What's happening
This bill prohibits ambulance services from disclosing patients' identifying information for marketing purposes, with specific exceptions and enforcement provisions.
Why it matters
Expands definitions to close loopholes. The bill defines "individual identifying information" and "marketing" broadly, reducing the risk that patient data could be shared through technicalities or ambiguous interpretations.
Creates strict exceptions for legitimate use. It allows the sharing of patient information only for patient care, legal requirements, insurance claims, quality assurance, and with explicit patient consent for certain promotional or training uses—helping balance privacy with operational needs.
Protects against downstream misuse. Any entity that receives patient information for legitimate reasons is strictly prohibited from further disclosing or using it for marketing, and must ensure recipients also safeguard the information.
Empowers enforcement beyond health agencies. The bill gives the state attorney general explicit authority to enforce these privacy protections, increasing the likelihood of meaningful oversight and accountability.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Protect Patient Health Privacy
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to health
- Print number 4372a
- Amend and recommit to health
- Referred to health
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Ban Sale of Patient Data
In Senate Committee · Health · Sponsor Edward Braunstein
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
4372--A
2017-2018 Regular Sessions
IN SENATE
February 10, 2017
Introduced by Sen. GOLDEN -- read twice and ordered printed, and when printed to be committed to the Committee on Health -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee
AN ACT to amend the public health law, in relation to the protection of private patient information by ambulance services
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The public health law is amended by adding a new section 3006-a to read as follows:
§ 3006-a. Patient privacy. 1. As used in this section:
(a) "Individual identifying information" means information identifying or tending to identify a patient.
(b) "Marketing" means advertising, detailing, marketing, promotion, or any other activity that is intended to be used to influence business volume, sales or market share or evaluate the effectiveness of marketing practices or marketing personnel, regardless of whether the beneficiary of the marketing is a governmental, for-profit, or not-for-profit entity.
2. No ambulance service, advanced life support first response service, or employee, member or agent thereof shall disclose, sell, transfer, exchange, provide or use any individual identifying information to any person or entity for the purpose of marketing.
3. Notwithstanding subdivision two of this section, and subject to otherwise applicable law, individual identifying information may be:
(a) disclosed, sold, transferred or exchanged to:
(i) the patient who is the subject of the information, or a person authorized to make health care decisions for the patient;
(ii) a health care provider providing care or treatment to the patient, for the purpose of such care or treatment; or a health informa-
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01759-07-7
S. 4372--A 2
tion system subject to regulations of the department, for the purpose of such care or treatment;
(iii) an officer, inspector or investigator for a government health, licensing or law enforcement agency acting under appropriate legal authority;
(iv) a person authorized by a court order or a subpoena to receive such information;
(v) the patient's health plan, insurer, or third party payer, or an agent thereof, for the purpose of payment or reimbursement for health care services, including determining compliance with the terms of coverage or medical necessity, or utilization review;
(vi) a person or entity to whom, and for a purpose for which, disclosure or transfer is otherwise explicitly authorized or required by law;
(vii) a person or entity, for the purpose of conducting quality assurance or evaluating the performance of an ambulance service, advanced life support first response service, or any employee, member or agent thereof;
(viii) a person or entity acting as an employee or agent of a person or entity under any preceding paragraph of this subdivision, for the purpose of and consistent with that paragraph; or
(ix) a government entity as provided by law; and
(b) used by such ambulance service, advanced life support first responder service, or employee, member or agent thereof, for training, promotion, staff recognition or recruitment purposes, consistent with applicable law, provided the patient or a qualified person as defined by paragraph (G) of subdivision one of section eighteen of this chapter has provided consent to such use in a separate, stand-alone document. Such consent shall be limited to the particular type or types of use and specific transaction or transactions for which such consent is given.
4. Nothing in this section shall prohibit the collection, use, transfer, or sale of patient data by zip code, geographic region, or medical specialty for marketing purposes, providing it does not contain individual identifying information.
5. This section shall not prevent a person from disclosing, selling, transferring, or exchanging for value his or her own individual identifying information, for any purpose; provided that the information does not include individual identifying information pertaining to any other person.
6. This section does not prohibit a not-for-profit or governmental ambulance service or advanced life support first response service, or agent thereof, from using a patient's name and address in order to contact such patient or a family member at such address with requests for donations to such service; providing that such use shall not include disclosing any individual identifying information.
7. No person or entity to whom or which individual identifying information is disclosed, sold, transferred or exchanged shall disclose, sell, transfer or exchange it to any person or entity other than for the lawful purpose for which it was disclosed, sold, transferred or exchanged to the person or entity, and without satisfactory assurance that the recipient will safeguard the records from being disclosed or used for marketing purposes.
8. This section does not authorize any disclosure, sale, transfer, or exchange of individual identifying information that is not otherwise authorized or required by law.
9. In addition to the commissioner's authority to enforce this section under section three thousand twelve of this article, the attorney gener-
S. 4372--A 3
al shall have the authority to bring an action to enforce compliance with this section without referral by the commissioner.
§ 2. This act shall take effect on the one hundred eightieth day after it shall have become a law; provided that, effective immediately, the commissioner of health may make regulations and take other actions reasonably necessary to implement this act on such date.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the public health law, in relation to the protection of private patient information by ambulance services
Purpose or general idea of bill
To prohibit the sale of patient-protected health information.
Summary of provisions
Section 1. Defines "individual identifying information" as information identifying or tending to identify a patient. This section also defines "marketing." Marketing means, but is not limited to, advertising, detailing, marketing, promotion, or any activity that is intended to be or could be used to influence business volume, sales or market share or evaluate the effectiveness of marketing practices or personnel, regardless of whether the beneficiary of the marketing is a governmental, for-profit, or not-for-profit entity.
Read the full memo (774 words)
Section 2. Adds a new section 3006-a to the public health law to cover patient privacy. New section 3006-a provides that no ambulance service, advanced life support first response service, or employee, member or agent shall disclose, sell, transfer, exchange or use any individual identifying information to any person or entity for the purpose of marketing.
However, within this section there are several exceptions. This information may be disclosed, sold, transferred or exchanged to: the patient who is the subject of the information, or a person authorized to make health care decisions; a health care provider or information system subject to the regulations of the department, for the purpose of providing care or treatment; an officer, inspector, or investigator for a government health, licensing, or law enforcement agency acting under appropriate legal authority; a person authorized by court order, the patient's insurer for the purpose of payment or reimbursement; a person or entity to whom, and for a purpose for which, disclosure is explicitly authorized by law; a person acting as an agent of the person or entity under any preceding paragraph, for the purpose of and consistent with that paragraph; or, a government entity as provided by law.
Additionally, the collection, use, transfer, or sale of patient data by zip code, geographic region, or medical specialty for marketing purposes is permitted, providing it does not contain individual identifying information.
New section 3006-a permits not-for-profit or governmental ambulances and other life support first responders to use a patient's address in connection with fundraising for such services, as long as the use does not include disclosing the individual's identifying information. An individual may also disclose their own identifying information, as long as identifying information about another individual is not included.
No person or entity to whom or which individual identifying information is sold or disclosed shall sell or disclose it to any person or entity other than for the lawful purpose for which it was disclosed or sold, and without satisfactory assurance that the recipient will safeguard the records from being disclosed or used for marketing purposes. The section also does not allow any disclosure, sale, transfer, or exchange of individual identifying information that is not otherwise authorized or required by law.
In addition to the commissioner's authority to enforce this section under section 3012, the attorney general shall have the authority to bring an action to enforce compliance with this section without referral by the commissioner.
Section 3. Provides the effective date, which is that this act shall take effect on the one hundred eightieth day after it shall have become a law; provided that, effective immediately, the commissioner of health may make regulations and take other actions reasonably necessary to implement this act on such date.
Justification
According to a New York Post article in 2014, the FDNY issued a patient-privacy notice, which disclosed that it may sell or use patient protected health information for fundraising and marketing purposes. While the FDNY has since changed its privacy policy, public health agencies, such as the FDNY and other emergency service providers, should not be able to legally sell patient protected health information (PHI). PI-11 refers to information such as the patient's address and phone number, prescriptions, and medical history. All emergency service providers hold this information on patients. Patients have an expectation and a right to the privacy in relation to their health records. As such, PHI should never be sold to pharmaceutical companies, insurers, nursing homes, and other businesses.
Prior legislative history
2016: S.6489 - Referred to Health Similar to: 2015: S.1997-A - 3rd Reading Calendar 2014: S.7008-A - Passed Senate
Fiscal implications
None.
Effective date
This act shall take effect on the one hundred eightieth day after it shall have become a law; provided that, effective immediately, the commissioner of health may make regulations and take other actions reasonably necessary to implement this act on such date.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.