Amd §§2168, 2169, 2183 & 2180, rpld §2180 subs 13 - 18 & 20, Pub Health L (as proposed in S.6541-A &
A.7326-A)
Protects the confidentiality of vaccine information; relates to the sharing of vaccine registry information; provides that anyone requiring an immunization passport shall accept a valid COVID-19 Vaccination Record Card.
STATE OF NEW YORK
________________________________________________________________________
4132
2023-2024 Regular Sessions
IN ASSEMBLY
February 9, 2023
___________
Introduced by M. of A. PAULIN -- read once and referred to the Committee
on Health
AN ACT to amend the public health law, in relation to protecting the
confidentiality of vaccine information; and to repeal provisions of
the public health law relating thereto
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Subdivision 11-a of section 2168 of the public health law,
2 as added by a chapter of the laws of 2022, amending the public health
3 law relating to protecting the confidentiality of vaccine information,
4 as proposed in legislative bills numbers S. 6541-A and A. 7326-A, is
5 amended to read as follows:
6 11-a. The commissioner, or in the city of New York, the commissioner
7 of the department of health and mental hygiene, may only share registry
8 information maintained by the department, or in the case of the citywide
9 immunization registry, the city of New York under the provisions of this
10 section with the federal Centers for Disease Control and Prevention, or
11 successor agency, for public health purposes in summary, statistical,
12 aggregate, or other form such that no individual person can be identi-
13 fied, except that either such commissioner may disclose identifiable
14 registrant information to the federal Centers for Disease Control and
15 Prevention, or its successor agency, when the commissioner has deter-
16 mined that the disclosure is in the best interests of the registrant or
17 will contribute to the protection of public health[,] and that the
18 objective of the disclosure cannot be served by disclosure limited to
19 de-identified information, [and] or the federal health officials have
20 committed in writing not to redisclose to or share registrant informa-
21 tion with any other federal agency, including but not limited to the
22 department of homeland security, immigration and customs enforcement,
23 customs and border protection, or any successor agency, or any law
24 enforcement agency; provided that either such commissioner may forgo the
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD04035-01-3
A. 4132 2
1 written commitment if requiring written commitment would result in the
2 actual withholding of federal funds.
3 § 2. Paragraph (d) of subdivision 4 of section 2168 of the public
4 health law, as amended by a chapter of the laws of 2022, amending the
5 public health law relating to protecting the confidentiality of vaccine
6 information, as proposed in legislative bills numbers S. 6541-A and A.
7 7326-A, is amended to read as follows:
8 (d) [(i) Identifiable registrant information is not (1) subject to
9 discovery, subpoena, warrant, or other means of legal compulsion for
10 release to any person or (2) admissible in any civil, administrative,
11 criminal, or family court proceeding, except for the purposes of inves-
12 tigations and prosecutions of allegations of computer tampering or bill-
13 ing fraud related to vaccination records, fraudulent statements related
14 to an individual's vaccination status, an act of violence or attempted
15 violence occurring at the site of a vaccination provider's or vaccine
16 navigator's business, or medical malpractice. Disclosure for these
17 purposes shall be subject to in camera review and approval by the court
18 and, if the use is initiated by a party other than the individual whose
19 registry information is sought, the information must be highly material
20 and relevant for the purpose.
21 (ii) Nothing in this section shall be construed to limit commissioners
22 of local social services districts or the commissioner of the office of
23 children and family services from accessing identifiable registrant
24 information under paragraph (d) of subdivision eight of this section.] A
25 person, institution or agency to whom such immunization information is
26 furnished or to whom, access to records or information has been given,
27 shall not divulge any part thereof so as to disclose the identity of
28 such person to whom such information or record relates, except insofar
29 as such disclosure is necessary for the best interests of the person or
30 other persons, consistent with the purposes of this section.
31 § 3. Paragraphs (f), (g) and (i) of subdivision 1, subparagraph (iii)
32 of paragraph (c), subparagraphs (ii) and (iv) of paragraph (d) and para-
33 graph (e) of subdivision 2 and subdivision 3 of section 2169 of the
34 public health law, as added by a chapter of the laws of 2022, amending
35 the public health law relating to protecting the confidentiality of
36 vaccine information, as proposed in legislative bills numbers S. 6541-A
37 and A. 7326-A, are amended to read as follows:
38 (f) The term "personal information" shall mean information obtained
39 from or about an individual, in connection with their registering for
40 [or receiving] a vaccination, that directly or indirectly identifies,
41 relates to, describes, is capable of being associated with, or could
42 reasonably be linked to a particular individual, household, or personal
43 device. Information is reasonably linkable to an individual, household,
44 or personal device if it can be used on its own or in combination with
45 other reasonably available information, [regardless of whether such
46 other information is held by the vaccine navigator or vaccine provider]
47 when such information is held by the vaccine navigator, to identify an
48 individual, household, or a personal device.
49 (g) The term "service attendant to the delivery of immunization" shall
50 mean [scheduling and billing for] facilitating an immunization appoint-
51 ment, sending reminders about immunization, arranging transportation to
52 or from a vaccine provider, or reporting to the department, the New York
53 City department of health and mental hygiene, or other local health
54 agency on whose behalf such vaccine navigator is performing such
55 services.
A. 4132 3
1 (i) The term "vaccine navigator" shall mean any person that collects
2 personal information from an individual in order to register that indi-
3 vidual for immunization or to help that individual register for immuni-
4 zation, provided the department, a local public health agency, or a
5 person that administers vaccines or their designees are not vaccine
6 navigators [if they only store vaccine recipient personal information in
7 medical records protected under the federal Health Insurance Portability
8 and Accountability Act of 1996, its implementing regulations, or section
9 eighteen of this chapter].
10 (iii) Without consent under this subdivision, personal information and
11 any evidence derived therefrom shall not be subject to or provided in
12 response to any legal process or be admissible for any purpose in any
13 judicial or administrative action or proceeding unless provided in
14 response pursuant to warrants, court-ordered subpoenas, administrative
15 subpoenas, or grand jury subpoenas.
16 (ii) A [person] vaccine navigator may only possess or use de-identi-
17 fied information pertaining to services attendant to the delivery of
18 immunization if the [person] vaccine navigator maintains technical safe-
19 guards and policies and procedures that prevent re-identification,
20 whether intentional or unintentional, of any individual, as may be
21 required by the commissioner (or the New York city commissioner of
22 health and mental hygiene, in the case of information collected by or
23 under authority of the New York city department of health and mental
24 hygiene. The commissioner (or the New York city commissioner as the case
25 may be) shall require safeguards, policies and procedures under this
26 paragraph as the commissioner deems practicable.
27 [(iv) This section does not prevent disclosure of personal information
28 sought for the purposes of investigations and prosecutions of allega-
29 tions of computer tampering or billing fraud related to vaccination
30 records, fraudulent statements related to an individual's vaccination
31 status, an act of violence or attempted violence occurring at the site
32 of a vaccination provider's or vaccine navigator's business, or medical
33 malpractice, professional discipline, or defense of any claim brought
34 against a vaccine navigator or provider. Disclosure for these purposes
35 shall be subject to in camera review and approval by the court and, if
36 the use is initiated by a party other than the individual whose registry
37 information is sought, the information must be highly material and rele-
38 vant for the purpose.]
39 (e) A vaccine navigator that maintains personal information shall
40 establish appropriate administrative, technical, and physical safe-
41 guards, policies, and procedures that ensure the security of that
42 personal information. The safeguards, policies, and procedures must be
43 appropriate to the volume and nature of the personal information main-
44 tained and the size, revenue, and sophistication of the vaccine naviga-
45 tor and must ensure that personal information is encrypted and protected
46 at least as much as or more than other confidential information in the
47 vaccine navigator's possession. The commissioner or, in the city of New
48 York, the commissioner of the department of health and mental hygiene
49 [shall] may make regulations as reasonably necessary to require that
50 personal information possessed, used, or under the control of a vaccine
51 navigator shall be subject to technical safeguards, policies, and proce-
52 dures for storage, transmission, use, and protection of the information.
53 The regulations must take into account the different sizes, revenues and
54 sophistications of different vaccine navigators, as well as the volume
55 and nature of the personal information they maintain.
A. 4132 4
1 3. Vaccine providers. A vaccine provider shall not delay or condition
2 the provision of any service attendant to the delivery of immunization
3 by inviting or requiring an individual seeking vaccination to complete
4 an application for a customer discount card or account or share personal
5 information that will be stored outside of a [medical] record protected
6 under the federal Health Insurance Portability and Accountability Act of
7 1996, its implementing regulations, or section eighteen of this chapter
8 for purposes other than services attendant to the delivery of immuniza-
9 tion, or by engaging in any other activity unrelated to the provision of
10 such a service that the commissioner designates by regulation.
11 § 4. Subdivisions 13, 14, 15, 16, 17, 18 and 20 of section 2180 of the
12 public health law, as added by a chapter of the laws of 2022, amending
13 the public health law relating to protecting the confidentiality of
14 vaccine information, as proposed in legislative bills numbers S. 6541-A
15 and A. 7326-A, are REPEALED and subdivision 19 is renumbered subdivision
16 13.
17 § 5. Section 2183 of the public health law, as added by a chapter of
18 the laws of 2022, amending the public health law relating to protecting
19 the confidentiality of vaccine information, as proposed in legislative
20 bills numbers S. 6541-A and A. 7326-A, is amended to read as follows:
21 § 2183. Immunity passports. 1. Any covered entity that requires proof
22 of COVID-19 immunization shall permit the use of physical immunity pass-
23 ports. No covered entity may require digital, electronic, or smart-
24 phone-based proof of immunity. Notwithstanding this section, anyone
25 requiring an immunization passport shall accept a valid COVID-19 Vacci-
26 nation Record Card allocated to COVID-19 vaccine providers by the
27 Centers for Disease Control and Prevention for that purpose. The
28 provisions of this section shall apply to valid COVID-19 Vaccination
29 Record Cards allocated to COVID-19 vaccine providers by the Centers for
30 Disease Control and Prevention.
31 2. [Any covered entity that requires the use of an immunity passport
32 shall delete any personal information derived from the immunity passport
33 about the individual to whom the immunity passport pertains within twen-
34 ty-four hours of receiving it, except that where a covered entity has an
35 ongoing relationship with an individual, the covered entity may store
36 the fact that the individual has received a COVID-19 vaccine, as well as
37 a copy of the individual's immunity passport, provided that:
38 (a) the covered entity first obtains the individual's informed, affir-
39 mative, and voluntary consent to store such information, and
40 (b) the covered entity stores any copy of an individual's immunity
41 passport and any personal information derived from the immunity passport
42 as if they were subject to the confidentiality requirements of title I
43 of the Americans with Disabilities Act 42 U.S.C. 12112(d) and its imple-
44 menting regulations, 29 CFR 1630.14.
45 3. An immunity passport provider shall not use or disclose personal
46 information derived from an immunity passport beyond what is adequate,
47 relevant, and necessary to identify an individual as having received a
48 COVID-19 vaccine or a COVID-19 test result and shall not collect,
49 access, receive, capture, store, maintain, use, or disclose personal
50 information pertaining to where or when an individual uses an immunity
51 passport.
52 4. (a) Except as provided in this subdivision, no covered entity or
53 immunity passport provider may:
54 (i) provide personal information derived from an immunity passport or
55 otherwise make such personal information accessible, directly or indi-
56 rectly, to a law enforcement agent or entity or immigration authority;
A. 4132 5
1 (ii) provide such personal information or otherwise make such personal
2 information accessible, directly or indirectly, to any other individual
3 or entity except as explicitly authorized by this section.
4 (b) Except as provided in this subdivision, personal information
5 derived from an immunity passport, and any evidence derived therefrom,
6 shall not be subject to or provided in response to any legal process or
7 be admissible for any purpose in any judicial or administrative action
8 or proceeding.
9 (c) Personal information derived from an immunity passport, and any
10 evidence derived therefrom, may be disclosed for the purposes of inves-
11 tigations and prosecutions of allegations of computer tampering or frau-
12 dulent statements related to an individual's vaccination status.
13 Disclosure for these purposes shall be subject to in camera review and
14 approval by the court and, if the use is initiated by a party other than
15 the individual whose personal information is sought, the information
16 must be highly material and relevant for the purpose.
17 5. The commissioner shall make regulations as reasonably necessary to
18 ensure that individuals who are medically contraindicated from receiving
19 the COVID-19 vaccine are nonetheless able to obtain reasonable accommo-
20 dations to enable them to access the services of a covered entity, in a
21 manner that does not impose an undue hardship on the covered entity or
22 present a direct threat that cannot be addressed by a reasonable accom-
23 modation.
24 6.] Nothing in this section requires a covered entity to require proof
25 of COVID-19 immunity or to independently verify the information
26 contained in an immunity passport.
27 [7.] 3. Nothing in this section shall be construed to limit a covered
28 entity's obligations under the Americans with Disabilities Act, article
29 fifteen of the executive law, the civil rights law, or any other feder-
30 al, state, or local anti-discrimination law.
31 [8.] 4. Nothing in this section shall be construed to affect the prac-
32 tices of a health care provider, as defined in section eighteen of this
33 chapter, a hospital or nursing home as defined in article twenty-eight
34 of this chapter, a health practitioner as defined in section twenty-one
35 hundred sixty-four of this chapter, a facility, as defined in section
36 33.13 of the mental hygiene law, or a correctional health service
37 governed by the department of corrections and community supervision, the
38 rules of the board of correction in the city of New York, or a county
39 board of correction, with respect to records concerning their patients'
40 vaccinations.
41 § 6. This act shall take effect on the same date and in the same
42 manner as a chapter of the laws of 2022, amending the public health law
43 relating to protecting the confidentiality of vaccine information, as
44 proposed in legislative bills numbers S. 6541-A and A. 7326-A, takes
45 effect.
