STATE OF NEW YORK
________________________________________________________________________
10500--A
IN ASSEMBLY
May 22, 2020
___________
Introduced by COMMITTEE ON RULES -- (at request of M. of A. Gottfried,
Paulin, Dinowitz, Jaffee, McDonald, Galef, Simon, Ashby) -- read once
and referred to the Committee on Health -- committee discharged, bill
amended, ordered reprinted as amended and recommitted to said commit-
tee
AN ACT to amend the public health law, in relation to the confidentiali-
ty of contact tracing information
The People of the State of New York, represented in Senate and Assem-
bly, do enact as follows:
1 Section 1. Article 21 of the public health law is amended by adding a
2 new title 8 to read as follows:
3 TITLE 8
4 NOVEL CORONAVIRUS, COVID-19
5 Section 2180. Definitions.
6 2181. COVID-19 contact tracing; confidential.
7 2182. Regulations.
8 § 2180. Definitions. As used in this title the following terms shall
9 have the following meanings:
10 1. "Contact tracing" means case investigation and identification of
11 contact individuals.
12 2. "Contact tracer" and "contact tracing entity" means an individual
13 or entity employed by or under contract with the state, a local govern-
14 ment, a state or local governmental entity, or an agent thereof, to
15 conduct contact tracing, engaged in contact tracing, or receiving
16 contact tracing information.
17 3. "Contact tracing information" means any information that includes
18 or can reveal the identity of any principal individual or contact indi-
19 vidual, as well as any COVID-19-related test results, received or
20 collected for the purpose or in the course of contact tracing.
21 4. "Contact individual" means an individual who has or may have come
22 in contact with a principal individual or who has or may have been
23 exposed to and possibly infected with COVID-19.
24 5. "Principal individual" means an individual with a confirmed or
25 probable diagnosis of COVID-19.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD16487-03-0
A. 10500--A 2
1 6. "COVID-19" means infection with or the disease caused by the severe
2 acute respiratory syndrome coronavirus 2 (SARS-CoV-2).
3 7. "Immigration authority" means any entity, officer, employee, or
4 government employee or agent thereof charged with enforcement of the
5 federal Immigration and Nationality Act, including the United States
6 Immigration and Customs Enforcement or United States Customs and Border
7 Protection, or any successor legislation or entity.
8 8. "De-identified" means, in relation to contact tracing information,
9 that the information cannot identify or be made to identify or be asso-
10 ciated with a particular individual, directly or indirectly and is
11 subject to technical safeguards and policies and procedures that prevent
12 re-identification, whether intentionally or unintentionally, of any
13 individual.
14 § 2181. COVID-19 contact tracing; confidential. 1. All contact trac-
15 ing information shall be kept confidential by any contact tracer and
16 contact tracing entity, and may not be disclosed except as necessary to
17 carry out contact tracing.
18 2. A person may only waive the confidentiality provided for by this
19 section by a written, informed and voluntary waiver, in plain language
20 and not part of any other document. The waiver shall state the scope and
21 limit of the waiver. If a person lacks the capacity to make a waiver, a
22 person authorized to consent to health care for the person, or the
23 person's legal representative, may make the waiver.
24 3. A disclosure of contact tracing information authorized under this
25 section shall be limited in scope as to the identity of any individual,
26 the information to be disclosed, and the party to which disclosure may
27 be made, and as necessary to achieve the purpose of the disclosure under
28 this section, and shall not authorize re-disclosure except as explicitly
29 authorized. However, this section does not bar disclosure of contact
30 tracing information pertaining to and identifying a principal individual
31 or contact individual by that individual.
32 4. (a) This section does not bar otherwise-lawful disclosure of
33 contact tracing information, including aggregate contact tracing infor-
34 mation, that is de-identified. Disclosure under this subdivision shall
35 only be for a public health or public health research purpose.
36 (b) A person or entity may only use de-identified contact tracing
37 information if the person or entity maintains technical safeguards and
38 policies and procedures that prevent re-identification, whether inten-
39 tionally or unintentionally, of any individual.
40 (c) Disclosure under this subdivision shall be only pursuant to
41 approval by the commissioner (or the New York city commissioner of
42 health and mental hygiene in the case of contact tracing information
43 collected by or under authority of the New York city department of
44 health and mental hygiene or the New York City health and hospitals
45 corporation) specifying the purpose, nature and scope of the disclosure
46 and measures to ensure that it will comply with this section and the
47 terms of the approval.
48 5. No law enforcement agent or entity (other than an entity defined in
49 section two of this chapter or an agent thereof) or immigration authori-
50 ty shall be a contact tracer or contact tracing entity or engage in
51 contact tracing.
52 6. No contact tracer or contact tracing entity may provide contact
53 tracing information to a law enforcement agent or entity (other than an
54 entity defined in section two of this chapter or an agent thereof) or
55 immigration authority. Without consent under subdivision two of this
56 section, contact tracing information and any evidence derived therefrom
A. 10500--A 3
1 shall not be subject to or provided in response to any legal process or
2 be admissible for any purpose in any judicial or administrative action
3 or proceeding.
4 7. A contact tracer or contact tracing entity shall cause all contact
5 tracing information it receives or collects and that is in its
6 possession or control to be expunged or de-identified within thirty days
7 of the date the contact tracer or contact tracing entity receives or
8 collects it.
9 § 2182. Regulations. The commissioner shall make regulations imple-
10 menting this title.
11 § 2. This act shall take effect immediately.