STATE OF NEW YORK
________________________________________________________________________
900
2021-2022 Regular Sessions
IN SENATE(Prefiled)
January 6, 2021
___________
Introduced by Sen. RIVERA -- read twice and ordered printed, and when
printed to be committed to the Committee on Rules
AN ACT to amend the public health law, in relation to the confidentiali-
ty of contact tracing information
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Sections 2180, 2181 and 2182 of the public health law, as
2 added by a chapter of the laws of 2020, amending the public health law
3 relating to the confidentiality of contact tracing information, as
4 proposed in legislative bills numbers S.8450-C and A.10500-C, are
5 amended to read as follows:
6 § 2180. Definitions. As used in this title the following terms shall
7 have the following meanings:
8 1. "Contact tracing" means COVID-19 case investigation and identifica-
9 tion of [principal] case individuals and contact individuals.
10 2. (a) "Contact tracer" and "contact tracing entity" means an individ-
11 ual or entity employed by or under contract with the state, a local
12 government, a state or local governmental entity, or an agent thereof,
13 to conduct contact tracing, engage in contact tracing, or receive
14 contact tracing information.
15 (b) A contact tracer or contact tracing entity shall not include a
16 service provider that is a non-governmental entity that is employed by
17 or under contract with a contact tracing entity or an agent thereof,
18 that receives, transmits, maintains, stores, or hosts contact tracing
19 information at the direction of a contact tracer or contact tracing
20 entity so long as such service provider's access to the information is
21 exclusively limited to the maintenance of the information and the
22 contact tracer or contact tracing entity has the ability to delete and
23 manage contact tracing information as provided by this chapter, law,
24 rules or regulations. A service provider under this paragraph shall be
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD07194-01-1
S. 900 2
1 referred to in this title as a "designated non-governmental entity." A
2 service provider that does not meet the requirements of this paragraph
3 and would otherwise be subject to paragraph (a) of this subdivision
4 shall be a contact tracing entity.
5 3. "Contact tracing information" means any information that includes
6 or can reveal the identity of any [principal] case individual or contact
7 individual, and any COVID-19-related information or test results,
8 received or collected for the purpose or in the course of contact trac-
9 ing.
10 4. "Contact individual" means an individual who has or may have come
11 in contact with a [principal] case individual or who has or may have
12 been exposed to and possibly infected with COVID-19.
13 5. "[Principal] Case individual" means an individual with a confirmed
14 or probable diagnosis of COVID-19.
15 6. "COVID-19" means infection with or the disease caused by the severe
16 acute respiratory syndrome coronavirus 2 (SARS-CoV-2).
17 7. "Immigration authority" means any entity, officer, employee, or
18 government employee or agent thereof charged with or engaged in enforce-
19 ment of the federal Immigration and Nationality Act, including the
20 United States Immigration and Customs Enforcement, United States Depart-
21 ment of Homeland Security, or United States Customs and Border
22 Protection, or agent, contractor or employee thereof, or any successor
23 legislation or entity.
24 8. "De-identified" means, in relation to contact tracing information,
25 that the information cannot identify or be made to identify or be asso-
26 ciated with a particular individual, directly or indirectly and is
27 subject to technical safeguards and policies and procedures that prevent
28 re-identification, whether intentionally or unintentionally, of any
29 individual.
30 9. "Law enforcement agent or entity" means any governmental entity or
31 public servant, or agent, contractor or employee thereof, authorized to
32 investigate, prosecute, or make an arrest for a criminal or civil
33 offense (except a designated civil offense), or engaged in any such
34 activity, but shall not mean the department, the commissioner, a health
35 district, a county department of health, a county health commissioner, a
36 local board of health, a local health officer, the department of health
37 and mental hygiene of the city of New York, or the commissioner of the
38 department of health and mental hygiene of the city of New York. As
39 used in this subdivision, "designated civil offense" means a civil
40 offense or offenses designated by the commissioner (or the commissioner
41 of the New York city department of health and mental hygiene in the case
42 of contact tracing information collected by or under authority of the
43 New York city department of health and mental hygiene or the New York
44 city health and hospitals corporation).
45 10. "Support" means resources or services provided to an individual to
46 enable such individual to safely quarantine or isolate, including
47 grocery, meal or pharmacy delivery, laundry services, child or elder
48 care, pet walking, assistance with telephone, internet, or other commu-
49 nication services or devices, health and mental health services, legal
50 services, provision of appropriate living space for individuals who
51 cannot isolate or quarantine at home, and income replacement. "Support"
52 may also include support provided to other individuals for whom the
53 individual commonly provides those resources or services.
54 11. "Permitted purpose" means:
55 (a) disclosure to appropriate health care providers or their personnel
56 for the purpose of the clinical diagnosis, care or treatment of the
S. 900 3
1 [principal] case individual or contact individual who is the subject of
2 the information, where an emergency exists and the individual is in
3 immediate need of medical attention and an attempt to secure consent
4 would result in delay of treatment which would increase the risk to the
5 individual's life or health;
6 (b) facilitating a legally-authorized public health-related action,
7 [in relation to a specified principal individual or contact individual,]
8 where and only to the extent necessary to protect the public health in
9 relation to COVID-19; or
10 (c) [the investigation, prosecution or defense of a civil or legal
11 action for] use or disclosure of contact tracing information to pursue a
12 legal action in relation to a violation of this title; provided that
13 disclosure shall be subject to in camera review and approval by the
14 court, and, if the use is initiated by a party other than the [princi-
15 pal] case individual or contact individual who is the subject of the
16 contact tracing information, the information must be highly material and
17 relevant for the purpose.
18 § 2181. COVID-19 contact tracing; confidentiality. 1. (a) All contact
19 tracing information shall be kept confidential by any contact tracer
20 [and], contact tracing entity, or designated non-governmental entity and
21 may not be disclosed except as necessary to carry out contact tracing or
22 a permitted purpose. A designated non-governmental entity may only act
23 in relation to contact tracing information as explicitly authorized by
24 this title.
25 (b) Where a contact tracer or contact tracing entity discloses contact
26 tracing information for a permitted purpose, the contact tracer or
27 contact tracing entity shall make a record of the disclosure, including
28 to whom it was made and when it was made, which shall be part of the
29 contact tracing information.
30 (c) Nothing in this title prohibits otherwise lawful voluntary
31 reporting, at the discretion of the contact tracer, reasonably and in
32 good faith: (i) to the statewide central registry under title six of
33 article six of the social services law, adult protective services under
34 titles one and two of article nine-B of the social services law, or the
35 justice center for the protection of people with special needs under
36 article eleven of the social services law; or (ii) to a governmental or
37 non-governmental emergency reporting system (such as a "911," domestic
38 violence or suicide prevention system) to prevent imminent risk of
39 injury to any person.
40 (d) This title does not limit disclosure to or by, or possession or
41 use by, the case individual or contact individual who is the subject of
42 the information.
43 2. (a) An individual may waive the confidentiality provided for by
44 this section, only by a written, informed and voluntary waiver, in plain
45 language and in a language understandable to the individual making the
46 waiver, and not part of any other document. The waiver shall state the
47 scope and limit of the waiver. No contact tracer, contact tracing enti-
48 ty or governmental or non-governmental entity may seek or act in reli-
49 ance on a waiver to distribute, sell, or otherwise disclose identifiable
50 or de-identified data to any individual or entity. Provided however,
51 nothing in this subdivision shall prohibit distribution or disclosure
52 that is otherwise explicitly authorized by this section. If an individ-
53 ual lacks the capacity to make a waiver, an individual authorized to
54 consent to health care for the individual, or the individual's legal
55 representative, may make the waiver. However, a waiver of confidential-
56 ity is not required to be written if it is solely for the purpose of
S. 900 4
1 arranging or providing support for the individual who is the subject of
2 the contact tracing information, provided the consent is informed and
3 voluntary.
4 (b) A waiver of confidentiality under this section shall only apply
5 for the purpose of arranging or providing support if the individual who
6 is the subject of the contact tracing information (or, if the individual
7 lacks the capacity to provide informed consent, an individual authorized
8 to consent to health care for the individual, or the individual's legal
9 representative) provides voluntary informed consent to the arranging or
10 providing of the support.
11 3. A disclosure of contact tracing information authorized under this
12 section shall be limited in scope as to the identity of any individual,
13 the information to be disclosed, and the party to which disclosure may
14 be made, and as necessary to achieve the purpose of the disclosure under
15 this section, and shall not authorize re-disclosure except as explicitly
16 authorized by the terms of the waiver under this section. However, this
17 section does not bar disclosure of contact tracing information pertain-
18 ing to and identifying a [principal] case individual or contact individ-
19 ual by the individual who is identified.
20 4. (a) This section does not bar otherwise-lawful disclosure,
21 possession or use of de-identified contact tracing information, includ-
22 ing aggregate contact tracing information[, that is de-identified].
23 Disclosure, possession or use under this subdivision shall only be for a
24 public health or public health research or evaluation purpose as deter-
25 mined by the commissioner (or the commissioner of the New York city
26 department of health and mental hygiene in the case of contact tracing
27 information collected by or under authority of the New York city depart-
28 ment of health and mental hygiene or the New York city health and hospi-
29 tals corporation), and shall not authorize re-disclosure or other use.
30 (b) A person or entity may only disclose, possess or use de-identified
31 contact tracing information if the person or entity, and the person or
32 entity to which it is disclosed, maintains technical safeguards and
33 policies and procedures that prevent re-identification, whether inten-
34 tional or unintentional, of any individual, as may be required by the
35 commissioner (or the New York city commissioner of health and mental
36 hygiene in the case of contact tracing information collected by or under
37 authority of the New York city department of health and mental hygiene
38 or the New York city health and hospitals corporation). The commission-
39 er (or the New York city commissioner as the case may be) shall require
40 safeguards, policies and procedures under this paragraph as the commis-
41 sioner deems practicable.
42 (c) Disclosure, possession and use of de-identified contact tracing
43 information under this subdivision shall be only pursuant to approval by
44 the commissioner (or the New York city commissioner of health and mental
45 hygiene in the case of contact tracing information collected by or under
46 authority of the New York city department of health and mental hygiene
47 or the New York city health and hospitals corporation) specifying the
48 purpose, nature and scope of the disclosure, possession and use and
49 measures to ensure that it will comply with this section and the terms
50 of the approval.
51 5. No law enforcement agent or entity or immigration authority shall
52 be a contact tracer or contact tracing entity or engage in contact trac-
53 ing. This subdivision does not bar an individual who is associated with
54 a law enforcement entity or immigration authority from acting only as a
55 [principal] case individual or contact individual. This subdivision
56 does not prevent a law enforcement agent or entity from assisting in a
S. 900 5
1 permitted use under paragraph (b) of subdivision eleven of section twen-
2 ty-one hundred eighty of this title.
3 6. No contact tracer [or], contact tracing entity or designated non-
4 governmental entity may provide contact tracing information to a law
5 enforcement agent [or], entity or immigration authority, or any individ-
6 ual or entity other than the contact tracing entity from which it
7 received the information, except as explicitly authorized by this title.
8 Without consent under subdivision two of this section, contact tracing
9 information and any evidence derived therefrom shall not be subject to
10 or provided in response to any legal process or be admissible for any
11 purpose in any judicial or administrative action or proceeding. However,
12 this subdivision does not restrict providing information, relating to a
13 specified [principal] case individual or contact individual, where and
14 only to the extent necessary for a permitted purpose.
15 7. (a) Contact tracing entities shall establish appropriate adminis-
16 trative, technical and physical safeguards, policies and procedures that
17 ensure the security of contact tracing information under the entity's
18 jurisdiction. The safeguards, policies and procedures must ensure
19 contact tracing information is encrypted and protected at least as much
20 as or more than other confidential information under the entity's juris-
21 diction. All storage of contact tracing information shall meet the
22 requirements of this title. The commissioner (or the New York city
23 commissioner of health and mental hygiene in the case of contact tracing
24 information collected by or under authority of the New York city depart-
25 ment of health and mental hygiene or the New York city health and hospi-
26 tals corporation) shall make regulations as reasonably necessary to
27 require that contact tracing information possessed, used or under the
28 control of a contact tracer or contact tracing entity shall be subject
29 to technical safeguards [and], policies and procedures for storage,
30 transmission, use and protection of the information. The regulations
31 shall prevent possession, use or disclosure of the contact tracing
32 information not permitted by this title, and shall be at least as or
33 more protective than the safeguards, policies and procedures the commis-
34 sioner (or the New York city commissioner as the case may be) provides
35 for other confidential information.
36 (b) This paragraph applies [where contact tracing information is
37 possessed or controlled by a contact tracer or contact tracing entity
38 that is a non-governmental individual or entity employed by or under
39 contract with a governmental entity, or an agent thereof] to a contact
40 tracer or contact tracing entity that is a non-governmental individual
41 or entity employed by or under contract with a governmental entity, or
42 an agent thereof. Within [thirty] sixty days of collecting or receiving
43 the contact tracing information, the [non-governmental individual or]
44 entity shall (i) remove information from its possession or control and
45 deliver it to the appropriate governmental contact tracing entity or a
46 designated non-governmental entity specified by the governmental contact
47 tracing entity, retaining no copy of it; (ii) expunge the information
48 from its possession or control; or (iii) de-identify the information.
49 However, the expungement or de-identification of particular contact
50 tracing information may be postponed for up to fifteen days after the
51 initial sixty day period while the contact tracer or contact tracing
52 entity is actively engaged in contact tracing using that information,
53 provided that the [principal] case individual or contact individual to
54 whom it pertains gives voluntary informed consent. The disclosure,
55 possession and use of the de-identified contact tracing information
56 shall be subject to subdivision four of this section.
S. 900 6
1 § 2182. Regulations. The commissioner shall make regulations [imple-
2 menting] as reasonably necessary to implement this title.
3 § 2. This act shall take effect on the same date and in the same
4 manner as a chapter of the laws of 2020, amending the public health law
5 relating to the confidentiality of contact tracing information, as
6 proposed in legislative bills numbers S.8450-C and A.10500-C, takes
7 effect.
