Establishes the central healthcare data system which stores medical records and information and provides such medical records and information to authorized users.
STATE OF NEW YORK
________________________________________________________________________
8292
2023-2024 Regular Sessions
IN ASSEMBLY
November 27, 2023
___________
Introduced by M. of A. BURKE -- read once and referred to the Committee
on Health
AN ACT to amend the public health law, in relation to establishing the
central healthcare data system
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The public health law is amended by adding a new section
2 18-c to read as follows:
3 § 18-c. Central healthcare data system. 1. For the purposes of this
4 section:
5 (a) The term "authorized user" shall mean any person or entity author-
6 ized by a patient to provide information on such patient to or to
7 receive information about such patient from the central healthcare data
8 system and shall include, but not be limited to, health care providers
9 and their designees, registered professional nurses, and pharmacists. An
10 authorized user may be located outside New York state. An entity shall
11 be an authorized user only with respect to their patients who have
12 authorized access to such patients' information within the system.
13 (b) The term "central healthcare data system" or "system" shall mean a
14 statewide computerized database maintained by the department capable of
15 collecting, storing, and disclosing electronic and paper medical records
16 and information.
17 (c) The term "patient" shall mean a person seeking or receiving a
18 health care service from the health care provider.
19 2. The department is hereby directed to establish a central healthcare
20 data system that shall:
21 (a) collect medical records and information from and distribute
22 medical records and information to authorized users to ensure such
23 authorized users are aware of a patient's entire medical history so as
24 to ensure the highest quality of health care is provided;
25 (b) establish the public health infrastructure necessary to obtain,
26 collect, preserve, and disclose medical records and information; and
27 (c) protect the confidentiality of an individual's identifying infor-
28 mation and the privacy of persons included in the system.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD13042-01-3
A. 8292 2
1 3. (a) All authorized users shall provide all medical records and
2 information on their patients to the central healthcare data system
3 within fourteen days of such medical records and information being
4 created.
5 (b) All authorized users shall retrieve all medical records and infor-
6 mation on their patients from the central healthcare data system before
7 providing any healthcare services; provided, however, an authorized user
8 shall retrieve all medical records and information on their patients
9 from the central healthcare data system within twenty-four hours of
10 beginning to provide any healthcare services where emergency healthcare
11 services were required to protect the life and well-being of the
12 patient.
13 4. (a) All information maintained by the department under the
14 provisions of this section shall be confidential except as necessary to
15 carry out the provisions of this section and shall not be released for
16 any other purpose.
17 (b) No authorized user to whom medical records and information is
18 furnished by the system shall divulge any part thereof, except insofar
19 as such disclosure is necessary for the best interests of the patient,
20 consistent with the purposes of this section.
21 5. Submission of incomplete medical records and information shall not
22 prohibit entry of incomplete but viable data into the system. All
23 authorized users shall provide the department with additional or clari-
24 fying information upon request reasonably related to the purposes of
25 this section.
26 6. (a) Access and use of the system shall be limited to authorized
27 users. The commissioner shall provide a method by which authorized
28 users shall apply for access to the system.
29 (b) The commissioner may judge the legitimacy of any request for
30 access and use of the system and may refuse such access and use based on
31 the authenticity of the request, credibility of the authorized user or
32 other reasons as provided for by the commissioner.
33 7. Any patient, or his or her parent, or guardian, or other person in
34 parental or custodial relation for persons under the age of eighteen,
35 who has any medical records and information in the system may request a
36 copy of such medical records and information according to procedures
37 established by the commissioner.
38 8. The commissioner shall promulgate regulations as necessary to
39 effectuate the provisions of this section. Such regulations shall
40 include provisions for orderly implementation and operation of the
41 system, including the method by which each category of authorized user
42 may access the system. Access standards shall include at a minimum a
43 method for assigning and authenticating each user identification and
44 password assigned.
45 9. No authorized user shall be subjected to civil or criminal liabil-
46 ity, or be deemed to have engaged in unprofessional conduct, for report-
47 ing to, receiving from, or disclosing information relating to the system
48 when made reasonably and in good faith and in accordance with the
49 provisions of this section or any regulation adopted thereto.
50 § 2. This act shall take effect one year after it shall have become a
51 law. Effective immediately, the addition, amendment and/or repeal of any
52 rule or regulation necessary for the implementation of this act on its
53 effective date are authorized to be made and completed on or before such
54 effective date.