•  Summary 
  •  
  •  Actions 
  •  
  •  Committee Votes 
  •  
  •  Floor Votes 
  •  
  •  Memo 
  •  
  •  Text 
  •  
  •  LFIN 
  •  
  •  Chamber Video/Transcript 

A00230 Summary:

BILL NOA00230
 
SAME ASSAME AS S04119
 
SPONSORBraunstein (MS)
 
COSPNSRAbinanti, Zebrowski, Colton, Jaffee, Steck, Weprin
 
MLTSPNSRCrouch, Montesano, O'Donnell
 
Add 3006-a, Pub Health L
 
Prohibits emergency service providers from selling patient health information without written consent.
Go to top    

A00230 Actions:

BILL NOA00230
 
01/09/2019referred to health
01/15/2019reported referred to codes
05/21/2019reported
05/23/2019advanced to third reading cal.369
05/29/2019passed assembly
05/29/2019delivered to senate
05/29/2019REFERRED TO HEALTH
06/12/2019SUBSTITUTED FOR S4119
06/12/20193RD READING CAL.1306
06/12/2019PASSED SENATE
06/12/2019RETURNED TO ASSEMBLY
Go to top

A00230 Memo:

NEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
submitted in accordance with Assembly Rule III, Sec 1(f)
 
BILL NUMBER: A230
 
SPONSOR: Braunstein (MS)
  TITLE OF BILL: An act to amend the public health law, in relation to the protection of private patient information by ambulance services   PURPOSE OR GENERAL IDEA OF BILL: To prohibit the sale of patient-protected health information.   SUMMARY OF SPECIFIC PROVISIONS: Section 1. Defines "individual identifying information" as information identifying or tending to identify a patient. This section also defines "marketing." Marketing means, but is not limited to, advertising, detailing, marketing, promotion, or any activity that is intended to be or could be used to influence business volume, sales or market share or evaluate the effectiveness of marketing practices or personnel, regard- less of whether the beneficiary of the marketing is a governmental, for-profit, or not-for-profit entity. Section 2. Adds a new section 3006-a to the public health law to cover patient privacy. 3006-a provides that no ambulance service, advanced life support first response service, or employee, member or agent shall disclose, sell, transfer, exchange or use any individual identifying information to any person or entity for the purpose of marketing. However, within this section there are several exceptions. This informa- tion may be disclosed, sold, transferred or exchanged to: the patient who is the subject of the information, or a person authorized to make health care decisions; a health care provider or information system subject to the regulations of the department, for the purpose of provid- ing care or treatment; an officer, inspector, or investigator for a government health, licensing, or law enforcement agency acting under appropriate legal authority; a person authorized by court order; the patient's insurer for the purpose of payment or reimbursement; a person or entity to whom, and for a purpose for which, disclosure is explicitly authorized by law; a person acting as an agent of the person or entity under any preceding paragraph, for the purpose of and consistent with that paragraph; or, a government entity as provided by law. Additionally, the collection, use, transfer, or sale of patient data by zip code, geographic region, or medical specialty for marketing purposes is permitted, providing it does not contain individual identifying information. 3006-a permits not-for-profit or governmental ambulances and other life support first responders to use a patient's address in connection with fundraising for such services, as long as the use does not include disclosing the individual's identifying information. An individual may also disclose their own identifying information, as long as identifying information about another individual is not included. No person or entity to whom or which individual identifying information is sold or disclosed shall sell or disclose it to any person or entity other than for the lawful purpose for which it was disclosed or sold, and without satisfactory assurance that the recipient will safeguard the records from being disclosed or used for marketing purposes. The section also does not allow any disclosure, sale, transfer, or exchange of individual identifying information that is not otherwise authorized or required by law. In addition to the commissioner's authority to enforce this section under section 3012, the attorney general shall have the authority to bring an action to enforce compliance with this section without referral by the commissioner. Section 3. Contains the effective date.   JUSTIFICATION: According to a New York Post article in 2014, the FDNY issued a patient-privacy notice which disclosed that it may sell or use patient protected health information for fundraising and marketing purposes. While the FDNY has since changed its privacy policy, public health agen- cies, such as the FDNY and other emergency service providers, should not be able to legally sell patient protected health information (PHI). PHI refers to information such as the patient's address and phone number, prescriptions, and medical history. All emergency service providers hold this information on patients. Patients have an expectation and a right to the privacy in relation to their health records. As such, PHI should never be sold to pharmaceutical companies, insurers, nursing homes, and other businesses.   PRIOR LEGISLATIVE HISTORY: 2015: A.8226-A/S.6489-A - Referred to Codes. 2016: A.8226-A/S.6489-A - Passed Assembly. 2017: A.328-A/S.4372-A - Passed Assembly. 2018: A.328-A/S.4372-A - Passed Assembly. Similar to: 2013-2014: A.9313/S.7008 - Ordered to Third Reading. 2015-2016: A.659-A - Amended on Third Reading.   FISCAL IMPLICATIONS: None.   EFFECTIVE DATE: This act shall take effect on the one hundred eightieth day after it shall become a law; provided that, effective immediately, the commis- sioner of health may make regulations and take other actions reasonably necessary to implement this act on such date.
Go to top

A00230 Text:



 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                           230
 
                               2019-2020 Regular Sessions
 
                   IN ASSEMBLY
 
                                       (Prefiled)
 
                                     January 9, 2019
                                       ___________
 
        Introduced  by M. of A. BRAUNSTEIN, ABINANTI, ZEBROWSKI, COLTON, JAFFEE,
          STECK, WEPRIN -- Multi-Sponsored by -- M.  of  A.  CROUCH,  MONTESANO,
          O'DONNELL -- read once and referred to the Committee on Health
 
        AN  ACT to amend the public health law, in relation to the protection of
          private patient information by ambulance services
 
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
 
     1    Section  1.  The  public health law is amended by adding a new section
     2  3006-a to read as follows:
     3    § 3006-a. Patient privacy. 1. As used in this section:
     4    (a) "Individual identifying information" means information identifying
     5  or tending to identify a patient.
     6    (b) "Marketing" means advertising, detailing, marketing, promotion, or
     7  any other activity that is intended to be  used  to  influence  business
     8  volume, sales or market share or evaluate the effectiveness of marketing
     9  practices  or marketing personnel, regardless of whether the beneficiary
    10  of the marketing is a governmental, for-profit, or not-for-profit  enti-
    11  ty.
    12    2. No ambulance service, advanced life support first response service,
    13  or  employee,  member  or  agent thereof shall disclose, sell, transfer,
    14  exchange, provide or use any individual identifying information  to  any
    15  person or entity for the purpose of marketing.
    16    3.  Notwithstanding  subdivision  two  of this section, and subject to
    17  otherwise applicable law, individual identifying information may be:
    18    (a) disclosed, sold, transferred or exchanged to:
    19    (i) the patient who is the subject of the  information,  or  a  person
    20  authorized to make health care decisions for the patient;
    21    (ii)  a  health  care  provider  providing  care  or  treatment to the
    22  patient, for the purpose of such care or treatment; or a health informa-
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD02658-01-9

        A. 230                              2
 
     1  tion system subject to regulations of the department, for the purpose of
     2  such care or treatment;
     3    (iii)  an  officer, inspector or investigator for a government health,
     4  licensing or law  enforcement  agency  acting  under  appropriate  legal
     5  authority;
     6    (iv)  a  person  authorized  by a court order or a subpoena to receive
     7  such information;
     8    (v) the patient's health plan, insurer, or third party  payer,  or  an
     9  agent  thereof,  for  the purpose of payment or reimbursement for health
    10  care services, including determining compliance with the terms of cover-
    11  age or medical necessity, or utilization review;
    12    (vi) a person or entity to whom, and for a purpose for which,  disclo-
    13  sure or transfer is otherwise explicitly authorized or required by law;
    14    (vii) a person or entity, for the purpose of conducting quality assur-
    15  ance  or  evaluating  the  performance of an ambulance service, advanced
    16  life support first response service, or any employee,  member  or  agent
    17  thereof;
    18    (viii)  a  person or entity acting as an employee or agent of a person
    19  or entity under any preceding paragraph of  this  subdivision,  for  the
    20  purpose of and consistent with that paragraph; or
    21    (ix) a government entity as provided by law; and
    22    (b)  used  by  such  ambulance  service,  advanced  life support first
    23  responder service, or employee, member or agent thereof,  for  training,
    24  promotion,  staff  recognition  or recruitment purposes, consistent with
    25  applicable law, provided the patient or a qualified person as defined by
    26  paragraph (G) of subdivision one of section eighteen of this chapter has
    27  provided consent to such use in a separate, stand-alone  document.  Such
    28  consent  shall  be  limited  to  the particular type or types of use and
    29  specific transaction or transactions for which such consent is given.
    30    4. Nothing in this section shall prohibit the collection, use,  trans-
    31  fer,  or sale of patient data by zip code, geographic region, or medical
    32  specialty for marketing purposes, providing it does not contain individ-
    33  ual identifying information.
    34    5. This section shall not prevent a person from  disclosing,  selling,
    35  transferring,  or exchanging for value his or her own individual identi-
    36  fying information, for any purpose; provided that the  information  does
    37  not  include  individual identifying information pertaining to any other
    38  person.
    39    6. This section does not prohibit  a  not-for-profit  or  governmental
    40  ambulance  service  or  advanced life support first response service, or
    41  agent thereof, from using a patient's  name  and  address  in  order  to
    42  contact  such  patient  or a family member at such address with requests
    43  for donations to such service; providing that such use shall not include
    44  disclosing any individual identifying information.
    45    7. No person or entity to whom or which individual identifying  infor-
    46  mation  is  disclosed,  sold,  transferred  or exchanged shall disclose,
    47  sell, transfer or exchange it to any person or entity other than for the
    48  lawful  purpose  for  which  it  was  disclosed,  sold,  transferred  or
    49  exchanged  to  the  person or entity, and without satisfactory assurance
    50  that the recipient will safeguard the records from  being  disclosed  or
    51  used for marketing purposes.
    52    8.  This section does not authorize any disclosure, sale, transfer, or
    53  exchange of individual identifying information  that  is  not  otherwise
    54  authorized or required by law.
    55    9. In addition to the commissioner's authority to enforce this section
    56  under section three thousand twelve of this article, the attorney gener-

        A. 230                              3
 
     1  al  shall  have  the  authority to bring an action to enforce compliance
     2  with this section without referral by the commissioner.
     3    § 2. This act shall take effect on the one hundred eightieth day after
     4  it  shall  have  become a law; provided that, effective immediately, the
     5  commissioner of health may  make  regulations  and  take  other  actions
     6  reasonably necessary to implement this act on such date.
Go to top