What's happening
This bill prohibits ambulance services from disclosing patient-identifying information for marketing purposes, with specific exceptions and enforcement by the attorney general.
Why it matters
Strengthens patient privacy protections. by strictly restricting how ambulance services handle and share individual identifying information, specifically banning its use or sale for marketing purposes, which helps prevent unwanted solicitation or data exploitation targeting vulnerable individuals.
Establishes clear, limited exceptions. for when personal patient information can be shared—such as for medical treatment, legal requirements, insurance payment, quality assurance, or with explicit, case-specific patient consent—ensuring that necessary data flows are preserved for legitimate care and operational needs.
Allows use of de-identified, aggregate data. (e.g., by zip code or medical specialty) for marketing activities, supporting public health analysis and service planning without risking individual privacy.
Gives the Attorney General direct enforcement authority. to pursue violations, increasing accountability and giving patients another avenue for redress if their information is misused, while also requiring those who receive patient data to safeguard it and prevent further unauthorized marketing use.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Ban Sale of Patient Data
Plain English, a few words. Used as the page title.
Sponsors
Assembly Member · Assembly District 26
4 Multi-sponsors
History
- Referred to health
- Delivered to senate
- Passed assembly
- Ordered to third reading cal.30
- Returned to assembly
- Died in senate
- Referred to rules
- Delivered to senate
- Passed assembly
- Amended on third reading 328a
- Advanced to third reading cal.43
- Reported
Show 2 earlier actions
- Reported referred to codes
- Referred to health
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Protect Patient Health Privacy
In Senate Committee · Health · Sponsor Martin J. Golden
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
328--A Cal. No. 43
2017-2018 Regular Sessions
IN ASSEMBLY
January 5, 2017
Introduced by M. of A. BRAUNSTEIN, ABINANTI, ZEBROWSKI, COLTON, JAFFEE, STECK, WEPRIN -- Multi-Sponsored by -- M. of A. CROUCH, GRAF, HIKIND, LOPEZ, MONTESANO, O'DONNELL, SIMANOWITZ -- read once and referred to the Committee on Health -- reported and referred to the Committee on Codes -- reported from committee, advanced to a third reading, amended and ordered reprinted, retaining its place on the order of third reading
AN ACT to amend the public health law, in relation to the protection of private patient information by ambulance services
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The public health law is amended by adding a new section 3006-a to read as follows:
§ 3006-a. Patient privacy. 1. As used in this section:
(a) "Individual identifying information" means information identifying or tending to identify a patient.
(b) "Marketing" means advertising, detailing, marketing, promotion, or any other activity that is intended to be used to influence business volume, sales or market share or evaluate the effectiveness of marketing practices or marketing personnel, regardless of whether the beneficiary of the marketing is a governmental, for-profit, or not-for-profit entity.
2. No ambulance service, advanced life support first response service, or employee, member or agent thereof shall disclose, sell, transfer, exchange, provide or use any individual identifying information to any person or entity for the purpose of marketing.
3. Notwithstanding subdivision two of this section, and subject to otherwise applicable law, individual identifying information may be:
(a) disclosed, sold, transferred or exchanged to:
(i) the patient who is the subject of the information, or a person authorized to make health care decisions for the patient;
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01759-06-7
A. 328--A 2
(ii) a health care provider providing care or treatment to the patient, for the purpose of such care or treatment; or a health information system subject to regulations of the department, for the purpose of such care or treatment;
(iii) an officer, inspector or investigator for a government health, licensing or law enforcement agency acting under appropriate legal authority;
(iv) a person authorized by a court order or a subpoena to receive such information;
(v) the patient's health plan, insurer, or third party payer, or an agent thereof, for the purpose of payment or reimbursement for health care services, including determining compliance with the terms of coverage or medical necessity, or utilization review;
(vi) a person or entity to whom, and for a purpose for which, disclosure or transfer is otherwise explicitly authorized or required by law;
(vii) a person or entity, for the purpose of conducting quality assurance or evaluating the performance of an ambulance service, advanced life support first response service, or any employee, member or agent thereof;
(viii) a person or entity acting as an employee or agent of a person or entity under any preceding paragraph of this subdivision, for the purpose of and consistent with that paragraph; or
(ix) a government entity as provided by law; and
(b) used by such ambulance service, advanced life support first responder service, or employee, member or agent thereof, for training, promotion, staff recognition or recruitment purposes, consistent with applicable law, provided the patient or a qualified person as defined by paragraph (G) of subdivision one of section eighteen of this chapter has provided consent to such use in a separate, stand-alone document. Such consent shall be limited to the particular type or types of use and specific transaction or transactions for which such consent is given.
4. Nothing in this section shall prohibit the collection, use, transfer, or sale of patient data by zip code, geographic region, or medical specialty for marketing purposes, providing it does not contain individual identifying information.
5. This section shall not prevent a person from disclosing, selling, transferring, or exchanging for value his or her own individual identifying information, for any purpose; provided that the information does not include individual identifying information pertaining to any other person.
6. This section does not prohibit a not-for-profit or governmental ambulance service or advanced life support first response service, or agent thereof, from using a patient's name and address in order to contact such patient or a family member at such address with requests for donations to such service; providing that such use shall not include disclosing any individual identifying information.
7. No person or entity to whom or which individual identifying information is disclosed, sold, transferred or exchanged shall disclose, sell, transfer or exchange it to any person or entity other than for the lawful purpose for which it was disclosed, sold, transferred or exchanged to the person or entity, and without satisfactory assurance that the recipient will safeguard the records from being disclosed or used for marketing purposes.
8. This section does not authorize any disclosure, sale, transfer, or exchange of individual identifying information that is not otherwise authorized or required by law.
A. 328--A 3
9. In addition to the commissioner's authority to enforce this section under section three thousand twelve of this article, the attorney general shall have the authority to bring an action to enforce compliance with this section without referral by the commissioner.
§ 2. This act shall take effect on the one hundred eightieth day after it shall have become a law; provided that, effective immediately, the commissioner of health may make regulations and take other actions reasonably necessary to implement this act on such date.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.