Bill Text: NY A01253 | 2021-2022 | General Assembly | Introduced
Bill Title: Relates to the confidentiality of contact tracing information.
Spectrum: Partisan Bill (Democrat 4-0)
Status: (Introduced - Dead) 2021-02-08 - substituted by s900 [A01253 Detail]
Download: New_York-2021-A01253-Introduced.html
STATE OF NEW YORK ________________________________________________________________________ 1253 2021-2022 Regular Sessions IN ASSEMBLY January 7, 2021 ___________ Introduced by M. of A. GOTTFRIED -- read once and referred to the Committee on Health AN ACT to amend the public health law, in relation to the confidentiali- ty of contact tracing information The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Sections 2180, 2181 and 2182 of the public health law, as 2 added by a chapter of the laws of 2020, amending the public health law 3 relating to the confidentiality of contact tracing information, as 4 proposed in legislative bills numbers S.8450-C and A.10500-C, are 5 amended to read as follows: 6 § 2180. Definitions. As used in this title the following terms shall 7 have the following meanings: 8 1. "Contact tracing" means COVID-19 case investigation and identifica- 9 tion of [principal] case individuals and contact individuals. 10 2. (a) "Contact tracer" and "contact tracing entity" means an individ- 11 ual or entity employed by or under contract with the state, a local 12 government, a state or local governmental entity, or an agent thereof, 13 to conduct contact tracing, engage in contact tracing, or receive 14 contact tracing information. 15 (b) A contact tracer or contact tracing entity shall not include a 16 service provider that is a non-governmental entity that is employed by 17 or under contract with a contact tracing entity or an agent thereof, 18 that receives, transmits, maintains, stores, or hosts contact tracing 19 information at the direction of a contact tracer or contact tracing 20 entity so long as such service provider's access to the information is 21 exclusively limited to the maintenance of the information and the 22 contact tracer or contact tracing entity has the ability to delete and 23 manage contact tracing information as provided by this chapter, law, 24 rules or regulations. A service provider under this paragraph shall be 25 referred to in this title as a "designated non-governmental entity." A EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD07194-01-1A. 1253 2 1 service provider that does not meet the requirements of this paragraph 2 and would otherwise be subject to paragraph (a) of this subdivision 3 shall be a contact tracing entity. 4 3. "Contact tracing information" means any information that includes 5 or can reveal the identity of any [principal] case individual or contact 6 individual, and any COVID-19-related information or test results, 7 received or collected for the purpose or in the course of contact trac- 8 ing. 9 4. "Contact individual" means an individual who has or may have come 10 in contact with a [principal] case individual or who has or may have 11 been exposed to and possibly infected with COVID-19. 12 5. "[Principal] Case individual" means an individual with a confirmed 13 or probable diagnosis of COVID-19. 14 6. "COVID-19" means infection with or the disease caused by the severe 15 acute respiratory syndrome coronavirus 2 (SARS-CoV-2). 16 7. "Immigration authority" means any entity, officer, employee, or 17 government employee or agent thereof charged with or engaged in enforce- 18 ment of the federal Immigration and Nationality Act, including the 19 United States Immigration and Customs Enforcement, United States Depart- 20 ment of Homeland Security, or United States Customs and Border 21 Protection, or agent, contractor or employee thereof, or any successor 22 legislation or entity. 23 8. "De-identified" means, in relation to contact tracing information, 24 that the information cannot identify or be made to identify or be asso- 25 ciated with a particular individual, directly or indirectly and is 26 subject to technical safeguards and policies and procedures that prevent 27 re-identification, whether intentionally or unintentionally, of any 28 individual. 29 9. "Law enforcement agent or entity" means any governmental entity or 30 public servant, or agent, contractor or employee thereof, authorized to 31 investigate, prosecute, or make an arrest for a criminal or civil 32 offense (except a designated civil offense), or engaged in any such 33 activity, but shall not mean the department, the commissioner, a health 34 district, a county department of health, a county health commissioner, a 35 local board of health, a local health officer, the department of health 36 and mental hygiene of the city of New York, or the commissioner of the 37 department of health and mental hygiene of the city of New York. As 38 used in this subdivision, "designated civil offense" means a civil 39 offense or offenses designated by the commissioner (or the commissioner 40 of the New York city department of health and mental hygiene in the case 41 of contact tracing information collected by or under authority of the 42 New York city department of health and mental hygiene or the New York 43 city health and hospitals corporation). 44 10. "Support" means resources or services provided to an individual to 45 enable such individual to safely quarantine or isolate, including 46 grocery, meal or pharmacy delivery, laundry services, child or elder 47 care, pet walking, assistance with telephone, internet, or other commu- 48 nication services or devices, health and mental health services, legal 49 services, provision of appropriate living space for individuals who 50 cannot isolate or quarantine at home, and income replacement. "Support" 51 may also include support provided to other individuals for whom the 52 individual commonly provides those resources or services. 53 11. "Permitted purpose" means: 54 (a) disclosure to appropriate health care providers or their personnel 55 for the purpose of the clinical diagnosis, care or treatment of the 56 [principal] case individual or contact individual who is the subject ofA. 1253 3 1 the information, where an emergency exists and the individual is in 2 immediate need of medical attention and an attempt to secure consent 3 would result in delay of treatment which would increase the risk to the 4 individual's life or health; 5 (b) facilitating a legally-authorized public health-related action, 6 [in relation to a specified principal individual or contact individual,] 7 where and only to the extent necessary to protect the public health in 8 relation to COVID-19; or 9 (c) [the investigation, prosecution or defense of a civil or legal10action for] use or disclosure of contact tracing information to pursue a 11 legal action in relation to a violation of this title; provided that 12 disclosure shall be subject to in camera review and approval by the 13 court, and, if the use is initiated by a party other than the [princi-14pal] case individual or contact individual who is the subject of the 15 contact tracing information, the information must be highly material and 16 relevant for the purpose. 17 § 2181. COVID-19 contact tracing; confidentiality. 1. (a) All contact 18 tracing information shall be kept confidential by any contact tracer 19 [and], contact tracing entity, or designated non-governmental entity and 20 may not be disclosed except as necessary to carry out contact tracing or 21 a permitted purpose. A designated non-governmental entity may only act 22 in relation to contact tracing information as explicitly authorized by 23 this title. 24 (b) Where a contact tracer or contact tracing entity discloses contact 25 tracing information for a permitted purpose, the contact tracer or 26 contact tracing entity shall make a record of the disclosure, including 27 to whom it was made and when it was made, which shall be part of the 28 contact tracing information. 29 (c) Nothing in this title prohibits otherwise lawful voluntary 30 reporting, at the discretion of the contact tracer, reasonably and in 31 good faith: (i) to the statewide central registry under title six of 32 article six of the social services law, adult protective services under 33 titles one and two of article nine-B of the social services law, or the 34 justice center for the protection of people with special needs under 35 article eleven of the social services law; or (ii) to a governmental or 36 non-governmental emergency reporting system (such as a "911," domestic 37 violence or suicide prevention system) to prevent imminent risk of 38 injury to any person. 39 (d) This title does not limit disclosure to or by, or possession or 40 use by, the case individual or contact individual who is the subject of 41 the information. 42 2. (a) An individual may waive the confidentiality provided for by 43 this section, only by a written, informed and voluntary waiver, in plain 44 language and in a language understandable to the individual making the 45 waiver, and not part of any other document. The waiver shall state the 46 scope and limit of the waiver. No contact tracer, contact tracing enti- 47 ty or governmental or non-governmental entity may seek or act in reli- 48 ance on a waiver to distribute, sell, or otherwise disclose identifiable 49 or de-identified data to any individual or entity. Provided however, 50 nothing in this subdivision shall prohibit distribution or disclosure 51 that is otherwise explicitly authorized by this section. If an individ- 52 ual lacks the capacity to make a waiver, an individual authorized to 53 consent to health care for the individual, or the individual's legal 54 representative, may make the waiver. However, a waiver of confidential- 55 ity is not required to be written if it is solely for the purpose of 56 arranging or providing support for the individual who is the subject ofA. 1253 4 1 the contact tracing information, provided the consent is informed and 2 voluntary. 3 (b) A waiver of confidentiality under this section shall only apply 4 for the purpose of arranging or providing support if the individual who 5 is the subject of the contact tracing information (or, if the individual 6 lacks the capacity to provide informed consent, an individual authorized 7 to consent to health care for the individual, or the individual's legal 8 representative) provides voluntary informed consent to the arranging or 9 providing of the support. 10 3. A disclosure of contact tracing information authorized under this 11 section shall be limited in scope as to the identity of any individual, 12 the information to be disclosed, and the party to which disclosure may 13 be made, and as necessary to achieve the purpose of the disclosure under 14 this section, and shall not authorize re-disclosure except as explicitly 15 authorized by the terms of the waiver under this section. However, this 16 section does not bar disclosure of contact tracing information pertain- 17 ing to and identifying a [principal] case individual or contact individ- 18 ual by the individual who is identified. 19 4. (a) This section does not bar otherwise-lawful disclosure, 20 possession or use of de-identified contact tracing information, includ- 21 ing aggregate contact tracing information[, that is de-identified]. 22 Disclosure, possession or use under this subdivision shall only be for a 23 public health or public health research or evaluation purpose as deter- 24 mined by the commissioner (or the commissioner of the New York city 25 department of health and mental hygiene in the case of contact tracing 26 information collected by or under authority of the New York city depart- 27 ment of health and mental hygiene or the New York city health and hospi- 28 tals corporation), and shall not authorize re-disclosure or other use. 29 (b) A person or entity may only disclose, possess or use de-identified 30 contact tracing information if the person or entity, and the person or 31 entity to which it is disclosed, maintains technical safeguards and 32 policies and procedures that prevent re-identification, whether inten- 33 tional or unintentional, of any individual, as may be required by the 34 commissioner (or the New York city commissioner of health and mental 35 hygiene in the case of contact tracing information collected by or under 36 authority of the New York city department of health and mental hygiene 37 or the New York city health and hospitals corporation). The commission- 38 er (or the New York city commissioner as the case may be) shall require 39 safeguards, policies and procedures under this paragraph as the commis- 40 sioner deems practicable. 41 (c) Disclosure, possession and use of de-identified contact tracing 42 information under this subdivision shall be only pursuant to approval by 43 the commissioner (or the New York city commissioner of health and mental 44 hygiene in the case of contact tracing information collected by or under 45 authority of the New York city department of health and mental hygiene 46 or the New York city health and hospitals corporation) specifying the 47 purpose, nature and scope of the disclosure, possession and use and 48 measures to ensure that it will comply with this section and the terms 49 of the approval. 50 5. No law enforcement agent or entity or immigration authority shall 51 be a contact tracer or contact tracing entity or engage in contact trac- 52 ing. This subdivision does not bar an individual who is associated with 53 a law enforcement entity or immigration authority from acting only as a 54 [principal] case individual or contact individual. This subdivision 55 does not prevent a law enforcement agent or entity from assisting in aA. 1253 5 1 permitted use under paragraph (b) of subdivision eleven of section twen- 2 ty-one hundred eighty of this title. 3 6. No contact tracer [or], contact tracing entity or designated non- 4 governmental entity may provide contact tracing information to a law 5 enforcement agent [or], entity or immigration authority, or any individ- 6 ual or entity other than the contact tracing entity from which it 7 received the information, except as explicitly authorized by this title. 8 Without consent under subdivision two of this section, contact tracing 9 information and any evidence derived therefrom shall not be subject to 10 or provided in response to any legal process or be admissible for any 11 purpose in any judicial or administrative action or proceeding. However, 12 this subdivision does not restrict providing information, relating to a 13 specified [principal] case individual or contact individual, where and 14 only to the extent necessary for a permitted purpose. 15 7. (a) Contact tracing entities shall establish appropriate adminis- 16 trative, technical and physical safeguards, policies and procedures that 17 ensure the security of contact tracing information under the entity's 18 jurisdiction. The safeguards, policies and procedures must ensure 19 contact tracing information is encrypted and protected at least as much 20 as or more than other confidential information under the entity's juris- 21 diction. All storage of contact tracing information shall meet the 22 requirements of this title. The commissioner (or the New York city 23 commissioner of health and mental hygiene in the case of contact tracing 24 information collected by or under authority of the New York city depart- 25 ment of health and mental hygiene or the New York city health and hospi- 26 tals corporation) shall make regulations as reasonably necessary to 27 require that contact tracing information possessed, used or under the 28 control of a contact tracer or contact tracing entity shall be subject 29 to technical safeguards [and], policies and procedures for storage, 30 transmission, use and protection of the information. The regulations 31 shall prevent possession, use or disclosure of the contact tracing 32 information not permitted by this title, and shall be at least as or 33 more protective than the safeguards, policies and procedures the commis- 34 sioner (or the New York city commissioner as the case may be) provides 35 for other confidential information. 36 (b) This paragraph applies [where contact tracing information is37possessed or controlled by a contact tracer or contact tracing entity38that is a non-governmental individual or entity employed by or under39contract with a governmental entity, or an agent thereof] to a contact 40 tracer or contact tracing entity that is a non-governmental individual 41 or entity employed by or under contract with a governmental entity, or 42 an agent thereof. Within [thirty] sixty days of collecting or receiving 43 the contact tracing information, the [non-governmental individual or] 44 entity shall (i) remove information from its possession or control and 45 deliver it to the appropriate governmental contact tracing entity or a 46 designated non-governmental entity specified by the governmental contact 47 tracing entity, retaining no copy of it; (ii) expunge the information 48 from its possession or control; or (iii) de-identify the information. 49 However, the expungement or de-identification of particular contact 50 tracing information may be postponed for up to fifteen days after the 51 initial sixty day period while the contact tracer or contact tracing 52 entity is actively engaged in contact tracing using that information, 53 provided that the [principal] case individual or contact individual to 54 whom it pertains gives voluntary informed consent. The disclosure, 55 possession and use of the de-identified contact tracing information 56 shall be subject to subdivision four of this section.A. 1253 6 1 § 2182. Regulations. The commissioner shall make regulations [imple-2menting] as reasonably necessary to implement this title. 3 § 2. This act shall take effect on the same date and in the same 4 manner as a chapter of the laws of 2020, amending the public health law 5 relating to the confidentiality of contact tracing information, as 6 proposed in legislative bills numbers S.8450-C and A.10500-C, takes 7 effect.