Bill Text: NY A03560 | 2017-2018 | General Assembly | Introduced
Bill Title: Prohibits any person from disclosing health care information or personal information to a person who engages in the business of accessing and compiling information for commercial purposes or whose use of such information will be in connection with the marketing of a product or service without the explicit written authorization of the data subject.
Spectrum: Partisan Bill (Democrat 8-0)
Status: (Introduced - Dead) 2018-01-03 - referred to health [A03560 Detail]
Download: New_York-2017-A03560-Introduced.html
STATE OF NEW YORK ________________________________________________________________________ 3560 2017-2018 Regular Sessions IN ASSEMBLY January 27, 2017 ___________ Introduced by M. of A. ORTIZ, DINOWITZ, COOK -- Multi-Sponsored by -- M. of A. GALEF, GOTTFRIED, HIKIND, HOOPER, RIVERA -- read once and referred to the Committee on Health AN ACT to amend the public health law, in relation to restricting the disclosure of health care information The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The public health law is amended by adding a new section 2 18-b to read as follows: 3 § 18-b. Disclosure of health care information. 1. As used in this 4 section: 5 (a) "Subject" means an individual concerning whom health care informa- 6 tion is maintained or possessed. 7 (b) "Health care" means any preventive, diagnostic, therapeutic, reha- 8 bilitative, maintenance or palliative care, counseling, service or 9 procedure provided by a medical professional or medical care facility 10 with respect to a subject's physical or mental condition or affecting 11 the structure or function of the human body or any part thereof, includ- 12 ing but not limited to, banking of blood, sperm, organs or other tissue; 13 and any sale or dispensing of any drug, substance, device, equipment or 14 other item to a subject or for a subject's use, pursuant to a 15 prescription. 16 (c) "Health care information" means any data or information, whether 17 oral or recorded in any form or medium that identifies or can readily be 18 associated with the identity of the subject and relates to the subject's 19 health care; or is obtained in the course of a subject's health care 20 from a medical professional or medical care facility, from the subject, 21 from a member of the subject's family including spouse, parent or legal 22 guardian or an individual with whom the subject has a relationship or 23 any patient information as defined in paragraph (e) of subdivision one 24 of section eighteen of this title. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD08371-01-7A. 3560 2 1 (d) "Medical professional" means any person licensed or certified to 2 provide health care services including but not limited to physicians, 3 dentists, clinical psychologists, podiatrists, chiropractors, nurses, 4 optometrists, pharmacists, clinical dietitians, ophthalmologists, phys- 5 ical or occupational therapists, certified social workers or speech 6 therapists. 7 (e) "Medical care facility" means any institution that is licensed to 8 provide health care services including but not limited to hospitals, 9 skilled nursing home facilities, home health agencies, medical clinics, 10 laboratories, rehabilitation agencies, public health agencies or health 11 maintenance organizations. 12 (f) "Personal information" means any individually identifiable infor- 13 mation gathered in connection with health care from which judgments can 14 be made about a subject's character, habits, mode of living, avocations, 15 finances, occupation, general reputation, credit, health condition or 16 other personal characteristics. Personal information includes a 17 subject's name, address and telephone number and "medical care informa- 18 tion". 19 (g) "Person" means any natural person, corporation, association, part- 20 nership or other legal entity. 21 (h) "Commercial purpose" means any purpose which has financial gain as 22 a major objective. 23 2. No person shall disclose health care information or personal infor- 24 mation to a person who engages in the business of accessing and compil- 25 ing information for commercial purpose or whose use of such information 26 will be in connection with the marketing of a product or service without 27 the explicit written authorization of the subject. Such authorization 28 shall be written in plain language; dated; specify the person to whom 29 the health care information or personal information shall be disclosed; 30 specify the purpose for which the health care information or personal 31 information is to be used; specify the length of time such authorization 32 shall remain valid; and shall advise the subject that such person is 33 entitled to receive a copy of the authorization form. 34 3. Any agreement purporting to waive the provisions of this section is 35 hereby prohibited and declared null and void and against public policy. 36 4. In addition to or in lieu of any criminal proceeding available 37 under this section, whenever there shall be a violation of this section, 38 application may be made by the attorney general in the name of the 39 people of the state of New York to a court or justice having jurisdic- 40 tion by a special proceeding to issue an injunction, and upon notice to 41 the defendant of not less than five days, to enjoin and restrain the 42 continuance of such violations; and if it shall appear to the satisfac- 43 tion of the court or justice that the defendant has, in fact, violated 44 this section, an injunction may be issued by such court or justice, 45 enjoining and restraining any further violation, without requiring proof 46 that any person has, in fact, been injured or damaged thereby. In any 47 such proceeding, the court may make allowances to the attorney general 48 as provided in paragraph six of subdivision (a) of section eighty-three 49 hundred three of the civil practice law and rules, and direct restitu- 50 tion. Whenever the court shall determine that a violation of this 51 section has occurred, the court may impose a civil penalty of not more 52 than one thousand dollars for each violation. In connection with any 53 such proposed application, the attorney general is authorized to take 54 proof and make a determination of the relevant facts and to issue 55 subpoenas in accordance with the civil practice law and rules.A. 3560 3 1 5. Any person who knowingly and willfully obtains health care informa- 2 tion concerning a subject under false pretenses shall, upon conviction, 3 be fined not more than one thousand dollars or imprisoned not more than 4 one year, or both. 5 6. In addition to the right of action granted to the attorney general 6 pursuant to this section, any person who has been injured by a violation 7 of this section may bring an action in his or her name to recover his or 8 her actual damages or one hundred dollars, whichever is greater. The 9 court, may in its discretion, increase the award of damages to an amount 10 not to exceed three times the actual damages, up to one thousand 11 dollars, if the court finds the defendant, willingly or knowingly 12 violated this section. 13 7. The court shall award reasonable attorney's fees to a prevailing 14 plaintiff. 15 8. Nothing in this section shall be construed to prohibit care manage- 16 ment educational communications provided to a patient about the 17 patient's health condition, adherence to a prescribed course of therapy 18 or other information about the drug being dispensed. 19 § 2. This act shall take effect on the ninetieth day after it shall 20 have become a law.
