§ 3371. Confidentiality of certain records, reports, and information.
1. No person, who has knowledge by virtue of his or her office of the
identity of a particular patient or research subject, a manufacturing
process, a trade secret or a formula shall disclose such knowledge, or
any report or record thereof, except:

(a) to another person employed by the department, for purposes of
executing provisions of this article;

(b) pursuant to judicial subpoena or court order in a criminal
investigation or proceeding;

(c) to an agency, department of government, or official board
authorized to regulate, license or otherwise supervise a person who is
authorized by this article to deal in controlled substances, or in the
course of any investigation or proceeding by or before such agency,
department or board;

(d) to the prescription monitoring program registry and to authorized
users of such registry as set forth in subdivision two of this section;

(e) to a practitioner to inform him or her that a patient may be under
treatment with a controlled substance by another practitioner for the
purposes of subdivision two of this section, and to facilitate the
department's review of individual challenges to the accuracy of
controlled substances histories pursuant to subdivision six of section
thirty-three hundred forty-three-a of this article;

(f) to a pharmacist to provide information regarding prescriptions for
controlled substances presented to the pharmacist for the purposes of
subdivision two of this section and to facilitate the department's
review of individual challenges to the accuracy of controlled substances
histories pursuant to subdivision six of section thirty-three hundred
forty-three-a of this article;

(g) to the deputy attorney general for medicaid fraud control, or his
or her designee, in furtherance of an investigation of fraud, waste or
abuse of the Medicaid program, pursuant to an agreement with the
department;

(h) to a local health department for the purpose of conducting public
health research or education: (i) pursuant to an agreement with the
commissioner; (ii) when the release of such information is deemed
appropriate by the commissioner; (iii) for use in accordance with
measures required by the commissioner to ensure that the security and
confidentiality of the data is protected; and (iv) provided that
disclosure is restricted to individuals within the local health
department who are engaged in the research or education;

(i) to a medical examiner or coroner who is an officer of or employed
by a state or local government, pursuant to his or her official duties;
and

(j) to an individual for the purpose of providing such individual with
his or her own controlled substance history or, in appropriate
circumstances, in the case of a patient who lacks capacity to make
health care decisions, a person who has legal authority to make such
decisions for the patient and who would have legal access to the
patient's health care records, if requested from the department pursuant
to subdivision six of section thirty-three hundred forty-three-a of this
article or from a treating practitioner pursuant to subparagraph (iv) of
paragraph (a) of subdivision two of this section.

* 2. The prescription monitoring program registry may be accessed,
under such terms and conditions as are established by the department for
purposes of maintaining the security and confidentiality of the
information contained in the registry, by:

(a) a practitioner, or a designee authorized by such practitioner
pursuant to paragraph (b) of subdivision two of section thirty-three
hundred forty-three-a, section thirty-three hundred sixty-one of this
article or section thirty of the cannabis law, for the purposes of: (i)
informing the practitioner that a patient may be under treatment with a
controlled substance by another practitioner; (ii) providing the
practitioner with notifications of controlled substance activity as
deemed relevant by the department, including but not limited to a
notification made available on a monthly or other periodic basis through
the registry of controlled substances activity pertaining to his or her
patient; (iii) allowing the practitioner, through consultation of the
prescription monitoring program registry, to review his or her patient's
controlled substances history as required by section thirty-three
hundred forty-three-a, section thirty-three hundred sixty-one of this
article or section thirty of the cannabis law; and (iv) providing to his
or her patient, or person authorized pursuant to paragraph (j) of
subdivision one of this section, upon request, a copy of such patient's
controlled substance history as is available to the practitioner through
the prescription monitoring program registry; or

(b) a pharmacist, pharmacy intern or other designee authorized by the
pharmacist pursuant to paragraph (b) of subdivision three of section
thirty-three hundred forty-three-a of this article, for the purposes of:
(i) consulting the prescription monitoring program registry to review
the controlled substances history of an individual for whom one or more
prescriptions for controlled substances or certifications for cannabis
is presented to the pharmacist, pursuant to section thirty-three hundred
forty-three-a of this article; and (ii) receiving from the department
such notifications of controlled substance activity as are made
available by the department; or

(c) an individual employed by a registered organization as defined in
section three of the cannabis law, for the purpose of consulting the
prescription monitoring program registry to review the controlled
substances history of an individual for whom one or more certifications
for cannabis is presented to that registered organization, pursuant to
section thirty-three hundred sixty-four of this article or section
thirty-four of the cannabis law. Unless otherwise authorized by this
article or by the cannabis law, an individual employed by a registered
organization will be provided access to the prescription monitoring
program in the sole discretion of the commissioner.

* NB Effective until July 5, 2028

* 2. The prescription monitoring program registry may be accessed,
under such terms and conditions as are established by the department for
purposes of maintaining the security and confidentiality of the
information contained in the registry, by:

(a) a practitioner, or a designee authorized by such practitioner
pursuant to paragraph (b) of subdivision two of section thirty-three
hundred forty-three-a of this article, for the purposes of: (i)
informing the practitioner that a patient may be under treatment with a
controlled substance by another practitioner; (ii) providing the
practitioner with notifications of controlled substance activity as
deemed relevant by the department, including but not limited to a
notification made available on a monthly or other periodic basis through
the registry of controlled substances activity pertaining to his or her
patient; (iii) allowing the practitioner, through consultation of the
prescription monitoring program registry, to review his or her patient's
controlled substances history as required by section thirty-three
hundred forty-three-a of this article; and (iv) providing to his or her
patient, or person authorized pursuant to paragraph (j) of subdivision
one of this section, upon request, a copy of such patient's controlled
substance history as is available to the practitioner through the
prescription monitoring program registry; or

(b) a pharmacist, pharmacy intern or other designee authorized by the
pharmacist pursuant to paragraph (b) of subdivision three of section
thirty-three hundred forty-three-a of this article, for the purposes of:
(i) consulting the prescription monitoring program registry to review
the controlled substances history of an individual for whom one or more
prescriptions for controlled substances is presented to the pharmacist,
pursuant to section thirty-three hundred forty-three-a of this article;
and (ii) receiving from the department such notifications of controlled
substance activity as are made available by the department.

* NB Effective July 5, 2028

3. Where it has reason to believe that a crime related to the
diversion of controlled substances has been committed, the department
may notify appropriate law enforcement agencies and provide relevant
information about the suspected criminal activity, including controlled
substances prescribed or dispensed, as reasonably appears to be
necessary. The department shall keep a record of the information
provided, including, but not limited to: the specific information
provided and the agency to which such information was provided,
including the name and title of the person to whom such information was
provided and an attestation from such person that he or she has
authority to receive such information.

4. In the course of any proceeding where such information is
disclosed, except when necessary to effectuate the rights of a party to
the proceeding, the court or presiding officer shall take such action as
is necessary to insure that such information, or record or report of
such information is not made public.