S T A T E O F N E W Y O R K
________________________________________________________________________
10500--C
I N A S S E M B L Y
May 22, 2020
___________
Introduced by COMMITTEE ON RULES -- (at request of M. of A. Gottfried,
Paulin, Dinowitz, Jaffee, McDonald, Galef, Simon, Solages, Bronson,
Hunter, Niou, Zebrowski, Quart, Cruz, Ashby, Lentol, Weprin, Epstein,
Mosley, Abinanti, Perry, Pichardo, Blake, Englebright, Seawright,
Ortiz, Reyes, L. Rosenthal, Fernandez, Simotas, Cahill, Jacobson,
Frontus, McMahon, Smith, Thiele, Colton, Stern, Rodriguez, Dickens,
Taylor, Otis, Lupardo, Fahy, Steck, Lavine, Cymbrowitz, Wright, Ramos,
Walker) -- read once and referred to the Committee on Health --
committee discharged, bill amended, ordered reprinted as amended and
recommitted to said committee -- again reported from said committee
with amendments, ordered reprinted as amended and recommitted to said
committee -- reported and referred to the Committee on Rules --
committee discharged, bill amended, ordered reprinted as amended and
recommitted to said committee
AN ACT to amend the public health law, in relation to the confidentiali-
ty of contact tracing information
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Article 21 of the public health law is amended by adding a
new title 8 to read as follows:
TITLE 8
NOVEL CORONAVIRUS, COVID-19
SECTION 2180. DEFINITIONS.
2181. COVID-19 CONTACT TRACING; CONFIDENTIALITY.
2182. REGULATIONS.
§ 2180. DEFINITIONS. AS USED IN THIS TITLE THE FOLLOWING TERMS SHALL
HAVE THE FOLLOWING MEANINGS:
1. "CONTACT TRACING" MEANS CASE INVESTIGATION AND IDENTIFICATION OF
PRINCIPAL INDIVIDUALS AND CONTACT INDIVIDUALS.
2. "CONTACT TRACER" AND "CONTACT TRACING ENTITY" MEANS AN INDIVIDUAL
OR ENTITY EMPLOYED BY OR UNDER CONTRACT WITH THE STATE, A LOCAL GOVERN-
MENT, A STATE OR LOCAL GOVERNMENTAL ENTITY, OR AN AGENT THEREOF, TO
CONDUCT CONTACT TRACING, ENGAGE IN CONTACT TRACING, OR RECEIVE CONTACT
TRACING INFORMATION.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD16487-13-0
A. 10500--C 2
3. "CONTACT TRACING INFORMATION" MEANS ANY INFORMATION THAT INCLUDES
OR CAN REVEAL THE IDENTITY OF ANY PRINCIPAL INDIVIDUAL OR CONTACT INDI-
VIDUAL, AND ANY COVID-19-RELATED INFORMATION OR TEST RESULTS, RECEIVED
OR COLLECTED FOR THE PURPOSE OR IN THE COURSE OF CONTACT TRACING.
4. "CONTACT INDIVIDUAL" MEANS AN INDIVIDUAL WHO HAS OR MAY HAVE COME
IN CONTACT WITH A PRINCIPAL INDIVIDUAL OR WHO HAS OR MAY HAVE BEEN
EXPOSED TO AND POSSIBLY INFECTED WITH COVID-19.
5. "PRINCIPAL INDIVIDUAL" MEANS AN INDIVIDUAL WITH A CONFIRMED OR
PROBABLE DIAGNOSIS OF COVID-19.
6. "COVID-19" MEANS INFECTION WITH OR THE DISEASE CAUSED BY THE SEVERE
ACUTE RESPIRATORY SYNDROME CORONAVIRUS 2 (SARS-COV-2).
7. "IMMIGRATION AUTHORITY" MEANS ANY ENTITY, OFFICER, EMPLOYEE, OR
GOVERNMENT EMPLOYEE OR AGENT THEREOF CHARGED WITH OR ENGAGED IN ENFORCE-
MENT OF THE FEDERAL IMMIGRATION AND NATIONALITY ACT, INCLUDING THE
UNITED STATES IMMIGRATION AND CUSTOMS ENFORCEMENT OR UNITED STATES
CUSTOMS AND BORDER PROTECTION, OR ANY SUCCESSOR LEGISLATION OR ENTITY.
8. "DE-IDENTIFIED" MEANS, IN RELATION TO CONTACT TRACING INFORMATION,
THAT THE INFORMATION CANNOT IDENTIFY OR BE MADE TO IDENTIFY OR BE ASSO-
CIATED WITH A PARTICULAR INDIVIDUAL, DIRECTLY OR INDIRECTLY AND IS
SUBJECT TO TECHNICAL SAFEGUARDS AND POLICIES AND PROCEDURES THAT PREVENT
RE-IDENTIFICATION, WHETHER INTENTIONALLY OR UNINTENTIONALLY, OF ANY
INDIVIDUAL.
9. "LAW ENFORCEMENT AGENT OR ENTITY" MEANS ANY GOVERNMENTAL ENTITY OR
PUBLIC SERVANT, OR AGENT, CONTRACTOR OR EMPLOYEE THEREOF, AUTHORIZED TO
INVESTIGATE, PROSECUTE, OR MAKE AN ARREST FOR A CRIMINAL OR CIVIL
OFFENSE, OR ENGAGED IN ANY SUCH ACTIVITY, BUT SHALL NOT MEAN THE DEPART-
MENT, THE COMMISSIONER, A HEALTH DISTRICT, A COUNTY DEPARTMENT OF
HEALTH, A COUNTY HEALTH COMMISSIONER, A LOCAL BOARD OF HEALTH, A LOCAL
HEALTH OFFICER, THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE CITY
OF NEW YORK, OR THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND MENTAL
HYGIENE OF THE CITY OF NEW YORK.
10. "SUPPORT" MEANS RESOURCES OR SERVICES PROVIDED TO AN INDIVIDUAL TO
ENABLE SUCH INDIVIDUAL TO SAFELY QUARANTINE OR ISOLATE, INCLUDING
GROCERY, MEAL OR PHARMACY DELIVERY, LAUNDRY SERVICES, CHILD OR ELDER
CARE, PET WALKING, ASSISTANCE WITH TELEPHONE, INTERNET, OR OTHER COMMU-
NICATION SERVICES OR DEVICES, HEALTH AND MENTAL HEALTH SERVICES, LEGAL
SERVICES, PROVISION OF APPROPRIATE LIVING SPACE FOR INDIVIDUALS WHO
CANNOT ISOLATE OR QUARANTINE AT HOME, AND INCOME REPLACEMENT. "SUPPORT"
MAY ALSO INCLUDE SUPPORT PROVIDED TO OTHER INDIVIDUALS FOR WHOM THE
INDIVIDUAL COMMONLY PROVIDES THOSE RESOURCES OR SERVICES.
11. "PERMITTED PURPOSE" MEANS:
(A) DISCLOSURE TO APPROPRIATE HEALTH CARE PROVIDERS OR THEIR PERSONNEL
FOR THE PURPOSE OF THE CLINICAL DIAGNOSIS, CARE OR TREATMENT OF THE
PRINCIPAL INDIVIDUAL OR CONTACT INDIVIDUAL WHO IS THE SUBJECT OF THE
INFORMATION, WHERE AN EMERGENCY EXISTS AND THE INDIVIDUAL IS IN IMMEDI-
ATE NEED OF MEDICAL ATTENTION AND AN ATTEMPT TO SECURE CONSENT WOULD
RESULT IN DELAY OF TREATMENT WHICH WOULD INCREASE THE RISK TO THE INDI-
VIDUAL'S LIFE OR HEALTH;
(B) FACILITATING A LEGALLY-AUTHORIZED PUBLIC HEALTH-RELATED ACTION, IN
RELATION TO A SPECIFIED PRINCIPAL INDIVIDUAL OR CONTACT INDIVIDUAL,
WHERE AND ONLY TO THE EXTENT NECESSARY TO PROTECT THE PUBLIC HEALTH; OR
(C) THE INVESTIGATION, PROSECUTION OR DEFENSE OF A CIVIL OR LEGAL
ACTION FOR A VIOLATION OF THIS TITLE; PROVIDED THAT IF THE USE IS INITI-
ATED BY A PARTY OTHER THAN THE PRINCIPAL INDIVIDUAL OR CONTACT INDIVID-
UAL WHO IS THE SUBJECT OF THE CONTACT TRACING INFORMATION, THE INFORMA-
TION MUST BE HIGHLY MATERIAL AND RELEVANT FOR THE PURPOSE.
A. 10500--C 3
§ 2181. COVID-19 CONTACT TRACING; CONFIDENTIALITY. 1. (A) ALL CONTACT
TRACING INFORMATION SHALL BE KEPT CONFIDENTIAL BY ANY CONTACT TRACER AND
CONTACT TRACING ENTITY, AND MAY NOT BE DISCLOSED EXCEPT AS NECESSARY TO
CARRY OUT CONTACT TRACING OR A PERMITTED PURPOSE.
(B) WHERE A CONTACT TRACER OR CONTACT TRACING ENTITY DISCLOSES CONTACT
TRACING INFORMATION FOR A PERMITTED PURPOSE, THE CONTACT TRACER OR
CONTACT TRACING ENTITY SHALL MAKE A RECORD OF THE DISCLOSURE, INCLUDING
TO WHOM IT WAS MADE, WHICH SHALL BE PART OF THE CONTACT TRACING INFORMA-
TION.
2. (A) AN INDIVIDUAL MAY WAIVE THE CONFIDENTIALITY PROVIDED FOR BY
THIS SECTION, ONLY BY A WRITTEN, INFORMED AND VOLUNTARY WAIVER, IN PLAIN
LANGUAGE AND IN A LANGUAGE UNDERSTANDABLE TO THE INDIVIDUAL MAKING THE
WAIVER, AND NOT PART OF ANY OTHER DOCUMENT. THE WAIVER SHALL STATE THE
SCOPE AND LIMIT OF THE WAIVER. IF AN INDIVIDUAL LACKS THE CAPACITY TO
MAKE A WAIVER, AN INDIVIDUAL AUTHORIZED TO CONSENT TO HEALTH CARE FOR
THE INDIVIDUAL, OR THE INDIVIDUAL'S LEGAL REPRESENTATIVE, MAY MAKE THE
WAIVER. HOWEVER, A WAIVER OF CONFIDENTIALITY IS NOT REQUIRED TO BE
WRITTEN IF IT IS SOLELY FOR THE PURPOSE OF ARRANGING OR PROVIDING
SUPPORT FOR THE INDIVIDUAL WHO IS THE SUBJECT OF THE CONTACT TRACING
INFORMATION.
(B) A WAIVER OF CONFIDENTIALITY UNDER THIS SECTION SHALL ONLY APPLY
FOR THE PURPOSE OF ARRANGING OR PROVIDING SUPPORT IF THE INDIVIDUAL WHO
IS THE SUBJECT OF THE CONTACT TRACING INFORMATION PROVIDES VOLUNTARY
INFORMED CONSENT TO THE ARRANGING OR PROVIDING OF THE SUPPORT.
3. A DISCLOSURE OF CONTACT TRACING INFORMATION AUTHORIZED UNDER THIS
SECTION SHALL BE LIMITED IN SCOPE AS TO THE IDENTITY OF ANY INDIVIDUAL,
THE INFORMATION TO BE DISCLOSED, AND THE PARTY TO WHICH DISCLOSURE MAY
BE MADE, AND AS NECESSARY TO ACHIEVE THE PURPOSE OF THE DISCLOSURE UNDER
THIS SECTION, AND SHALL NOT AUTHORIZE RE-DISCLOSURE EXCEPT AS EXPLICITLY
AUTHORIZED BY THE TERMS OF THE WAIVER UNDER THIS SECTION. HOWEVER, THIS
SECTION DOES NOT BAR DISCLOSURE OF CONTACT TRACING INFORMATION PERTAIN-
ING TO AND IDENTIFYING A PRINCIPAL INDIVIDUAL OR CONTACT INDIVIDUAL BY
THE INDIVIDUAL WHO IS IDENTIFIED.
4. (A) THIS SECTION DOES NOT BAR OTHERWISE-LAWFUL DISCLOSURE,
POSSESSION OR USE OF CONTACT TRACING INFORMATION, INCLUDING AGGREGATE
CONTACT TRACING INFORMATION, THAT IS DE-IDENTIFIED. DISCLOSURE,
POSSESSION OR USE UNDER THIS SUBDIVISION SHALL ONLY BE FOR A PUBLIC
HEALTH OR PUBLIC HEALTH RESEARCH PURPOSE.
(B) A PERSON OR ENTITY MAY ONLY POSSESS OR USE DE-IDENTIFIED CONTACT
TRACING INFORMATION IF THE PERSON OR ENTITY MAINTAINS TECHNICAL SAFE-
GUARDS AND POLICIES AND PROCEDURES THAT PREVENT RE-IDENTIFICATION,
WHETHER INTENTIONAL OR UNINTENTIONAL, OF ANY INDIVIDUAL, AS MAY BE
REQUIRED BY THE COMMISSIONER (OR THE NEW YORK CITY COMMISSIONER OF
HEALTH AND MENTAL HYGIENE IN THE CASE OF CONTACT TRACING INFORMATION
COLLECTED BY OR UNDER AUTHORITY OF THE NEW YORK CITY DEPARTMENT OF
HEALTH AND MENTAL HYGIENE OR THE NEW YORK CITY HEALTH AND HOSPITALS
CORPORATION). THE COMMISSIONER (OR THE NEW YORK CITY COMMISSIONER AS
THE CASE MAY BE) SHALL REQUIRE SAFEGUARDS, POLICIES AND PROCEDURES UNDER
THIS PARAGRAPH AS THE COMMISSIONER DEEMS PRACTICABLE.
(C) DISCLOSURE, POSSESSION AND USE OF DE-IDENTIFIED CONTACT TRACING
INFORMATION UNDER THIS SUBDIVISION SHALL BE ONLY PURSUANT TO APPROVAL BY
THE COMMISSIONER (OR THE NEW YORK CITY COMMISSIONER OF HEALTH AND MENTAL
HYGIENE IN THE CASE OF CONTACT TRACING INFORMATION COLLECTED BY OR UNDER
AUTHORITY OF THE NEW YORK CITY DEPARTMENT OF HEALTH AND MENTAL HYGIENE
OR THE NEW YORK CITY HEALTH AND HOSPITALS CORPORATION) SPECIFYING THE
PURPOSE, NATURE AND SCOPE OF THE DISCLOSURE, POSSESSION AND USE AND
A. 10500--C 4
MEASURES TO ENSURE THAT IT WILL COMPLY WITH THIS SECTION AND THE TERMS
OF THE APPROVAL.
5. NO LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY SHALL
BE A CONTACT TRACER OR CONTACT TRACING ENTITY OR ENGAGE IN CONTACT TRAC-
ING. THIS SUBDIVISION DOES NOT BAR AN INDIVIDUAL WHO IS ASSOCIATED WITH
A LAW ENFORCEMENT ENTITY OR IMMIGRATION AUTHORITY FROM ACTING ONLY AS A
PRINCIPAL INDIVIDUAL OR CONTACT INDIVIDUAL.
6. NO CONTACT TRACER OR CONTACT TRACING ENTITY MAY PROVIDE CONTACT
TRACING INFORMATION TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION
AUTHORITY. WITHOUT CONSENT UNDER SUBDIVISION TWO OF THIS SECTION,
CONTACT TRACING INFORMATION AND ANY EVIDENCE DERIVED THEREFROM SHALL NOT
BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS OR BE ADMIS-
SIBLE FOR ANY PURPOSE IN ANY JUDICIAL OR ADMINISTRATIVE ACTION OR
PROCEEDING. HOWEVER, THIS SUBDIVISION DOES NOT RESTRICT PROVIDING INFOR-
MATION, RELATING TO A SPECIFIED PRINCIPAL INDIVIDUAL OR CONTACT INDIVID-
UAL, WHERE AND ONLY TO THE EXTENT NECESSARY FOR A PERMITTED PURPOSE.
7. (A) THE COMMISSIONER (OR THE NEW YORK CITY COMMISSIONER OF HEALTH
AND MENTAL HYGIENE IN THE CASE OF CONTACT TRACING INFORMATION COLLECTED
BY OR UNDER AUTHORITY OF THE NEW YORK CITY DEPARTMENT OF HEALTH AND
MENTAL HYGIENE OR THE NEW YORK CITY HEALTH AND HOSPITALS CORPORATION)
SHALL MAKE REGULATIONS TO REQUIRE THAT CONTACT TRACING INFORMATION
POSSESSED, USED OR UNDER THE CONTROL OF A CONTACT TRACER OR CONTACT
TRACING ENTITY SHALL BE SUBJECT TO TECHNICAL SAFEGUARDS AND POLICIES AND
PROCEDURES FOR STORAGE, TRANSMISSION, USE AND PROTECTION OF THE INFORMA-
TION. THE REGULATIONS SHALL PREVENT POSSESSION, USE OR DISCLOSURE OF
THE CONTACT TRACING INFORMATION NOT PERMITTED BY THIS TITLE, AND SHALL
BE AT LEAST AS OR MORE PROTECTIVE THAN THE SAFEGUARDS, POLICIES AND
PROCEDURES THE COMMISSIONER (OR THE NEW YORK CITY COMMISSIONER AS THE
CASE MAY BE) PROVIDES FOR OTHER CONFIDENTIAL INFORMATION.
(B) THIS PARAGRAPH APPLIES WHERE CONTACT TRACING INFORMATION IS
POSSESSED OR CONTROLLED BY A CONTACT TRACER OR CONTACT TRACING ENTITY
THAT IS A NON-GOVERNMENTAL INDIVIDUAL OR ENTITY EMPLOYED BY OR UNDER
CONTRACT WITH A GOVERNMENTAL ENTITY, OR AN AGENT THEREOF. WITHIN THIRTY
DAYS OF COLLECTING OR RECEIVING THE CONTACT TRACING INFORMATION, THE
NON-GOVERNMENTAL INDIVIDUAL OR ENTITY SHALL (I) REMOVE INFORMATION FROM
ITS POSSESSION OR CONTROL AND DELIVER IT TO THE APPROPRIATE GOVERNMENTAL
CONTACT TRACING ENTITY, RETAINING NO COPY OF IT; (II) EXPUNGE THE INFOR-
MATION FROM ITS POSSESSION OR CONTROL; OR (III) DE-IDENTIFY THE INFORMA-
TION. HOWEVER, THE EXPUNGEMENT OR DE-IDENTIFICATION OF PARTICULAR
CONTACT TRACING INFORMATION MAY BE POSTPONED FOR UP TO FIFTEEN DAYS
WHILE THE CONTACT TRACER OR CONTACT TRACING ENTITY IS ACTIVELY ENGAGED
IN CONTACT TRACING USING THAT INFORMATION, PROVIDED THAT THE PRINCIPAL
INDIVIDUAL OR CONTACT INDIVIDUAL TO WHOM IT PERTAINS GIVES VOLUNTARY
INFORMED CONSENT. THE DISCLOSURE, POSSESSION AND USE OF THE DE-IDENTI-
FIED CONTACT TRACING INFORMATION SHALL BE SUBJECT TO SUBDIVISION FOUR OF
THIS SECTION.
§ 2182. REGULATIONS. THE COMMISSIONER SHALL MAKE REGULATIONS IMPLE-
MENTING THIS TITLE.
§ 2. This act shall take effect immediately.