S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  6541--A
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                                May 5, 2021
                                ___________
 
 Introduced by Sens. RIVERA, BIAGGI, BORRELLO, BROUK, GOUNARDES, HOYLMAN,
   KENNEDY,  KRUEGER, MYRIE, SEPULVEDA -- read twice and ordered printed,
   and when printed to be committed to the Committee on Health --  recom-
   mitted  to  the  Committee on Health in accordance with Senate Rule 6,
   sec. 8 -- reported favorably from said committee and committed to  the
   Committee  on  Finance  -- committee discharged, bill amended, ordered
   reprinted as amended and recommitted to said committee
 
 AN ACT to amend the public health law, in  relation  to  protecting  the
   confidentiality of vaccine information
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1.  Subdivision 11 of section 2168 of the public  health  law,
 as  amended  by  chapter  154 of the laws of 2013, is amended to read as
 follows:
   11. The commissioner, or in the city of New York, the commissioner  of
 the  department  of  health  and  mental hygiene, may provide registrant
 specific immunization and lead test records TO THE FEDERAL  CENTERS  FOR
 DISEASE  CONTROL  AND PREVENTION OR ITS SUCCESSOR AGENCY, to other state
 or city registries  and  registries  maintained  by  the  Indian  Health
 Service  and tribal nations recognized by the state or the United States
 pursuant to a  written  agreement  requiring  that  the  other  registry
 conform  to national standards for maintaining the integrity of the data
 and THAT THE DATA will [not] ONLY be used  for  purposes  [inconsistent]
 CONSISTENT with the provisions of this section AND PROVIDED THAT DISCLO-
 SURE  OF  IDENTIFIABLE  REGISTRANT  INFORMATION  SHALL BE LIMITED TO THE
 MINIMUM AMOUNT NECESSARY TO ACCOMPLISH THE PURPOSES CONSISTENT WITH  THE
 PROVISIONS  OF THIS SECTION AS DETERMINED BY THE COMMISSIONER, OR IN THE
 CITY OF NEW YORK, THE COMMISSIONER  OF  THE  DEPARTMENT  OF  HEALTH  AND
 MENTAL HYGIENE.
   §  2. Section 2168 of the public health law is amended by adding a new
 subdivision 11-a to read as follows:
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD11016-02-2
              

 S. 6541--A                          2
 
   11-A. THE COMMISSIONER, OR IN THE CITY OF NEW YORK,  THE  COMMISSIONER
 OF  THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE, MAY ONLY SHARE REGISTRY
 INFORMATION WITH THE FEDERAL CENTERS FOR DISEASE CONTROL AND PREVENTION,
 OR SUCCESSOR AGENCY, FOR PUBLIC HEALTH PURPOSES IN SUMMARY, STATISTICAL,
 AGGREGATE,  OR  OTHER FORM SUCH THAT NO INDIVIDUAL PERSON CAN BE IDENTI-
 FIED, EXCEPT THAT EITHER SUCH  COMMISSIONER  MAY  DISCLOSE  IDENTIFIABLE
 REGISTRANT  INFORMATION  TO  THE FEDERAL CENTERS FOR DISEASE CONTROL AND
 PREVENTION, OR ITS SUCCESSOR AGENCY, WHEN THE  COMMISSIONER  HAS  DETER-
 MINED  THAT THE DISCLOSURE IS IN THE BEST INTERESTS OF THE REGISTRANT OR
 WILL CONTRIBUTE TO THE PROTECTION OF PUBLIC HEALTH, THAT  THE  OBJECTIVE
 OF  THE  DISCLOSURE CANNOT BE SERVED BY DISCLOSURE LIMITED TO DE-IDENTI-
 FIED INFORMATION, AND THE FEDERAL HEALTH  OFFICIALS  HAVE  COMMITTED  IN
 WRITING  NOT  TO  REDISCLOSE TO OR SHARE REGISTRANT INFORMATION WITH ANY
 OTHER FEDERAL AGENCY, INCLUDING BUT NOT LIMITED  TO  THE  DEPARTMENT  OF
 HOMELAND  SECURITY,  IMMIGRATION  AND  CUSTOMS  ENFORCEMENT, CUSTOMS AND
 BORDER PROTECTION, OR ANY SUCCESSOR AGENCY, OR ANY LAW ENFORCEMENT AGEN-
 CY; PROVIDED THAT EITHER SUCH COMMISSIONER MAY FORGO THE WRITTEN COMMIT-
 MENT IF REQUIRING WRITTEN COMMITMENT WOULD RESULT IN  THE  ACTUAL  WITH-
 HOLDING OF FEDERAL FUNDS.
   §  3.  Paragraph  (d)  of  subdivision 4 of section 2168 of the public
 health law, as amended by section 7 of part A of chapter 58 of the  laws
 of 2009, is amended to read as follows:
   (d)  [A person, institution or agency to whom such immunization infor-
 mation is furnished or to whom, access to  records  or  information  has
 been  given,  shall  not  divulge any part thereof so as to disclose the
 identity of such person to whom  such  information  or  record  relates,
 except insofar as such disclosure is necessary for the best interests of
 the  person  or  other  persons,  consistent  with  the purposes of this
 section] (I)  IDENTIFIABLE REGISTRANT INFORMATION IS NOT (1) SUBJECT  TO
 DISCOVERY,  SUBPOENA,  WARRANT,  OR  OTHER MEANS OF LEGAL COMPULSION FOR
 RELEASE TO ANY PERSON OR (2) ADMISSIBLE IN  ANY  CIVIL,  ADMINISTRATIVE,
 CRIMINAL,  OR FAMILY COURT PROCEEDING, EXCEPT FOR THE PURPOSES OF INVES-
 TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR BILL-
 ING FRAUD RELATED TO VACCINATION RECORDS, FRAUDULENT STATEMENTS  RELATED
 TO  AN  INDIVIDUAL'S VACCINATION STATUS, AN ACT OF VIOLENCE OR ATTEMPTED
 VIOLENCE OCCURRING AT THE SITE OF A VACCINATION  PROVIDER'S  OR  VACCINE
 NAVIGATOR'S  BUSINESS,  OR  MEDICAL  MALPRACTICE.   DISCLOSURE FOR THESE
 PURPOSES SHALL BE SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE  COURT
 AND,  IF THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE
 REGISTRY INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY  MATERIAL
 AND RELEVANT FOR THE PURPOSE.
   (II) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT COMMISSIONERS
 OF  LOCAL SOCIAL SERVICES DISTRICTS OR THE COMMISSIONER OF THE OFFICE OF
 CHILDREN AND FAMILY  SERVICES  FROM  ACCESSING  IDENTIFIABLE  REGISTRANT
 INFORMATION UNDER PARAGRAPH (D) OF SUBDIVISION EIGHT OF THIS SECTION.
   §    4.  Subparagraph (i) of paragraph (b) of subdivision 8 of section
 2168 of the public health law, as amended by section  7  of  part  A  of
 chapter 58 of the laws of 2009, is amended to read as follows:
   (i)  The  commissioner  may use the statewide immunization information
 system and the blood lead information in such  system  for  purposes  of
 outreach, quality improvement and accountability, INCLUDING PROFESSIONAL
 RESPONSIBILITY PROCEEDINGS OF THE OFFICE OF PROFESSIONAL MEDICAL CONDUCT
 AND  THE  STATE  EDUCATION DEPARTMENT, research, epidemiological studies
 and disease control, and to obtain blood lead test results  from  physi-
 cian  office  laboratories  for the statewide registry of lead levels of
 children established pursuant to subdivision  two  of  section  thirteen
 S. 6541--A                          3
 
 hundred  seventy-a  of this chapter; (ii) the commissioner of health and
 mental hygiene for the city of New York may use the immunization  regis-
 try  and  the  blood  lead  information  in  such system for purposes of
 outreach, quality improvement and accountability, research, epidemiolog-
 ical  studies  and disease control; (iii) local health departments shall
 have access to the immunization information system and  the  blood  lead
 information in such system for purposes of outreach, quality improvement
 and  accountability,  epidemiological studies and disease control within
 their county; and
   § 5. Paragraph (c) of subdivision 8 of  section  2168  of  the  public
 health law, as amended by chapter 420 of the laws of 2014, is amended to
 read as follows:
   (c) health care providers and their designees, registered professional
 nurses,  and pharmacists authorized to administer immunizations pursuant
 to subdivision two of section sixty-eight hundred one of  the  education
 law  shall  have access to the statewide immunization information system
 and the blood lead information in  such  system  only  for  purposes  of
 submission  of  information  about  vaccinations  received by a specific
 registrant, determination of  the  immunization  status  of  a  specific
 registrant, determination of the blood lead testing status of a specific
 registrant,  submission  of  the results from a blood lead analysis of a
 sample obtained from a specific registrant in accordance with  paragraph
 (h)  of  subdivision  two  of this section, review of practice coverage,
 generation of reminder notices, quality improvement and  accountability,
 INCLUDING  PROFESSIONAL  RESPONSIBILITY  PROCEEDINGS  OF  THE  OFFICE OF
 PROFESSIONAL MEDICAL CONDUCT AND THE  STATE  EDUCATION  DEPARTMENT,  and
 printing  a  copy  of  the  immunization  or lead testing record for the
 registrant's medical record, for the registrant's parent or guardian, or
 other person in parental or custodial relation to  a  child,  or  for  a
 registrant upon reaching eighteen years of age.
   §  6. The public health law is amended by adding a new section 2169 to
 read as follows:
   § 2169. VACCINE CONFIDENTIALITY. 1. AS USED IN  THIS  SECTION,  UNLESS
 CONTEXT REQUIRES OTHERWISE:
   (A) THE TERM "CONSENT" SHALL MEAN INFORMED, AFFIRMATIVE, AND VOLUNTARY
 AUTHORIZATION.
   (B)  THE  TERM  "DE-IDENTIFIED" SHALL MEAN THAT THE INFORMATION CANNOT
 IDENTIFY OR BE MADE TO IDENTIFY OR BE ASSOCIATED WITH A PARTICULAR INDI-
 VIDUAL, DIRECTLY OR INDIRECTLY, AND IS SUBJECT TO  TECHNICAL  SAFEGUARDS
 AND  POLICIES  AND  PROCEDURES  THAT  PREVENT RE-IDENTIFICATION, WHETHER
 INTENTIONALLY OR UNINTENTIONALLY, OF ANY INDIVIDUAL.
   (C) THE TERM "DISCLOSURE" SHALL MEAN RELEASE, TRANSFER, PROVISION  OF,
 ACCESS  TO,  OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE
 ENTITY HOLDING THE INFORMATION.
   (D) THE  TERM  "IMMIGRATION  AUTHORITY"  MEANS  ANY  ENTITY,  OFFICER,
 EMPLOYEE,  OR  GOVERNMENT  EMPLOYEE  OR  AGENT  THEREOF  CHARGED WITH OR
 ENGAGED IN ENFORCEMENT OF THE FEDERAL IMMIGRATION AND  NATIONALITY  ACT,
 INCLUDING  THE UNITED STATES IMMIGRATION AND CUSTOMS ENFORCEMENT, UNITED
 STATES DEPARTMENT OF HOMELAND SECURITY, OR  UNITED  STATES  CUSTOMS  AND
 BORDER  PROTECTION,  OR  AGENT,  CONTRACTOR, OR EMPLOYEE THEREOF, OR ANY
 SUCCESSOR LEGISLATION OR ENTITY.
   (E) THE TERM "LAW ENFORCEMENT AGENT OR ENTITY" MEANS ANY  GOVERNMENTAL
 ENTITY  OR  PUBLIC  SERVANT,  OR  AGENT, CONTRACTOR OR EMPLOYEE THEREOF,
 AUTHORIZED TO INVESTIGATE, PROSECUTE, OR MAKE AN ARREST FOR  A  CRIMINAL
 OR  CIVIL  OFFENSE,  OR ENGAGED IN ANY SUCH ACTIVITY, BUT SHALL NOT MEAN
 THE DEPARTMENT, THE COMMISSIONER, A HEALTH DISTRICT, A COUNTY DEPARTMENT
 S. 6541--A                          4
 
 OF HEALTH, A COUNTY HEALTH COMMISSIONER, A  LOCAL  BOARD  OF  HEALTH,  A
 LOCAL HEALTH OFFICER, THE DEPARTMENT OF HEALTH AND MENTAL HYGIENE OF THE
 CITY  OF  NEW  YORK, OR THE COMMISSIONER OF THE DEPARTMENT OF HEALTH AND
 MENTAL HYGIENE OF THE CITY OF NEW YORK.
   (F)  THE  TERM  "PERSONAL INFORMATION" SHALL MEAN INFORMATION OBTAINED
 FROM OR ABOUT AN INDIVIDUAL, IN CONNECTION WITH THEIR REGISTERING FOR OR
 RECEIVING A VACCINATION, THAT DIRECTLY OR INDIRECTLY IDENTIFIES, RELATES
 TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD  REASONABLY
 BE  LINKED  TO  A  PARTICULAR INDIVIDUAL, HOUSEHOLD, OR PERSONAL DEVICE.
 INFORMATION IS REASONABLY  LINKABLE  TO  AN  INDIVIDUAL,  HOUSEHOLD,  OR
 PERSONAL  DEVICE  IF  IT  CAN  BE USED ON ITS OWN OR IN COMBINATION WITH
 OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER
 INFORMATION IS HELD BY THE VACCINE NAVIGATOR  OR  VACCINE  PROVIDER,  TO
 IDENTIFY AN INDIVIDUAL, HOUSEHOLD, OR A PERSONAL DEVICE.
   (G) THE TERM "SERVICE ATTENDANT TO THE DELIVERY OF IMMUNIZATION" SHALL
 MEAN  SCHEDULING  AND  BILLING  FOR AN IMMUNIZATION APPOINTMENT, SENDING
 REMINDERS ABOUT IMMUNIZATION, ARRANGING  TRANSPORTATION  TO  OR  FROM  A
 VACCINE  PROVIDER,  OR  REPORTING  TO  THE DEPARTMENT, THE NEW YORK CITY
 DEPARTMENT OF HEALTH AND MENTAL HYGIENE, OR OTHER LOCAL HEALTH AGENCY ON
 WHOSE BEHALF SUCH VACCINE NAVIGATOR IS PERFORMING SUCH SERVICES.
   (H) THE TERM "USE" SHALL MEAN, WITH RESPECT TO  PERSONAL  INFORMATION,
 THE SHARING, EMPLOYMENT, APPLICATION, UTILIZATION, EXAMINATION OR ANALY-
 SIS  OF  SUCH  INFORMATION WITHIN AN ENTITY THAT MAINTAINS SUCH INFORMA-
 TION.
   (I) THE TERM "VACCINE NAVIGATOR" SHALL MEAN ANY PERSON  THAT  COLLECTS
 PERSONAL  INFORMATION FROM AN INDIVIDUAL IN ORDER TO REGISTER THAT INDI-
 VIDUAL FOR IMMUNIZATION OR TO HELP THAT INDIVIDUAL REGISTER FOR  IMMUNI-
 ZATION,  PROVIDED  THE  DEPARTMENT,  A  LOCAL PUBLIC HEALTH AGENCY, OR A
 PERSON THAT ADMINISTERS VACCINES ARE NOT VACCINE NAVIGATORS IF THEY ONLY
 STORE  VACCINE  RECIPIENT  PERSONAL  INFORMATION  IN   MEDICAL   RECORDS
 PROTECTED  UNDER  THE  FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNT-
 ABILITY ACT OF 1996, ITS IMPLEMENTING REGULATIONS, OR  SECTION  EIGHTEEN
 OF THIS CHAPTER.
   2. (A) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION, ABSENT
 CONSENT  FROM  THE INDIVIDUAL SEEKING IMMUNIZATION, OR IF THE INDIVIDUAL
 LACKS THE CAPACITY TO MAKE HEALTH CARE DECISIONS, AN INDIVIDUAL  AUTHOR-
 IZED  TO  CONSENT  TO HEALTH CARE FOR THE INDIVIDUAL OR THE INDIVIDUAL'S
 LEGAL REPRESENTATIVE, A VACCINE NAVIGATOR SHALL NOT  USE,  DISCLOSE,  OR
 MAINTAIN  PERSONAL  INFORMATION  EXCEPT AS NECESSARY TO PROVIDE SERVICES
 ATTENDANT TO THE DELIVERY OF IMMUNIZATION.
   (B) A VACCINE NAVIGATOR MAY REQUEST CONSENT FROM AN INDIVIDUAL, OR  IF
 THE  INDIVIDUAL  LACKS  THE  CAPACITY  TO MAKE HEALTH CARE DECISIONS, AN
 INDIVIDUAL AUTHORIZED TO CONSENT TO HEALTH CARE FOR  THE  INDIVIDUAL  OR
 THE INDIVIDUAL'S LEGAL REPRESENTATIVE, TO USE, DISCLOSE, OR MAINTAIN THE
 INDIVIDUAL'S  PERSONAL  INFORMATION  FOR  PURPOSES  OTHER  THAN SERVICES
 ATTENDANT TO THE DELIVERY OF IMMUNIZATION PROVIDED THAT:
   (I) A VACCINE NAVIGATOR SHALL NOT REFUSE TO PROVIDE A SERVICE  ATTEND-
 ANT  TO  THE  DELIVERY  OF  IMMUNIZATION  FOR AN INDIVIDUAL WHO DOES NOT
 PROVIDE SUCH CONSENT;
   (II) A VACCINE NAVIGATOR SHALL NOT RELATE THE PRICE OR QUALITY OF  ANY
 SERVICE  ATTENDANT  TO  THE  DELIVERY  OF  IMMUNIZATION  TO  THE PRIVACY
 PROTECTIONS AFFORDED THE INDIVIDUAL, INCLUDING BY PROVIDING  A  DISCOUNT
 OR  OTHER  INCENTIVE  IN  EXCHANGE  FOR SUCH CONSENT, PROVIDED THAT THIS
 PARAGRAPH DOES NOT PROHIBIT THE OFFERING OF INCENTIVES TO INDIVIDUALS TO
 GET VACCINATED; PROVIDED THAT SUCH INCENTIVES SHALL NOT  BE  CONDITIONED
 ON  AN  INDIVIDUAL'S CONSENT TO ADDITIONAL USES, DISCLOSURES, OR MAINTE-
 S. 6541--A                          5
 
 NANCE OF THEIR PERSONAL INFORMATION EXCEPT AS NECESSARY TO  PROVIDE  THE
 INCENTIVE; AND
   (III) A VACCINE NAVIGATOR SHALL CLEARLY DELINEATE WHAT PERSONAL INFOR-
 MATION IS ADEQUATE, RELEVANT, AND NECESSARY TO PROVIDE A SERVICE ATTEND-
 ANT  TO  THE DELIVERY OF IMMUNIZATION BY CLEARLY AND CONSPICUOUSLY INDI-
 CATING IN ANY SOLICITATION FOR THE INFORMATION THAT ALL  OTHER  REQUESTS
 FOR PERSONAL INFORMATION ARE OPTIONAL.
   (C) EXCEPT AS PROVIDED IN PARAGRAPH (D) OF THIS SUBDIVISION:
   (I) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION OR OTHERWISE
 MAKE  PERSONAL  INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO A LAW
 ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY;
   (II) NO VACCINE NAVIGATOR MAY PROVIDE PERSONAL INFORMATION  OR  OTHER-
 WISE  MAKE  PERSONAL  INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO
 ANY OTHER INDIVIDUAL OR ENTITY, EXCEPT AS EXPLICITLY AUTHORIZED BY  THIS
 TITLE; AND
   (III) WITHOUT CONSENT UNDER THIS SUBDIVISION, PERSONAL INFORMATION AND
 ANY  EVIDENCE  DERIVED  THEREFROM SHALL NOT BE SUBJECT TO OR PROVIDED IN
 RESPONSE TO ANY LEGAL PROCESS OR BE ADMISSIBLE FOR ANY  PURPOSE  IN  ANY
 JUDICIAL OR ADMINISTRATIVE ACTION OR PROCEEDING.
   (D)  (I)  THIS  SECTION  DOES  NOT  BAR  OTHERWISE  LAWFUL DISCLOSURE,
 POSSESSION OR USE OF INFORMATION PERTAINING TO SERVICES ATTENDANT TO THE
 DELIVERY OF IMMUNIZATION, INCLUDING AGGREGATE INFORMATION, THAT IS DE-I-
 DENTIFIED.  DISCLOSURE, POSSESSION OR USE UNDER THIS SUBPARAGRAPH  SHALL
 ONLY BE FOR A PUBLIC HEALTH OR PUBLIC HEALTH RESEARCH PURPOSES.
   (II)  A  PERSON  MAY  ONLY  POSSESS  OR  USE DE-IDENTIFIED INFORMATION
 PERTAINING TO SERVICES ATTENDANT TO THE DELIVERY OF IMMUNIZATION IF  THE
 PERSON  MAINTAINS  TECHNICAL SAFEGUARDS AND POLICIES AND PROCEDURES THAT
 PREVENT RE-IDENTIFICATION, WHETHER INTENTIONAL OR UNINTENTIONAL, OF  ANY
 INDIVIDUAL, AS MAY BE REQUIRED BY THE COMMISSIONER (OR THE NEW YORK CITY
 COMMISSIONER  OF  HEALTH  AND MENTAL HYGIENE, IN THE CASE OF INFORMATION
 COLLECTED BY OR UNDER AUTHORITY OF  THE  NEW  YORK  CITY  DEPARTMENT  OF
 HEALTH  AND  MENTAL  HYGIENE.  THE  COMMISSIONER  (OR  THE NEW YORK CITY
 COMMISSIONER AS THE CASE MAY BE) SHALL REQUIRE SAFEGUARDS, POLICIES  AND
 PROCEDURES UNDER THIS PARAGRAPH AS THE COMMISSIONER DEEMS PRACTICABLE.
   (III)  DISCLOSURE,  POSSESSION  AND  USE  OF DE-IDENTIFIED INFORMATION
 UNDER THIS SUBDIVISION SHALL BE ONLY PURSUANT TO APPROVAL BY THE COMMIS-
 SIONER (OR THE NEW YORK CITY COMMISSIONER OF HEALTH AND  MENTAL  HYGIENE
 IN  THE  CASE  OF INFORMATION COLLECTED BY OR UNDER AUTHORITY OF THE NEW
 YORK CITY DEPARTMENT  OF  HEALTH  AND  MENTAL  HYGIENE)  SPECIFYING  THE
 PURPOSE,  NATURE  AND  SCOPE  OF  THE DISCLOSURE, POSSESSION AND USE AND
 MEASURES TO ENSURE THAT IT WILL COMPLY WITH THIS SECTION AND  THE  TERMS
 OF THE APPROVAL.
   (IV)  THIS SECTION DOES NOT PREVENT DISCLOSURE OF PERSONAL INFORMATION
 SOUGHT FOR THE PURPOSES OF  INVESTIGATIONS AND PROSECUTIONS  OF  ALLEGA-
 TIONS  OF  COMPUTER  TAMPERING  OR  BILLING FRAUD RELATED TO VACCINATION
 RECORDS, FRAUDULENT STATEMENTS RELATED TO  AN  INDIVIDUAL'S  VACCINATION
 STATUS,  AN  ACT OF VIOLENCE OR ATTEMPTED VIOLENCE OCCURRING AT THE SITE
 OF A VACCINATION PROVIDER'S OR VACCINE NAVIGATOR'S BUSINESS, OR  MEDICAL
 MALPRACTICE,  PROFESSIONAL  DISCIPLINE,  OR DEFENSE OF ANY CLAIM BROUGHT
 AGAINST A VACCINE NAVIGATOR OR PROVIDER.  DISCLOSURE FOR THESE  PURPOSES
 SHALL  BE  SUBJECT TO IN CAMERA REVIEW AND APPROVAL BY THE COURT AND, IF
 THE USE IS INITIATED BY A PARTY OTHER THAN THE INDIVIDUAL WHOSE REGISTRY
 INFORMATION IS SOUGHT, THE INFORMATION MUST BE HIGHLY MATERIAL AND RELE-
 VANT FOR THE PURPOSE.
   (E) A VACCINE NAVIGATOR  THAT  MAINTAINS  PERSONAL  INFORMATION  SHALL
 ESTABLISH  APPROPRIATE  ADMINISTRATIVE,  TECHNICAL,  AND  PHYSICAL SAFE-
 S. 6541--A                          6
 
 GUARDS, POLICIES, AND  PROCEDURES  THAT  ENSURE  THE  SECURITY  OF  THAT
 PERSONAL  INFORMATION.  THE SAFEGUARDS, POLICIES, AND PROCEDURES MUST BE
 APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL  INFORMATION  MAIN-
 TAINED  AND THE SIZE, REVENUE, AND SOPHISTICATION OF THE VACCINE NAVIGA-
 TOR AND MUST ENSURE THAT PERSONAL INFORMATION IS ENCRYPTED AND PROTECTED
 AT LEAST AS MUCH AS OR MORE THAN OTHER CONFIDENTIAL INFORMATION  IN  THE
 VACCINE  NAVIGATOR'S POSSESSION. THE COMMISSIONER OR, IN THE CITY OF NEW
 YORK, THE COMMISSIONER OF THE DEPARTMENT OF HEALTH  AND  MENTAL  HYGIENE
 SHALL  MAKE REGULATIONS AS REASONABLY NECESSARY TO REQUIRE THAT PERSONAL
 INFORMATION POSSESSED, USED, OR UNDER THE CONTROL OF A VACCINE NAVIGATOR
 SHALL BE SUBJECT TO TECHNICAL SAFEGUARDS, POLICIES, AND  PROCEDURES  FOR
 STORAGE, TRANSMISSION, USE, AND PROTECTION OF THE INFORMATION. THE REGU-
 LATIONS MUST TAKE INTO ACCOUNT THE DIFFERENT SIZES, REVENUES AND SOPHIS-
 TICATIONS  OF  DIFFERENT  VACCINE  NAVIGATORS, AS WELL AS THE VOLUME AND
 NATURE OF THE PERSONAL INFORMATION THEY MAINTAIN.
   (F) NOTHING IN THIS SECTION SHALL LIMIT A VACCINE NAVIGATOR THAT HAS A
 PRE-EXISTING  SERVICE  PROVIDER-CLIENT,  PROVIDER-PATIENT,  OR  FAMILIAL
 RELATIONSHIP  OR  A  FRIENDSHIP  WITH AN INDIVIDUAL FROM PROCESSING THAT
 INDIVIDUAL'S PERSONAL INFORMATION AS PREVIOUSLY AGREED TO IN THE  COURSE
 OF THE PRE-EXISTING RELATIONSHIP.
   3.  VACCINE PROVIDERS. A VACCINE PROVIDER SHALL NOT DELAY OR CONDITION
 THE PROVISION OF ANY SERVICE ATTENDANT TO THE DELIVERY  OF  IMMUNIZATION
 BY  INVITING  OR REQUIRING AN INDIVIDUAL SEEKING VACCINATION TO COMPLETE
 AN APPLICATION FOR A CUSTOMER DISCOUNT CARD OR ACCOUNT OR SHARE PERSONAL
 INFORMATION THAT WILL BE STORED OUTSIDE OF A  MEDICAL  RECORD  PROTECTED
 UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF
 1996,  ITS IMPLEMENTING REGULATIONS, OR SECTION EIGHTEEN OF THIS CHAPTER
 FOR PURPOSES OTHER THAN SERVICES ATTENDANT TO THE DELIVERY OF  IMMUNIZA-
 TION, OR BY ENGAGING IN ANY OTHER ACTIVITY UNRELATED TO THE PROVISION OF
 SUCH A SERVICE THAT THE COMMISSIONER DESIGNATES BY REGULATION.
   §  7.  Section 2180 of the public health law is amended by adding nine
 new subdivisions 12, 13, 14, 15, 16, 17,  18,  19  and  20  to  read  as
 follows:
   12.  "COVERED ENTITY" MEANS A GOVERNMENTAL ENTITY OR A PLACE OF PUBLIC
 ACCOMMODATION, RESORT OR AMUSEMENT, AS DEFINED IN  SECTION  TWO  HUNDRED
 NINETY-TWO OF THE EXECUTIVE LAW.
   13.   "DERIVED  FROM  AN  IMMUNITY  PASSPORT"  MEANS  ANY  INFORMATION
 CONTAINED IN OR RETRIEVED FROM AN IMMUNITY  PASSPORT,  AS  WELL  AS  ANY
 METADATA ASSOCIATED WITH THE USE OF THE IMMUNITY PASSPORT, INCLUDING THE
 TIME  AND LOCATION THE IMMUNITY PASSPORT WAS USED, AS WELL AS ANY INFER-
 ENCES MADE BASED ON THE INFORMATION CONTAINED IN AN IMMUNITY PASSPORT OR
 AN IMMUNITY PASSPORT'S USAGE.
   14. "DISCLOSE" MEANS THE RELEASE, TRANSFER, PROVISION OF,  ACCESS  TO,
 OR DIVULGING IN ANY OTHER MANNER OF INFORMATION OUTSIDE THE ENTITY HOLD-
 ING THE INFORMATION.
   15. "GOVERNMENTAL ENTITY" MEANS A DEPARTMENT OR AGENCY OF THE STATE OR
 A  POLITICAL  SUBDIVISION THEREOF, AN INDIVIDUAL ACTING FOR OR ON BEHALF
 OF THE STATE OR A POLITICAL SUBDIVISION THEREOF, OR ANY ENTITY REGULATED
 UNDER THE SOCIAL SERVICES LAW.
   16. "IMMUNITY PASSPORT" MEANS A CREDENTIAL, WHETHER DIGITAL, ELECTRON-
 IC, OR PHYSICAL, THAT IDENTIFIES AN  INDIVIDUAL  AS  HAVING  RECEIVED  A
 COVID-19 VACCINE OR A COVID-19 TEST RESULT.
   17.  "IMMUNITY  PASSPORT PROVIDER" MEANS A LEGAL ENTITY THAT DEVELOPS,
 MAINTAINS, DISTRIBUTES, OR MARKETS IMMUNITY PASSPORTS IN NEW YORK STATE.
   18. "PERSONAL INFORMATION" MEANS INFORMATION THAT  DIRECTLY  OR  INDI-
 RECTLY IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED
 S. 6541--A                          7
 
 WITH,  OR  COULD  REASONABLY  BE  LINKED  TO  A PARTICULAR INDIVIDUAL OR
 PERSONAL DEVICE.  INFORMATION IS REASONABLY LINKABLE TO AN INDIVIDUAL OR
 PERSONAL DEVICE IF IT CAN BE USED ON ITS  OWN  OR  IN  COMBINATION  WITH
 OTHER REASONABLY AVAILABLE INFORMATION, REGARDLESS OF WHETHER SUCH OTHER
 INFORMATION IS HELD BY THE COVERED ENTITY OR IMMUNITY PASSPORT PROVIDER,
 TO IDENTIFY AN INDIVIDUAL OR A PERSONAL DEVICE.
   19. "PHYSICAL IMMUNITY PASSPORT" MEANS A CREDENTIAL THAT IDENTIFIES AN
 INDIVIDUAL  AS  HAVING  RECEIVED  A  COVID-19 VACCINE OR A COVID-19 TEST
 RESULT THAT DOES NOT RELY ON A DIGITAL OR ELECTRONIC DEVICE.    PHYSICAL
 IMMUNITY  PASSPORTS  INCLUDE,  BUT  ARE  NOT LIMITED TO, PIECES OF PAPER
 DENOTING IMMUNITY STATUS.
   20. "USE" MEANS, WITH RESPECT TO PERSONAL  INFORMATION,  THE  SHARING,
 EMPLOYMENT,  APPLICATION,  UTILIZATION, EXAMINATION, OR ANALYSIS OF SUCH
 INFORMATION WITHIN AN ENTITY THAT MAINTAINS SUCH INFORMATION.
   § 8. The public health law is amended by adding a new section 2183  to
 read as follows:
   §  2183. IMMUNITY PASSPORTS. 1. ANY COVERED ENTITY THAT REQUIRES PROOF
 OF COVID-19 IMMUNIZATION SHALL PERMIT THE USE OF PHYSICAL IMMUNITY PASS-
 PORTS.  NO COVERED ENTITY MAY REQUIRE  DIGITAL,  ELECTRONIC,  OR  SMART-
 PHONE-BASED PROOF OF IMMUNITY.
   2.  ANY  COVERED  ENTITY THAT REQUIRES THE USE OF AN IMMUNITY PASSPORT
 SHALL DELETE ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT
 ABOUT THE INDIVIDUAL TO WHOM THE IMMUNITY PASSPORT PERTAINS WITHIN TWEN-
 TY-FOUR HOURS OF RECEIVING IT, EXCEPT THAT WHERE A COVERED ENTITY HAS AN
 ONGOING RELATIONSHIP WITH AN INDIVIDUAL, THE COVERED  ENTITY  MAY  STORE
 THE FACT THAT THE INDIVIDUAL HAS RECEIVED A COVID-19 VACCINE, AS WELL AS
 A COPY OF THE INDIVIDUAL'S IMMUNITY PASSPORT, PROVIDED THAT:
   (A) THE COVERED ENTITY FIRST OBTAINS THE INDIVIDUAL'S INFORMED, AFFIR-
 MATIVE, AND VOLUNTARY CONSENT TO STORE SUCH INFORMATION, AND
   (B)  THE  COVERED  ENTITY  STORES ANY COPY OF AN INDIVIDUAL'S IMMUNITY
 PASSPORT AND ANY PERSONAL INFORMATION DERIVED FROM THE IMMUNITY PASSPORT
 AS IF THEY WERE SUBJECT TO THE CONFIDENTIALITY REQUIREMENTS OF  TITLE  I
 OF THE AMERICANS WITH DISABILITIES ACT 42 U.S.C. 12112(D) AND ITS IMPLE-
 MENTING REGULATIONS, 29 CFR 1630.14.
   3.  AN  IMMUNITY  PASSPORT PROVIDER SHALL NOT USE OR DISCLOSE PERSONAL
 INFORMATION DERIVED FROM AN IMMUNITY PASSPORT BEYOND WHAT  IS  ADEQUATE,
 RELEVANT,  AND  NECESSARY TO IDENTIFY AN INDIVIDUAL AS HAVING RECEIVED A
 COVID-19 VACCINE OR A  COVID-19  TEST  RESULT  AND  SHALL  NOT  COLLECT,
 ACCESS,  RECEIVE,  CAPTURE,  STORE,  MAINTAIN, USE, OR DISCLOSE PERSONAL
 INFORMATION PERTAINING TO WHERE OR WHEN AN INDIVIDUAL USES  AN  IMMUNITY
 PASSPORT.
   4.  (A)  EXCEPT  AS PROVIDED IN THIS SUBDIVISION, NO COVERED ENTITY OR
 IMMUNITY PASSPORT PROVIDER MAY:
   (I) PROVIDE PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT  OR
 OTHERWISE  MAKE  SUCH PERSONAL INFORMATION ACCESSIBLE, DIRECTLY OR INDI-
 RECTLY, TO A LAW ENFORCEMENT AGENT OR ENTITY OR IMMIGRATION AUTHORITY;
   (II) PROVIDE SUCH PERSONAL INFORMATION OR OTHERWISE MAKE SUCH PERSONAL
 INFORMATION ACCESSIBLE, DIRECTLY OR INDIRECTLY, TO ANY OTHER  INDIVIDUAL
 OR ENTITY EXCEPT AS EXPLICITLY AUTHORIZED BY THIS SECTION.
   (B)  EXCEPT  AS  PROVIDED  IN  THIS  SUBDIVISION, PERSONAL INFORMATION
 DERIVED FROM AN IMMUNITY PASSPORT, AND ANY EVIDENCE  DERIVED  THEREFROM,
 SHALL  NOT BE SUBJECT TO OR PROVIDED IN RESPONSE TO ANY LEGAL PROCESS OR
 BE ADMISSIBLE FOR ANY PURPOSE IN ANY JUDICIAL OR  ADMINISTRATIVE  ACTION
 OR PROCEEDING.
   (C)    PERSONAL INFORMATION DERIVED FROM AN IMMUNITY PASSPORT, AND ANY
 EVIDENCE DERIVED THEREFROM, MAY BE DISCLOSED FOR THE PURPOSES OF  INVES-
 S. 6541--A                          8
 
 TIGATIONS AND PROSECUTIONS OF ALLEGATIONS OF COMPUTER TAMPERING OR FRAU-
 DULENT   STATEMENTS  RELATED  TO  AN  INDIVIDUAL'S  VACCINATION  STATUS.
 DISCLOSURE FOR THESE PURPOSES SHALL BE SUBJECT TO IN CAMERA  REVIEW  AND
 APPROVAL BY THE COURT AND, IF THE USE IS INITIATED BY A PARTY OTHER THAN
 THE  INDIVIDUAL  WHOSE  PERSONAL  INFORMATION IS SOUGHT, THE INFORMATION
 MUST BE HIGHLY MATERIAL AND RELEVANT FOR THE PURPOSE.
   5. THE COMMISSIONER SHALL MAKE REGULATIONS AS REASONABLY NECESSARY  TO
 ENSURE THAT INDIVIDUALS WHO ARE MEDICALLY CONTRAINDICATED FROM RECEIVING
 THE  COVID-19 VACCINE ARE NONETHELESS ABLE TO OBTAIN REASONABLE ACCOMMO-
 DATIONS TO ENABLE THEM TO ACCESS THE SERVICES OF A COVERED ENTITY, IN  A
 MANNER  THAT  DOES NOT IMPOSE AN UNDUE HARDSHIP ON THE COVERED ENTITY OR
 PRESENT A DIRECT THREAT THAT CANNOT BE ADDRESSED BY A REASONABLE  ACCOM-
 MODATION.
   6.  NOTHING IN THIS SECTION REQUIRES A COVERED ENTITY TO REQUIRE PROOF
 OF  COVID-19  IMMUNITY  OR  TO  INDEPENDENTLY  VERIFY  THE   INFORMATION
 CONTAINED IN AN IMMUNITY PASSPORT.
   7. NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT A COVERED ENTI-
 TY'S  OBLIGATIONS  UNDER  THE  AMERICANS  WITH DISABILITIES ACT, ARTICLE
 FIFTEEN OF THE EXECUTIVE LAW, THE CIVIL RIGHTS LAW, OR ANY OTHER  FEDER-
 AL, STATE, OR LOCAL ANTI-DISCRIMINATION LAW.
   8.  NOTHING IN THIS SECTION SHALL BE CONSTRUED TO AFFECT THE PRACTICES
 OF A HEALTH CARE PROVIDER, AS DEFINED IN SECTION EIGHTEEN OF THIS  CHAP-
 TER,  A  HOSPITAL OR NURSING HOME AS DEFINED IN ARTICLE TWENTY-EIGHT  OF
 THIS CHAPTER, A HEALTH PRACTITIONER AS  DEFINED  IN  SECTION  TWENTY-ONE
 HUNDRED  SIXTY-FOUR  OF  THIS CHAPTER, A FACILITY, AS DEFINED IN SECTION
 33.13 OF THE MENTAL  HYGIENE  LAW,  OR  A  CORRECTIONAL  HEALTH  SERVICE
 GOVERNED BY THE DEPARTMENT OF CORRECTIONS AND COMMUNITY SUPERVISION, THE
 RULES  OF  THE  BOARD OF CORRECTION IN THE CITY OF NEW YORK, OR A COUNTY
 BOARD OF CORRECTION, WITH RESPECT TO RECORDS CONCERNING THEIR  PATIENTS'
 VACCINATIONS.
   § 9. Severability. If any provision of this act, or any application of
 any  provision of this act, is held to be invalid, that shall not affect
 the validity or effectiveness of any other provision of this act, or  of
 any  other  application of any provision of this act, which can be given
 effect without that provision or  application;  and  to  that  end,  the
 provisions and applications of this act are severable.
   § 10. This act shall take effect immediately.