New York State Assembly

 
•  Summary 
 
•  Actions 
 
•  Committee Votes 
 
•  Floor Votes 
 
•  Memo 
 
•  Text 
 
•  LFIN 
 
•  Chamber Video/Transcript 

A10500 Summary:

A10500 Actions:

A10500 Committee Votes:

Committee:HEALTH   Chair:Gottfried      
DATE:07/13/2020AYE/NAY:24/0  Action: Favorable refer to committee Codes        
Gottfried
Aye
Byrne
Aye
Schimminger
Excused
McDonough
Excused
Galef
Aye
Garbarino
Aye
Dinowitz
Aye
Byrnes
Aye
Cahill
Aye
Ashby
Aye
Paulin
Aye
Miller
Aye
Cymbrowitz
Aye
Salka
Aye
Gunther
Aye
Rosenthal
Aye
Hevesi
Aye
Jaffee
Aye
Steck
Aye
Abinanti
Aye
Braunstein
Aye
Kim
Aye
Solages
Aye
Bichotte
Aye
Barron
Aye
Sayegh
Aye

Committee:CODES   Chair:Lentol      
DATE:07/17/2020AYE/NAY:21/0  Action: Favorable refer to committee Rules        
Lentol
Aye
Morinello
Aye
Schimminger
Excused
Giglio
Aye
Pretlow
Aye
Montesano
Aye
Cook
Aye
Palumbo
Aye
Cymbrowitz
Aye
Garbarino
Aye
O'Donnell
Aye
Reilly
Aye
Lavine
Aye
Perry
Aye
Abinanti
Aye
Weprin
Aye
Mosley
Aye
Hevesi
Aye
Fahy
Aye
Seawright
Aye
Rosenthal
Aye
Walker
Aye

Committee:RULES   Chair:Heastie      
DATE:07/20/2020AYE/NAY:27/0  Action: Favorable         
Heastie
Excused
Barclay
Aye
Gottfried
Aye
Crouch
Aye
Lentol
Aye
Finch
Excused
Nolan
Aye
Hawley
Aye
Weinstein
Aye
Giglio
Aye
Ortiz
Aye
Malliotakis
Aye
Pretlow
Aye
Blankenbush
Aye
Cook
Aye
Norris
Aye
Glick
Excused
Aubry
Aye
Englebright
Aye
Dinowitz
Aye
Colton
Aye
Magnarelli
Aye
Perry
Aye
Paulin
Aye
Peoples-Stokes
Aye
Benedetto
Aye
Lavine
Aye
Lupardo
Aye
Zebrowski
Aye
Thiele
Aye

A10500 Floor Votes:

A10500 Memo:

NEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
 submitted in accordance with Assembly Rule III, Sec 1(f)



 
BILL NUMBER: A10500c          REVISED 07/22/2020
 
SPONSOR: Rules (Gottfried)

 
TITLE OF BILL:
 
An act to amend the public health law, in relation to the confidentiali-
ty of contact tracing information
 
 
PURPOSE:
 
To ensure that information collected through contact tracing for COVID19
is kept confidential
 
 
SUMMARY OF PROVISIONS:
 
Section one of the bill would amend Article 21 of the public health law
by adding a new title 8 including a new section 2180 which sets forth
various definitions and a new section 2181 which:

-Requires all contact tracing information be kept confidential and may
not be disclosed except as necessary to carry out contact tracing or a
permitted purpose (2181 (1) (a);
 
-Authorizes an individual to waive confidentiality in a written,
informed, and voluntary waiver in plain language understandable to the
individual (oral waiver in a limited case). If an individual lacks the
ability to make a waiver, an individual authorized to consent to health
care for the individual may make the waiver (2181 (2) (a);
 
-States that a waiver for providing support to an individual only
applies if the individual consents to the providing of the support
(2181) (2) (b). While 2181 (2) (b) does not, on its face, authorize
consent by another person for support services where the individual
lacks capacity, the legislative intent is that it does authorize such
consent. Otherwise it would create an irrational and unintended result
making it effectively impossible to provide consent to enable support
services for person who lacks capacity to consent.
 
-Authorizes disclosure, possession, or use of contact tracing informa-
tion that has been de-identified, for public health or public health
research purposes, including requiring technical safeguards against
re-identification (2181 (4) (a);
 
-Prohibits law enforcement agents or entities or immigration authorities
from participating in contact tracing (except acting as the principal
individual or contact individual) and prohibits contact tracers and
entities from providing contact tracing information to law enforcement
or immigration authorities except for permitted purposes (2181) (6). The
final sentence of subdivision 2181 (6) creates the plain language excep-
tion to the prohibition, for permitted purposes (as defined in 2180
(11,) and only relating to a specified principal individual or contact
individual and only to the extent necessary for such permitted purpose.

-Directs the Commissioner and New York City Commissioner of Health and
Mental Hygiene to make regulations on technical safeguards for data
storage, transmission, and use, that are at least as protective as apply
to other confidential information (2181) (7) (a); and
 
 
-Requires non-governmental entities (such as private contractors hired
for contact tracing programs) to expunge or de-identify information in
their possession within 30 days of receiving it, and allows an addi-
tional 15 days if actively engaged in contact tracing using that infor-
mation and the individual consents (2181) (7) (b).
 
New York City uses a private company to house its contact tracing infor-
mation. The City says the information is fully encrypted, only accessi-
ble by the governmental contact tracing entity, and that the company has
no access to or control of the information. The company is not able to
deliver it to anyone. Only the governmental contact tracing entity can
do that. This is like property being in a sealed container in a bank
safe deposit box or a locked mini-storage space, where only the City has
the keys. Where this is in fact the case, it is clear, and is the legis-
lative intent, that this contact tracing information would not be
considered to be "possessed or controlled" by the non-governmental indi-
vidual or entity, for purposes of 2181 (7) (b). It would be "possessed
or controlled" by the governmental entity. It is important to note that
the bill requires the state and city health departments to adopt very
stringent regulations to secure all contact tracing information.
 
Section two of the bill provides an effective date.
 
 
JUSTIFICATION:
 
New York State began an aggressive contact tracing program in May 2020
as part of its effort to stop the spread of the COVID-I9 virus and move
toward the reopening of regions of the state. The plan envisions an
"army" of contact tracers to help identify COVID-19 positive individ-
uals, who they have been in contact with, and isolate those who may have
been infected. Contact tracing has been conducted for decades to address
various communicable diseases, but never on this scale. It is estimated
that there will be 30 contact tracers per 100,000 individuals.
 
Contact tracing is vital, but will not work unless people know that
their information will be kept confidential.
 
Under the bill, PHL Sec. 2181(1)(a) states: "All contact tracing infor-
mation . . . may not be disclosed except as necessary to carry out
contact tracing or a permitted purpose." Where contact tracing informa-
tion is disclosed for a particular purpose under the bill, the recipient
of the information is and must be bound by the terms under which it was
disclosed and may not "repurpose" the use or handling of the informa-
tion.
 
New York State has a long history of establishing confidentiality
protections for information gathered on people relative to contagious
diseases like HIV/AIDS and sexually transmitted diseases. Information
gathered through this new, massive COVID-19 contact tracing program must
also be protected.
 
At a joint legislative public hearing held May 18, 2020 entitled
"Exploring solutions to the disproportionate impact of COVID-19 on
minority communities," concerns were raised about the use and sharing of
information gathered through contact tracing. Communities of color have
been disproportionately impacted by the COVID-19 pandemic and have expe-
rienced many types and levels of racial disparities. They may be right-
fully reluctant to share sensitive and personal information with
contract tracers for fear that the information will be shared with other
government entities. As this information is key to stopping the spread
of this highly contagious virus, individuals must know that the informa-
tion they provide cannot be shared with law enforcement or be used in
other ways not associated with the purposes of safeguarding the public's
health without their voluntary disclosure and written consent.
 
This legislation preserves the confidentiality of information and
reports gathered through contact tracing. It both protects all individ-
uals involved in the effort and provides them with the confidence that
sharing information with a contact tracer cannot put them or their loved
ones in harm's way.
 
 
LEGISLATIVE HISTORY:
 
New bill.
 
 
FISCAL:
 
None
 
 
EFFECTIVE DATE:
Immediately.

A10500 Text:

 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                        10500--C
 
                   IN ASSEMBLY
 
                                      May 22, 2020
                                       ___________
 
        Introduced  by  COMMITTEE ON RULES -- (at request of M. of A. Gottfried,
          Paulin, Dinowitz, Jaffee, McDonald, Galef,  Simon,  Solages,  Bronson,
          Hunter,  Niou, Zebrowski, Quart, Cruz, Ashby, Lentol, Weprin, Epstein,
          Mosley, Abinanti,  Perry,  Pichardo,  Blake,  Englebright,  Seawright,
          Ortiz,  Reyes,  L. Rosenthal,  Fernandez,  Simotas,  Cahill, Jacobson,
          Frontus, McMahon, Smith, Thiele, Colton,  Stern,  Rodriguez,  Dickens,
          Taylor, Otis, Lupardo, Fahy, Steck, Lavine, Cymbrowitz, Wright, Ramos,
          Walker)  --  read  once  and  referred  to  the Committee on Health --
          committee discharged, bill amended, ordered reprinted as  amended  and
          recommitted  to  said  committee -- again reported from said committee
          with amendments, ordered reprinted as amended and recommitted to  said
          committee  --  reported  and  referred  to  the  Committee on Rules --
          committee discharged, bill amended, ordered reprinted as  amended  and
          recommitted to said committee
 
        AN ACT to amend the public health law, in relation to the confidentiali-
          ty of contact tracing information
 
          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:

     1    Section 1. Article 21 of the public health law is amended by adding  a
     2  new title 8 to read as follows:
     3                                   TITLE 8
     4                         NOVEL CORONAVIRUS, COVID-19
     5  Section 2180. Definitions.
     6          2181. COVID-19 contact tracing; confidentiality.
     7          2182. Regulations.
     8    §  2180.  Definitions. As used in this title the following terms shall
     9  have the following meanings:
    10    1. "Contact tracing" means case investigation  and  identification  of
    11  principal individuals and contact individuals.
    12    2.  "Contact  tracer" and "contact tracing entity" means an individual
    13  or entity employed by or under contract with the state, a local  govern-
    14  ment,  a  state  or  local  governmental entity, or an agent thereof, to
    15  conduct contact tracing, engage in contact tracing, or  receive  contact
    16  tracing information.
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD16487-13-0
        A. 10500--C                         2
 
     1    3.  "Contact  tracing information" means any information that includes
     2  or can reveal the identity of any principal individual or contact  indi-
     3  vidual,  and  any COVID-19-related information or test results, received
     4  or collected for the purpose or in the course of contact tracing.
     5    4.  "Contact  individual" means an individual who has or may have come
     6  in contact with a principal individual or  who  has  or  may  have  been
     7  exposed to and possibly infected with COVID-19.
     8    5.  "Principal  individual"  means  an  individual with a confirmed or
     9  probable diagnosis of COVID-19.
    10    6. "COVID-19" means infection with or the disease caused by the severe
    11  acute respiratory syndrome coronavirus 2 (SARS-CoV-2).
    12    7. "Immigration authority" means any  entity,  officer,  employee,  or
    13  government employee or agent thereof charged with or engaged in enforce-
    14  ment  of  the  federal  Immigration  and  Nationality Act, including the
    15  United States Immigration  and  Customs  Enforcement  or  United  States
    16  Customs and Border Protection, or any successor legislation or entity.
    17    8.  "De-identified" means, in relation to contact tracing information,
    18  that the information cannot identify or be made to identify or be  asso-
    19  ciated  with  a  particular  individual,  directly  or indirectly and is
    20  subject to technical safeguards and policies and procedures that prevent
    21  re-identification, whether  intentionally  or  unintentionally,  of  any
    22  individual.
    23    9.  "Law enforcement agent or entity" means any governmental entity or
    24  public servant, or agent, contractor or employee thereof, authorized  to
    25  investigate,  prosecute,  or  make  an  arrest  for  a criminal or civil
    26  offense, or engaged in any such activity, but shall not mean the depart-
    27  ment, the commissioner,  a  health  district,  a  county  department  of
    28  health,  a  county health commissioner, a local board of health, a local
    29  health officer, the department of health and mental hygiene of the  city
    30  of  New York, or the commissioner of the department of health and mental
    31  hygiene of the city of New York.
    32    10. "Support" means resources or services provided to an individual to
    33  enable such  individual  to  safely  quarantine  or  isolate,  including
    34  grocery,  meal  or  pharmacy  delivery, laundry services, child or elder
    35  care, pet walking, assistance with telephone, internet, or other  commu-
    36  nication  services  or devices, health and mental health services, legal
    37  services, provision of appropriate  living  space  for  individuals  who
    38  cannot  isolate or quarantine at home, and income replacement. "Support"
    39  may also include support provided to  other  individuals  for  whom  the
    40  individual commonly provides those resources or services.
    41    11. "Permitted purpose" means:
    42    (a) disclosure to appropriate health care providers or their personnel
    43  for  the  purpose  of  the  clinical diagnosis, care or treatment of the
    44  principal individual or contact individual who is  the  subject  of  the
    45  information,  where an emergency exists and the individual is in immedi-
    46  ate need of medical attention and an attempt  to  secure  consent  would
    47  result  in delay of treatment which would increase the risk to the indi-
    48  vidual's life or health;
    49    (b) facilitating a legally-authorized public health-related action, in
    50  relation to a specified  principal  individual  or  contact  individual,
    51  where and only to the extent necessary to protect the public health; or
    52    (c)  the  investigation,  prosecution  or  defense of a civil or legal
    53  action for a violation of this title; provided that if the use is initi-
    54  ated by a party other than the principal individual or contact  individ-
    55  ual  who is the subject of the contact tracing information, the informa-
    56  tion must be highly material and relevant for the purpose.
        A. 10500--C                         3
 
     1    § 2181. COVID-19 contact tracing; confidentiality. 1.  (a) All contact
     2  tracing information shall be kept confidential by any contact tracer and
     3  contact tracing entity, and may not be disclosed except as necessary  to
     4  carry out contact tracing or a permitted purpose.
     5    (b) Where a contact tracer or contact tracing entity discloses contact
     6  tracing  information  for  a  permitted  purpose,  the contact tracer or
     7  contact tracing entity shall make a record of the disclosure,  including
     8  to whom it was made, which shall be part of the contact tracing informa-
     9  tion.
    10    2.  (a)  An  individual  may waive the confidentiality provided for by
    11  this section, only by a written, informed and voluntary waiver, in plain
    12  language and in a language understandable to the individual  making  the
    13  waiver,  and  not part of any other document. The waiver shall state the
    14  scope and limit of the waiver. If an individual lacks  the  capacity  to
    15  make  a  waiver,  an individual authorized to consent to health care for
    16  the individual, or the individual's legal representative, may  make  the
    17  waiver.    However,  a  waiver  of confidentiality is not required to be
    18  written if it is solely  for  the  purpose  of  arranging  or  providing
    19  support  for  the  individual  who is the subject of the contact tracing
    20  information.
    21    (b) A waiver of confidentiality under this section  shall  only  apply
    22  for  the purpose of arranging or providing support if the individual who
    23  is the subject of the contact  tracing  information  provides  voluntary
    24  informed consent to the arranging or providing of the support.
    25    3.  A  disclosure of contact tracing information authorized under this
    26  section shall be limited in scope as to the identity of any  individual,
    27  the  information  to be disclosed, and the party to which disclosure may
    28  be made, and as necessary to achieve the purpose of the disclosure under
    29  this section, and shall not authorize re-disclosure except as explicitly
    30  authorized by the terms of the waiver under this section.  However, this
    31  section does not bar disclosure of contact tracing information  pertain-
    32  ing  to  and identifying a principal individual or contact individual by
    33  the individual who is identified.
    34    4.  (a)  This  section  does  not  bar  otherwise-lawful   disclosure,
    35  possession  or  use  of contact tracing information, including aggregate
    36  contact  tracing  information,  that   is   de-identified.   Disclosure,
    37  possession  or  use  under  this  subdivision shall only be for a public
    38  health or public health research purpose.
    39    (b) A person or entity may only possess or use  de-identified  contact
    40  tracing  information  if  the person or entity maintains technical safe-
    41  guards and  policies  and  procedures  that  prevent  re-identification,
    42  whether  intentional  or  unintentional,  of  any  individual, as may be
    43  required by the commissioner (or  the  New  York  city  commissioner  of
    44  health  and  mental  hygiene  in the case of contact tracing information
    45  collected by or under authority of  the  New  York  city  department  of
    46  health  and  mental  hygiene  or  the New York city health and hospitals
    47  corporation).  The commissioner (or the New York  city  commissioner  as
    48  the case may be) shall require safeguards, policies and procedures under
    49  this paragraph as the commissioner deems practicable.
    50    (c)  Disclosure,  possession  and use of de-identified contact tracing
    51  information under this subdivision shall be only pursuant to approval by
    52  the commissioner (or the New York city commissioner of health and mental
    53  hygiene in the case of contact tracing information collected by or under
    54  authority of the New York city department of health and  mental  hygiene
    55  or  the  New  York city health and hospitals corporation) specifying the
    56  purpose, nature and scope of the  disclosure,  possession  and  use  and
        A. 10500--C                         4
 
     1  measures  to  ensure that it will comply with this section and the terms
     2  of the approval.
     3    5.  No  law enforcement agent or entity or immigration authority shall
     4  be a contact tracer or contact tracing entity or engage in contact trac-
     5  ing. This subdivision does not bar an individual who is associated  with
     6  a  law enforcement entity or immigration authority from acting only as a
     7  principal individual or contact individual.
     8    6. No contact tracer or contact tracing  entity  may  provide  contact
     9  tracing  information to a law enforcement agent or entity or immigration
    10  authority. Without  consent  under  subdivision  two  of  this  section,
    11  contact tracing information and any evidence derived therefrom shall not
    12  be  subject to or provided in response to any legal process or be admis-
    13  sible for any purpose  in  any  judicial  or  administrative  action  or
    14  proceeding. However, this subdivision does not restrict providing infor-
    15  mation, relating to a specified principal individual or contact individ-
    16  ual, where and only to the extent necessary for a permitted purpose.
    17    7.  (a)  The commissioner (or the New York city commissioner of health
    18  and mental hygiene in the case of contact tracing information  collected
    19  by  or  under  authority  of  the New York city department of health and
    20  mental hygiene or the New York city health  and  hospitals  corporation)
    21  shall  make  regulations  to  require  that  contact tracing information
    22  possessed, used or under the control of  a  contact  tracer  or  contact
    23  tracing entity shall be subject to technical safeguards and policies and
    24  procedures for storage, transmission, use and protection of the informa-
    25  tion.    The  regulations shall prevent possession, use or disclosure of
    26  the contact tracing information not permitted by this title,  and  shall
    27  be  at  least  as  or  more protective than the safeguards, policies and
    28  procedures the commissioner (or the New York city  commissioner  as  the
    29  case may be) provides for other confidential information.
    30    (b)  This  paragraph  applies  where  contact  tracing  information is
    31  possessed or controlled by a contact tracer or  contact  tracing  entity
    32  that  is  a  non-governmental  individual or entity employed by or under
    33  contract with a governmental entity, or an agent thereof.  Within thirty
    34  days of collecting or receiving the  contact  tracing  information,  the
    35  non-governmental  individual or entity shall (i) remove information from
    36  its possession or control and deliver it to the appropriate governmental
    37  contact tracing entity, retaining no copy of it; (ii) expunge the infor-
    38  mation from its possession or control; or (iii) de-identify the informa-
    39  tion.   However, the  expungement  or  de-identification  of  particular
    40  contact  tracing  information  may  be  postponed for up to fifteen days
    41  while the contact tracer or contact tracing entity is  actively  engaged
    42  in  contact  tracing using that information, provided that the principal
    43  individual or contact individual to whom  it  pertains  gives  voluntary
    44  informed  consent.  The disclosure, possession and use of the de-identi-
    45  fied contact tracing information shall be subject to subdivision four of
    46  this section.
    47    § 2182. Regulations. The commissioner shall  make  regulations  imple-
    48  menting this title.
    49    § 2. This act shall take effect immediately.