tracer or
    26  contact tracing entity shall make a record of the disclosure,  including
    27  to  whom  it  was  made and when it was made, which shall be part of the
    28  contact tracing information.
    29    (c)   Nothing in  this  title  prohibits  otherwise  lawful  voluntary
    30  reporting,  at  the  discretion of the contact tracer, reasonably and in
    31  good faith:  (i) to the statewide central registry under  title  six  of
    32  article  six of the social services law, adult protective services under
    33  titles one and two of article nine-B of the social services law, or  the
    34  justice  center  for  the  protection of people with special needs under
    35  article eleven of the social services law; or (ii) to a governmental  or
    36  non-governmental  emergency  reporting system (such as a "911," domestic
    37  violence or suicide prevention   system) to  prevent  imminent  risk  of
    38  injury to any person.
    39    (d)  This  title  does not limit disclosure to or by, or possession or
    40  use by, the case individual or contact individual who is the subject  of
    41  the information.
    42    2.  (a)  An  individual  may waive the confidentiality provided for by
    43  this section, only by a written, informed and voluntary waiver, in plain
    44  language and in a language understandable to the individual  making  the
    45  waiver,  and  not part of any other document. The waiver shall state the
    46  scope and limit of the waiver.  No contact tracer, contact tracing enti-
    47  ty or governmental or non-governmental entity may seek or act  in  reli-
    48  ance on a waiver to distribute, sell, or otherwise disclose identifiable
    49  or  de-identified  data  to any individual or entity.  Provided however,
    50  nothing in this subdivision shall prohibit  distribution  or  disclosure
    51  that  is otherwise explicitly authorized by this section. If an individ-
    52  ual lacks the capacity to make a waiver,  an  individual  authorized  to
    53  consent  to  health  care  for the individual, or the individual's legal
    54  representative, may make the waiver.  However, a waiver of confidential-
    55  ity is not required to be written if it is solely  for  the  purpose  of
    56  arranging  or providing support for the individual who is the subject of
        A. 1253                             4

     1  the contact tracing information, provided the consent  is  informed  and
     2  voluntary.
     3    (b)  A  waiver  of confidentiality under this section shall only apply
     4  for the purpose of arranging or providing support if the individual  who
     5  is the subject of the contact tracing information (or, if the individual
     6  lacks the capacity to provide informed consent, an individual authorized
     7  to  consent to health care for the individual, or the individual's legal
     8  representative) provides voluntary informed consent to the arranging  or
     9  providing of the support.
    10    3.  A  disclosure of contact tracing information authorized under this
    11  section shall be limited in scope as to the identity of any  individual,
    12  the  information  to be disclosed, and the party to which disclosure may
    13  be made, and as necessary to achieve the purpose of the disclosure under
    14  this section, and shall not authorize re-disclosure except as explicitly
    15  authorized by the terms of the waiver under this section.  However, this
    16  section does not bar disclosure of contact tracing information  pertain-
    17  ing to and identifying a [principal] case individual or contact individ-
    18  ual by the individual who is identified.
    19    4.   (a)  This  section  does  not  bar  otherwise-lawful  disclosure,
    20  possession or use of de-identified contact tracing information,  includ-
    21  ing  aggregate  contact  tracing  information[,  that is de-identified].
    22  Disclosure, possession or use under this subdivision shall only be for a
    23  public health or public health research or evaluation purpose as  deter-
    24  mined  by  the  commissioner  (or  the commissioner of the New York city
    25  department of health and mental hygiene in the case of  contact  tracing
    26  information collected by or under authority of the New York city depart-
    27  ment of health and mental hygiene or the New York city health and hospi-
    28  tals corporation), and shall not authorize re-disclosure or other use.
    29    (b) A person or entity may only disclose, possess or use de-identified
    30  contact  tracing  information if the person or entity, and the person or
    31  entity to which it is  disclosed,  maintains  technical  safeguards  and
    32  policies  and  procedures that prevent re-identification, whether inten-
    33  tional or unintentional, of any individual, as may be  required  by  the
    34  commissioner  (or  the  New  York city commissioner of health and mental
    35  hygiene in the case of contact tracing information collected by or under
    36  authority of the New York city department of health and  mental  hygiene
    37  or the New York city health and hospitals corporation).  The commission-
    38  er  (or the New York city commissioner as the case may be) shall require
    39  safeguards, policies and procedures under this paragraph as the  commis-
    40  sioner deems practicable.
    41    (c)  Disclosure,  possession  and use of de-identified contact tracing
    42  information under this subdivision shall be only pursuant to approval by
    43  the commissioner (or the New York city commissioner of health and mental
    44  hygiene in the case of contact tracing information collected by or under
    45  authority of the New York city department of health and  mental  hygiene
    46  or  the  New  York city health and hospitals corporation) specifying the
    47  purpose, nature and scope of the  disclosure,  possession  and  use  and
    48  measures  to  ensure that it will comply with this section and the terms
    49  of the approval.
    50    5. No law enforcement agent or entity or immigration  authority  shall
    51  be a contact tracer or contact tracing entity or engage in contact trac-
    52  ing.  This subdivision does not bar an individual who is associated with
    53  a law enforcement entity or immigration authority from acting only as  a
    54  [principal]  case  individual  or contact individual.   This subdivision
    55  does not prevent a law enforcement agent or entity from assisting  in  a
        A. 1253                             5

     1  permitted use under paragraph (b) of subdivision eleven of section twen-
     2  ty-one hundred eighty of this title.
     3    6.  No  contact tracer [or], contact tracing entity or designated non-
     4  governmental entity may provide contact tracing  information  to  a  law
     5  enforcement agent [or], entity or immigration authority, or any individ-
     6  ual  or  entity  other  than  the  contact  tracing entity from which it
     7  received the information, except as explicitly authorized by this title.
     8  Without consent under subdivision two of this section,  contact  tracing
     9  information  and  any evidence derived therefrom shall not be subject to
    10  or provided in response to any legal process or be  admissible  for  any
    11  purpose in any judicial or administrative action or proceeding. However,
    12  this  subdivision does not restrict providing information, relating to a
    13  specified [principal] case individual or contact individual,  where  and
    14  only to the extent necessary for a permitted purpose.
    15    7.  (a)  Contact tracing entities shall establish appropriate adminis-
    16  trative, technical and physical safeguards, policies and procedures that
    17  ensure the security of contact tracing information  under  the  entity's
    18  jurisdiction.    The  safeguards,  policies  and  procedures must ensure
    19  contact tracing information is encrypted and protected at least as  much
    20  as or more than other confidential information under the entity's juris-
    21  diction.    All  storage  of  contact tracing information shall meet the
    22  requirements of this title. The  commissioner  (or  the  New  York  city
    23  commissioner of health and mental hygiene in the case of contact tracing
    24  information collected by or under authority of the New York city depart-
    25  ment of health and mental hygiene or the New York city health and hospi-
    26  tals  corporation)  shall  make  regulations  as reasonably necessary to
    27  require that contact tracing information possessed, used  or  under  the
    28  control  of  a contact tracer or contact tracing entity shall be subject
    29  to technical safeguards [and],  policies  and  procedures  for  storage,
    30  transmission,  use  and  protection of the information.  The regulations
    31  shall prevent possession, use  or  disclosure  of  the  contact  tracing
    32  information  not  permitted  by  this title, and shall be at least as or
    33  more protective than the safeguards, policies and procedures the commis-
    34  sioner (or the New York city commissioner as the case may  be)  provides
    35  for other confidential information.
    36    (b)  This  paragraph  applies  [where  contact  tracing information is
    37  possessed or controlled by a contact tracer or  contact  tracing  entity
    38  that  is  a  non-governmental  individual or entity employed by or under
    39  contract with a governmental entity, or an agent thereof] to  a  contact
    40  tracer  or  contact tracing entity that is a non-governmental individual
    41  or entity employed by or under contract with a governmental  entity,  or
    42  an agent thereof.  Within [thirty] sixty days of collecting or receiving
    43  the  contact  tracing  information, the [non-governmental individual or]
    44  entity shall (i) remove information from its possession or  control  and
    45  deliver  it  to the appropriate governmental contact tracing entity or a
    46  designated non-governmental entity specified by the governmental contact
    47  tracing entity, retaining no copy of it; (ii)  expunge  the  information
    48  from  its  possession  or control; or (iii) de-identify the information.
    49  However, the expungement  or  de-identification  of  particular  contact
    50  tracing  information  may  be postponed for up to fifteen days after the
    51  initial sixty day period while the contact  tracer  or  contact  tracing
    52  entity  is  actively  engaged in contact tracing using that information,
    53  provided that the [principal] case individual or contact  individual  to
    54  whom  it  pertains  gives  voluntary informed consent.   The disclosure,
    55  possession and use of  the  de-identified  contact  tracing  information
    56  shall be subject to subdivision four of this section.
        A. 1253                             6

     1    §  2182.  Regulations. The commissioner shall make regulations [imple-
     2  menting] as reasonably necessary to implement this title.
     3    §  2.   This act  shall  take  effect on the same date and in the same
     4  manner as a chapter of the laws of 2020, amending  the public health law
     5  relating to the confidentiality of  contact  tracing  information,    as
     6  proposed  in  legislative  bills  numbers  S.8450-C and A.10500-C, takes
     7  effect.