§ 2181. COVID-19 contact tracing; confidentiality. 1. (a) All contact
tracing information shall be kept confidential by any contact tracer,
contact tracing entity, or designated non-governmental entity and may
not be disclosed except as necessary to carry out contact tracing or a
permitted purpose. A designated non-governmental entity may only act in
relation to contact tracing information as explicitly authorized by this
title.

(b) Where a contact tracer or contact tracing entity discloses contact
tracing information for a permitted purpose, the contact tracer or
contact tracing entity shall make a record of the disclosure, including
to whom it was made and when it was made, which shall be part of the
contact tracing information.

(c) Nothing in this title prohibits otherwise lawful voluntary
reporting, at the discretion of the contact tracer, reasonably and in
good faith: (i) to the statewide central registry under title six of
article six of the social services law, adult protective services under
titles one and two of article nine-B of the social services law, or the
justice center for the protection of people with special needs under
article eleven of the social services law; or (ii) to a governmental or
non-governmental emergency reporting system (such as a "911," domestic
violence or suicide prevention system) to prevent imminent risk of
injury to any person.

(d) This title does not limit disclosure to or by, or possession or
use by, the case individual or contact individual who is the subject of
the information.

2. (a) An individual may waive the confidentiality provided for by
this section, only by a written, informed and voluntary waiver, in plain
language and in a language understandable to the individual making the
waiver, and not part of any other document. The waiver shall state the
scope and limit of the waiver. No contact tracer, contact tracing entity
or governmental or non-governmental entity may seek or act in reliance
on a waiver to distribute, sell, or otherwise disclose identifiable or
de-identified data to any individual or entity. Provided however,
nothing in this subdivision shall prohibit distribution or disclosure
that is otherwise explicitly authorized by this section. If an
individual lacks the capacity to make a waiver, an individual authorized
to consent to health care for the individual, or the individual's legal
representative, may make the waiver. However, a waiver of
confidentiality is not required to be written if it is solely for the
purpose of arranging or providing support for the individual who is the
subject of the contact tracing information, provided the consent is
informed and voluntary.

(b) A waiver of confidentiality under this section shall only apply
for the purpose of arranging or providing support if the individual who
is the subject of the contact tracing information (or, if the individual
lacks the capacity to provide informed consent, an individual authorized
to consent to health care for the individual, or the individual's legal
representative) provides voluntary informed consent to the arranging or
providing of the support.

3. A disclosure of contact tracing information authorized under this
section shall be limited in scope as to the identity of any individual,
the information to be disclosed, and the party to which disclosure may
be made, and as necessary to achieve the purpose of the disclosure under
this section, and shall not authorize re-disclosure except as explicitly
authorized by the terms of the waiver under this section. However, this
section does not bar disclosure of contact tracing information
pertaining to and identifying a case individual or contact individual by
the individual who is identified.

4. (a) This section does not bar otherwise-lawful disclosure,
possession or use of de-identified contact tracing information,
including aggregate contact tracing information. Disclosure, possession
or use under this subdivision shall only be for a public health or
public health research or evaluation purpose as determined by the
commissioner (or the commissioner of the New York city department of
health and mental hygiene in the case of contact tracing information
collected by or under authority of the New York city department of
health and mental hygiene or the New York city health and hospitals
corporation), and shall not authorize re-disclosure or other use.

(b) A person or entity may only disclose, possess or use de-identified
contact tracing information if the person or entity, and the person or
entity to which it is disclosed, maintains technical safeguards and
policies and procedures that prevent re-identification, whether
intentional or unintentional, of any individual, as may be required by
the commissioner (or the New York city commissioner of health and mental
hygiene in the case of contact tracing information collected by or under
authority of the New York city department of health and mental hygiene
or the New York city health and hospitals corporation). The commissioner
(or the New York city commissioner as the case may be) shall require
safeguards, policies and procedures under this paragraph as the
commissioner deems practicable.

(c) Disclosure, possession and use of de-identified contact tracing
information under this subdivision shall be only pursuant to approval by
the commissioner (or the New York city commissioner of health and mental
hygiene in the case of contact tracing information collected by or under
authority of the New York city department of health and mental hygiene
or the New York city health and hospitals corporation) specifying the
purpose, nature and scope of the disclosure, possession and use and
measures to ensure that it will comply with this section and the terms
of the approval.

5. No law enforcement agent or entity or immigration authority shall
be a contact tracer or contact tracing entity or engage in contact
tracing. This subdivision does not bar an individual who is associated
with a law enforcement entity or immigration authority from acting only
as a case individual or contact individual. This subdivision does not
prevent a law enforcement agent or entity from assisting in a permitted
use under paragraph (b) of subdivision eleven of section twenty-one
hundred eighty of this title.

6. No contact tracer, contact tracing entity or designated
non-governmental entity may provide contact tracing information to a law
enforcement agent, entity or immigration authority, or any individual or
entity other than the contact tracing entity from which it received the
information, except as explicitly authorized by this title. Without
consent under subdivision two of this section, contact tracing
information and any evidence derived therefrom shall not be subject to
or provided in response to any legal process or be admissible for any
purpose in any judicial or administrative action or proceeding. However,
this subdivision does not restrict providing information, relating to a
specified case individual or contact individual, where and only to the
extent necessary for a permitted purpose.

7. (a) Contact tracing entities shall establish appropriate
administrative, technical and physical safeguards, policies and
procedures that ensure the security of contact tracing information under
the entity's jurisdiction. The safeguards, policies and procedures must
ensure contact tracing information is encrypted and protected at least
as much as or more than other confidential information under the
entity's jurisdiction. All storage of contact tracing information shall
meet the requirements of this title. The commissioner (or the New York
city commissioner of health and mental hygiene in the case of contact
tracing information collected by or under authority of the New York city
department of health and mental hygiene or the New York city health and
hospitals corporation) shall make regulations as reasonably necessary to
require that contact tracing information possessed, used or under the
control of a contact tracer or contact tracing entity shall be subject
to technical safeguards, policies and procedures for storage,
transmission, use and protection of the information. The regulations
shall prevent possession, use or disclosure of the contact tracing
information not permitted by this title, and shall be at least as or
more protective than the safeguards, policies and procedures the
commissioner (or the New York city commissioner as the case may be)
provides for other confidential information.

(b) This paragraph applies to a contact tracer or contact tracing
entity that is a non-governmental individual or entity employed by or
under contract with a governmental entity, or an agent thereof. Within
sixty days of collecting or receiving the contact tracing information,
the entity shall (i) remove information from its possession or control
and deliver it to the appropriate governmental contact tracing entity or
a designated non-governmental entity specified by the governmental
contact tracing entity, retaining no copy of it; (ii) expunge the
information from its possession or control; or (iii) de-identify the
information. However, the expungement or de-identification of
particular contact tracing information may be postponed for up to
fifteen days after the initial sixty day period while the contact tracer
or contact tracing entity is actively engaged in contact tracing using
that information, provided that the case individual or contact
individual to whom it pertains gives voluntary informed consent. The
disclosure, possession and use of the de-identified contact tracing
information shall be subject to subdivision four of this section.