Protect Health Data Privacy

Section 1. The public health law is amended by adding a new section 18-b to read as follows:

§ 18-b. Disclosure of health care information. 1. As used in this section:

(a) "Subject" means an individual concerning whom health care information is maintained or possessed.

(b) "Health care" means any preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, counseling, service or procedure provided by a medical professional or medical care facility with respect to a subject's physical or mental condition or affecting the structure or function of the human body or any part thereof, including but not limited to, banking of blood, sperm, organs or other tissue; and any sale or dispensing of any drug, substance, device, equipment or other item to a subject or for a subject's use, pursuant to a prescription.

(c) "Health care information" means any data or information, whether oral or recorded in any form or medium that identifies or can readily be associated with the identity of the subject and relates to the subject's health care; or is obtained in the course of a subject's health care from a medical professional or medical care facility, from the subject, from a member of the subject's family including spouse, parent or legal guardian or an individual with whom the subject has a relationship or any patient information as defined in paragraph (e) of subdivision one of section eighteen of this title.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD08371-01-7

A. 3560 2

(d) "Medical professional" means any person licensed or certified to provide health care services including but not limited to physicians, dentists, clinical psychologists, podiatrists, chiropractors, nurses, optometrists, pharmacists, clinical dietitians, ophthalmologists, physical or occupational therapists, certified social workers or speech therapists.

(e) "Medical care facility" means any institution that is licensed to provide health care services including but not limited to hospitals, skilled nursing home facilities, home health agencies, medical clinics, laboratories, rehabilitation agencies, public health agencies or health maintenance organizations.

(f) "Personal information" means any individually identifiable information gathered in connection with health care from which judgments can be made about a subject's character, habits, mode of living, avocations, finances, occupation, general reputation, credit, health condition or other personal characteristics. Personal information includes a subject's name, address and telephone number and "medical care information".

(g) "Person" means any natural person, corporation, association, partnership or other legal entity.

(h) "Commercial purpose" means any purpose which has financial gain as a major objective.

2. No person shall disclose health care information or personal information to a person who engages in the business of accessing and compiling information for commercial purpose or whose use of such information will be in connection with the marketing of a product or service without the explicit written authorization of the subject. Such authorization shall be written in plain language; dated; specify the person to whom the health care information or personal information shall be disclosed; specify the purpose for which the health care information or personal information is to be used; specify the length of time such authorization shall remain valid; and shall advise the subject that such person is entitled to receive a copy of the authorization form.

3. Any agreement purporting to waive the provisions of this section is hereby prohibited and declared null and void and against public policy.

4. In addition to or in lieu of any criminal proceeding available under this section, whenever there shall be a violation of this section, application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction by a special proceeding to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violations; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding, the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this section has occurred, the court may impose a civil penalty of not more than one thousand dollars for each violation. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with the civil practice law and rules.

A. 3560 3

5. Any person who knowingly and willfully obtains health care information concerning a subject under false pretenses shall, upon conviction, be fined not more than one thousand dollars or imprisoned not more than one year, or both.

6. In addition to the right of action granted to the attorney general pursuant to this section, any person who has been injured by a violation of this section may bring an action in his or her name to recover his or her actual damages or one hundred dollars, whichever is greater. The court, may in its discretion, increase the award of damages to an amount not to exceed three times the actual damages, up to one thousand dollars, if the court finds the defendant, willingly or knowingly violated this section.

7. The court shall award reasonable attorney's fees to a prevailing plaintiff.

8. Nothing in this section shall be construed to prohibit care management educational communications provided to a patient about the patient's health condition, adherence to a prescribed course of therapy or other information about the drug being dispensed.

§ 2. This act shall take effect on the ninetieth day after it shall have become a law.