Bill Text: NY S00900 | 2021-2022 | General Assembly | Introduced

---

Bill Title: Relates to the confidentiality of contact tracing information.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Passed) 2021-02-16 - SIGNED CHAP.62 [S00900 Detail]

Download: New_York-2021-S00900-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                           900

                               2021-2022 Regular Sessions

                    IN SENATE

                                       (Prefiled)

                                     January 6, 2021
                                       ___________

        Introduced  by  Sen.  RIVERA -- read twice and ordered printed, and when
          printed to be committed to the Committee on Rules

        AN ACT to amend the public health law, in relation to the confidentiali-
          ty of contact tracing information

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section  1.  Sections 2180, 2181 and 2182 of the public health law, as
     2  added by a chapter of the laws of 2020, amending the public  health  law
     3  relating  to  the  confidentiality  of  contact  tracing information, as
     4  proposed in  legislative  bills  numbers  S.8450-C  and  A.10500-C,  are
     5  amended to read as follows:
     6    §  2180.  Definitions. As used in this title the following terms shall
     7  have the following meanings:
     8    1. "Contact tracing" means COVID-19 case investigation and identifica-
     9  tion of [principal] case individuals and contact individuals.
    10    2. (a) "Contact tracer" and "contact tracing entity" means an individ-
    11  ual or entity employed by or under contract  with  the  state,  a  local
    12  government,  a  state or local governmental entity, or an agent thereof,
    13  to conduct contact  tracing,  engage  in  contact  tracing,  or  receive
    14  contact tracing information.
    15    (b)  A  contact  tracer  or contact tracing entity shall not include a
    16  service provider that is a non-governmental entity that is  employed  by
    17  or  under  contract  with  a contact tracing entity or an agent thereof,
    18  that receives, transmits, maintains, stores, or  hosts  contact  tracing
    19  information  at  the  direction  of  a contact tracer or contact tracing
    20  entity so long as such service provider's access to the  information  is
    21  exclusively  limited  to  the  maintenance  of  the  information and the
    22  contact tracer or contact tracing entity has the ability to  delete  and
    23  manage  contact  tracing  information  as provided by this chapter, law,
    24  rules or regulations.  A service provider under this paragraph shall  be

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD07194-01-1
        S. 900                              2

     1  referred  to in this title as a "designated non-governmental entity."  A
     2  service provider that does not meet the requirements of  this  paragraph
     3  and  would  otherwise  be  subject  to paragraph (a) of this subdivision
     4  shall be a contact tracing entity.
     5    3.  "Contact  tracing information" means any information that includes
     6  or can reveal the identity of any [principal] case individual or contact
     7  individual,  and  any  COVID-19-related  information  or  test  results,
     8  received  or collected for the purpose or in the course of contact trac-
     9  ing.
    10    4. "Contact individual" means an individual who has or may  have  come
    11  in  contact  with  a  [principal] case individual or who has or may have
    12  been exposed to and possibly infected with COVID-19.
    13    5. "[Principal] Case individual" means an individual with a  confirmed
    14  or probable diagnosis of COVID-19.
    15    6. "COVID-19" means infection with or the disease caused by the severe
    16  acute respiratory syndrome coronavirus 2 (SARS-CoV-2).
    17    7.  "Immigration  authority"  means  any entity, officer, employee, or
    18  government employee or agent thereof charged with or engaged in enforce-
    19  ment of the federal  Immigration  and  Nationality  Act,  including  the
    20  United States Immigration and Customs Enforcement, United States Depart-
    21  ment   of  Homeland  Security,  or  United  States  Customs  and  Border
    22  Protection, or agent, contractor or employee thereof, or  any  successor
    23  legislation or entity.
    24    8.  "De-identified" means, in relation to contact tracing information,
    25  that the information cannot identify or be made to identify or be  asso-
    26  ciated  with  a  particular  individual,  directly  or indirectly and is
    27  subject to technical safeguards and policies and procedures that prevent
    28  re-identification, whether  intentionally  or  unintentionally,  of  any
    29  individual.
    30    9.  "Law enforcement agent or entity" means any governmental entity or
    31  public servant, or agent, contractor or employee thereof, authorized  to
    32  investigate,  prosecute,  or  make  an  arrest  for  a criminal or civil
    33  offense (except a designated civil offense),  or  engaged  in  any  such
    34  activity,  but shall not mean the department, the commissioner, a health
    35  district, a county department of health, a county health commissioner, a
    36  local board of health, a local health officer, the department of  health
    37  and  mental  hygiene of the city of New York, or the commissioner of the
    38  department of health and mental hygiene of the city of  New  York.    As
    39  used  in  this  subdivision,  "designated  civil  offense" means a civil
    40  offense or offenses designated by the commissioner (or the  commissioner
    41  of the New York city department of health and mental hygiene in the case
    42  of  contact  tracing  information collected by or under authority of the
    43  New York city department of health and mental hygiene or  the  New  York
    44  city health and hospitals corporation).
    45    10. "Support" means resources or services provided to an individual to
    46  enable  such  individual  to  safely  quarantine  or  isolate, including
    47  grocery, meal or pharmacy delivery, laundry  services,  child  or  elder
    48  care,  pet walking, assistance with telephone, internet, or other commu-
    49  nication services or devices, health and mental health  services,  legal
    50  services,  provision  of  appropriate  living  space for individuals who
    51  cannot isolate or quarantine at home, and income replacement.  "Support"
    52  may  also  include  support  provided  to other individuals for whom the
    53  individual commonly provides those resources or services.
    54    11. "Permitted purpose" means:
    55    (a) disclosure to appropriate health care providers or their personnel
    56  for the purpose of the clinical diagnosis,  care  or  treatment  of  the
        S. 900                              3

     1  [principal]  case individual or contact individual who is the subject of
     2  the information, where an emergency exists  and  the  individual  is  in
     3  immediate  need  of  medical  attention and an attempt to secure consent
     4  would  result in delay of treatment which would increase the risk to the
     5  individual's life or health;
     6    (b) facilitating a legally-authorized  public  health-related  action,
     7  [in relation to a specified principal individual or contact individual,]
     8  where  and  only to the extent necessary to protect the public health in
     9  relation to COVID-19; or
    10    (c) [the investigation, prosecution or defense of  a  civil  or  legal
    11  action for] use or disclosure of contact tracing information to pursue a
    12  legal  action  in  relation  to a violation of this title; provided that
    13  disclosure shall be subject to in camera  review  and  approval  by  the
    14  court,  and,  if the use is initiated by a party other than the [princi-
    15  pal] case individual or contact individual who is  the  subject  of  the
    16  contact tracing information, the information must be highly material and
    17  relevant for the purpose.
    18    § 2181. COVID-19 contact tracing; confidentiality. 1.  (a) All contact
    19  tracing  information  shall  be  kept confidential by any contact tracer
    20  [and], contact tracing entity, or designated non-governmental entity and
    21  may not be disclosed except as necessary to carry out contact tracing or
    22  a permitted purpose. A designated non-governmental entity may  only  act
    23  in  relation  to contact tracing information as explicitly authorized by
    24  this title.
    25    (b) Where a contact tracer or contact tracing entity discloses contact
    26  tracing information for a  permitted  purpose,  the  contact  tracer  or
    27  contact  tracing entity shall make a record of the disclosure, including
    28  to whom it was made and when it was made, which shall  be  part  of  the
    29  contact tracing information.
    30    (c)    Nothing  in  this  title  prohibits  otherwise lawful voluntary
    31  reporting, at the discretion of the contact tracer,  reasonably  and  in
    32  good  faith:    (i) to the statewide central registry under title six of
    33  article six of the social services law, adult protective services  under
    34  titles  one and two of article nine-B of the social services law, or the
    35  justice center for the protection of people  with  special  needs  under
    36  article  eleven of the social services law; or (ii) to a governmental or
    37  non-governmental emergency reporting system (such as a  "911,"  domestic
    38  violence  or  suicide  prevention    system) to prevent imminent risk of
    39  injury to any person.
    40    (d) This title does not limit disclosure to or by,  or  possession  or
    41  use  by, the case individual or contact individual who is the subject of
    42  the information.
    43    2. (a) An individual may waive the  confidentiality  provided  for  by
    44  this section, only by a written, informed and voluntary waiver, in plain
    45  language  and  in a language understandable to the individual making the
    46  waiver, and not part of any other document. The waiver shall  state  the
    47  scope and limit of the waiver.  No contact tracer, contact tracing enti-
    48  ty  or  governmental or non-governmental entity may seek or act in reli-
    49  ance on a waiver to distribute, sell, or otherwise disclose identifiable
    50  or de-identified data to any individual or entity.    Provided  however,
    51  nothing  in  this  subdivision shall prohibit distribution or disclosure
    52  that is otherwise explicitly authorized by this section. If an  individ-
    53  ual  lacks  the  capacity  to make a waiver, an individual authorized to
    54  consent to health care for the individual,  or  the  individual's  legal
    55  representative, may make the waiver.  However, a waiver of confidential-
    56  ity  is  not  required  to be written if it is solely for the purpose of
        S. 900                              4

     1  arranging or providing support for the individual who is the subject  of
     2  the  contact  tracing  information, provided the consent is informed and
     3  voluntary.
     4    (b)  A  waiver  of confidentiality under this section shall only apply
     5  for the purpose of arranging or providing support if the individual  who
     6  is the subject of the contact tracing information (or, if the individual
     7  lacks the capacity to provide informed consent, an individual authorized
     8  to  consent to health care for the individual, or the individual's legal
     9  representative) provides voluntary informed consent to the arranging  or
    10  providing of the support.
    11    3.  A  disclosure of contact tracing information authorized under this
    12  section shall be limited in scope as to the identity of any  individual,
    13  the  information  to be disclosed, and the party to which disclosure may
    14  be made, and as necessary to achieve the purpose of the disclosure under
    15  this section, and shall not authorize re-disclosure except as explicitly
    16  authorized by the terms of the waiver under this section.  However, this
    17  section does not bar disclosure of contact tracing information  pertain-
    18  ing to and identifying a [principal] case individual or contact individ-
    19  ual by the individual who is identified.
    20    4.   (a)  This  section  does  not  bar  otherwise-lawful  disclosure,
    21  possession or use of de-identified contact tracing information,  includ-
    22  ing  aggregate  contact  tracing  information[,  that is de-identified].
    23  Disclosure, possession or use under this subdivision shall only be for a
    24  public health or public health research or evaluation purpose as  deter-
    25  mined  by  the  commissioner  (or  the commissioner of the New York city
    26  department of health and mental hygiene in the case of  contact  tracing
    27  information collected by or under authority of the New York city depart-
    28  ment of health and mental hygiene or the New York city health and hospi-
    29  tals corporation), and shall not authorize re-disclosure or other use.
    30    (b) A person or entity may only disclose, possess or use de-identified
    31  contact  tracing  information if the person or entity, and the person or
    32  entity to which it is  disclosed,  maintains  technical  safeguards  and
    33  policies  and  procedures that prevent re-identification, whether inten-
    34  tional or unintentional, of any individual, as may be  required  by  the
    35  commissioner  (or  the  New  York city commissioner of health and mental
    36  hygiene in the case of contact tracing information collected by or under
    37  authority of the New York city department of health and  mental  hygiene
    38  or the New York city health and hospitals corporation).  The commission-
    39  er  (or the New York city commissioner as the case may be) shall require
    40  safeguards, policies and procedures under this paragraph as the  commis-
    41  sioner deems practicable.
    42    (c)  Disclosure,  possession  and use of de-identified contact tracing
    43  information under this subdivision shall be only pursuant to approval by
    44  the commissioner (or the New York city commissioner of health and mental
    45  hygiene in the case of contact tracing information collected by or under
    46  authority of the New York city department of health and  mental  hygiene
    47  or  the  New  York city health and hospitals corporation) specifying the
    48  purpose, nature and scope of the  disclosure,  possession  and  use  and
    49  measures  to  ensure that it will comply with this section and the terms
    50  of the approval.
    51    5. No law enforcement agent or entity or immigration  authority  shall
    52  be a contact tracer or contact tracing entity or engage in contact trac-
    53  ing.  This subdivision does not bar an individual who is associated with
    54  a law enforcement entity or immigration authority from acting only as  a
    55  [principal]  case  individual  or contact individual.   This subdivision
    56  does not prevent a law enforcement agent or entity from assisting  in  a
        S. 900                              5

     1  permitted use under paragraph (b) of subdivision eleven of section twen-
     2  ty-one hundred eighty of this title.
     3    6.  No  contact tracer [or], contact tracing entity or designated non-
     4  governmental entity may provide contact tracing  information  to  a  law
     5  enforcement agent [or], entity or immigration authority, or any individ-
     6  ual  or  entity  other  than  the  contact  tracing entity from which it
     7  received the information, except as explicitly authorized by this title.
     8  Without consent under subdivision two of this section,  contact  tracing
     9  information  and  any evidence derived therefrom shall not be subject to
    10  or provided in response to any legal process or be  admissible  for  any
    11  purpose in any judicial or administrative action or proceeding. However,
    12  this  subdivision does not restrict providing information, relating to a
    13  specified [principal] case individual or contact individual,  where  and
    14  only to the extent necessary for a permitted purpose.
    15    7.  (a)  Contact tracing entities shall establish appropriate adminis-
    16  trative, technical and physical safeguards, policies and procedures that
    17  ensure the security of contact tracing information  under  the  entity's
    18  jurisdiction.    The  safeguards,  policies  and  procedures must ensure
    19  contact tracing information is encrypted and protected at least as  much
    20  as or more than other confidential information under the entity's juris-
    21  diction.    All  storage  of  contact tracing information shall meet the
    22  requirements of this title. The  commissioner  (or  the  New  York  city
    23  commissioner of health and mental hygiene in the case of contact tracing
    24  information collected by or under authority of the New York city depart-
    25  ment of health and mental hygiene or the New York city health and hospi-
    26  tals  corporation)  shall  make  regulations  as reasonably necessary to
    27  require that contact tracing information possessed, used  or  under  the
    28  control  of  a contact tracer or contact tracing entity shall be subject
    29  to technical safeguards [and],  policies  and  procedures  for  storage,
    30  transmission,  use  and  protection of the information.  The regulations
    31  shall prevent possession, use  or  disclosure  of  the  contact  tracing
    32  information  not  permitted  by  this title, and shall be at least as or
    33  more protective than the safeguards, policies and procedures the commis-
    34  sioner (or the New York city commissioner as the case may  be)  provides
    35  for other confidential information.
    36    (b)  This  paragraph  applies  [where  contact  tracing information is
    37  possessed or controlled by a contact tracer or  contact  tracing  entity
    38  that  is  a  non-governmental  individual or entity employed by or under
    39  contract with a governmental entity, or an agent thereof] to  a  contact
    40  tracer  or  contact tracing entity that is a non-governmental individual
    41  or entity employed by or under contract with a governmental  entity,  or
    42  an agent thereof.  Within [thirty] sixty days of collecting or receiving
    43  the  contact  tracing  information, the [non-governmental individual or]
    44  entity shall (i) remove information from its possession or  control  and
    45  deliver  it  to the appropriate governmental contact tracing entity or a
    46  designated non-governmental entity specified by the governmental contact
    47  tracing entity, retaining no copy of it; (ii)  expunge  the  information
    48  from  its  possession  or control; or (iii) de-identify the information.
    49  However, the expungement  or  de-identification  of  particular  contact
    50  tracing  information  may  be postponed for up to fifteen days after the
    51  initial sixty day period while the contact  tracer  or  contact  tracing
    52  entity  is  actively  engaged in contact tracing using that information,
    53  provided that the [principal] case individual or contact  individual  to
    54  whom  it  pertains  gives  voluntary informed consent.   The disclosure,
    55  possession and use of  the  de-identified  contact  tracing  information
    56  shall be subject to subdivision four of this section.
        S. 900                              6

     1    §  2182.  Regulations. The commissioner shall make regulations [imple-
     2  menting] as reasonably necessary to implement this title.
     3    §  2.   This act  shall  take  effect on the same date and in the same
     4  manner as a chapter of the laws of 2020, amending  the public health law
     5  relating to the confidentiality of  contact  tracing  information,    as
     6  proposed  in  legislative  bills  numbers  S.8450-C and A.10500-C, takes
     7  effect.