NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
 
BILL NUMBER: A230
SPONSOR: Braunstein (MS)
 
TITLE OF BILL:
An act to amend the public health law, in relation to the protection of
private patient information by ambulance services
 
PURPOSE OR GENERAL IDEA OF BILL:
To prohibit the sale of patient-protected health information.
 
SUMMARY OF SPECIFIC PROVISIONS:
Section 1. Defines "individual identifying information" as information
identifying or tending to identify a patient. This section also defines
"marketing." Marketing means, but is not limited to, advertising,
detailing, marketing, promotion, or any activity that is intended to be
or could be used to influence business volume, sales or market share or
evaluate the effectiveness of marketing practices or personnel, regard-
less of whether the beneficiary of the marketing is a governmental,
for-profit, or not-for-profit entity.
Section 2. Adds a new section 3006-a to the public health law to cover
patient privacy.
3006-a provides that no ambulance service, advanced life support first
response service, or employee, member or agent shall disclose, sell,
transfer, exchange or use any individual identifying information to any
person or entity for the purpose of marketing.
However, within this section there are several exceptions. This informa-
tion may be disclosed, sold, transferred or exchanged to: the patient
who is the subject of the information, or a person authorized to make
health care decisions; a health care provider or information system
subject to the regulations of the department, for the purpose of provid-
ing care or treatment; an officer, inspector, or investigator for a
government health, licensing, or law enforcement agency acting under
appropriate legal authority; a person authorized by court order; the
patient's insurer for the purpose of payment or reimbursement; a person
or entity to whom, and for a purpose for which, disclosure is explicitly
authorized by law; a person acting as an agent of the person or entity
under any preceding paragraph, for the purpose of and consistent with
that paragraph; or, a government entity as provided by law.
Additionally, the collection, use, transfer, or sale of patient data by
zip code, geographic region, or medical specialty for marketing purposes
is permitted, providing it does not contain individual identifying
information.
3006-a permits not-for-profit or governmental ambulances and other life
support first responders to use a patient's address in connection with
fundraising for such services, as long as the use does not include
disclosing the individual's identifying information. An individual may
also disclose their own identifying information, as long as identifying
information about another individual is not included.
No person or entity to whom or which individual identifying information
is sold or disclosed shall sell or disclose it to any person or entity
other than for the lawful purpose for which it was disclosed or sold,
and without satisfactory assurance that the recipient will safeguard the
records from being disclosed or used for marketing purposes.
The section also does not allow any disclosure, sale, transfer, or
exchange of individual identifying information that is not otherwise
authorized or required by law.
In addition to the commissioner's authority to enforce this section
under section 3012, the attorney general shall have the authority to
bring an action to enforce compliance with this section without referral
by the commissioner.
Section 3. Contains the effective date.
 
JUSTIFICATION:
According to a New York Post article in 2014, the FDNY issued a
patient-privacy notice which disclosed that it may sell or use patient
protected health information for fundraising and marketing purposes.
While the FDNY has since changed its privacy policy, public health agen-
cies, such as the FDNY and other emergency service providers, should not
be able to legally sell patient protected health information (PHI). PHI
refers to information such as the patient's address and phone number,
prescriptions, and medical history. All emergency service providers hold
this information on patients. Patients have an expectation and a right
to the privacy in relation to their health records. As such, PHI should
never be sold to pharmaceutical companies, insurers, nursing homes, and
other businesses.
 
PRIOR LEGISLATIVE HISTORY:
2015: A.8226-A/S.6489-A - Referred to Codes.
2016: A.8226-A/S.6489-A - Passed Assembly.
2017: A.328-A/S.4372-A - Passed Assembly.
2018: A.328-A/S.4372-A - Passed Assembly. Similar to:
2013-2014: A.9313/S.7008 - Ordered to Third Reading.
2015-2016: A.659-A - Amended on Third Reading.
 
FISCAL IMPLICATIONS:
None.
 
EFFECTIVE DATE:
This act shall take effect on the one hundred eightieth day after it
shall become a law; provided that, effective immediately, the commis-
sioner of health may make regulations and take other actions reasonably
necessary to implement this act on such date.
STATE OF NEW YORK
________________________________________________________________________
230
2019-2020 Regular Sessions
IN ASSEMBLY(Prefiled)
January 9, 2019
___________
Introduced by M. of A. BRAUNSTEIN, ABINANTI, ZEBROWSKI, COLTON, JAFFEE,
STECK, WEPRIN -- Multi-Sponsored by -- M. of A. CROUCH, MONTESANO,
O'DONNELL -- read once and referred to the Committee on Health
AN ACT to amend the public health law, in relation to the protection of
private patient information by ambulance services
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The public health law is amended by adding a new section
2 3006-a to read as follows:
3 § 3006-a. Patient privacy. 1. As used in this section:
4 (a) "Individual identifying information" means information identifying
5 or tending to identify a patient.
6 (b) "Marketing" means advertising, detailing, marketing, promotion, or
7 any other activity that is intended to be used to influence business
8 volume, sales or market share or evaluate the effectiveness of marketing
9 practices or marketing personnel, regardless of whether the beneficiary
10 of the marketing is a governmental, for-profit, or not-for-profit enti-
11 ty.
12 2. No ambulance service, advanced life support first response service,
13 or employee, member or agent thereof shall disclose, sell, transfer,
14 exchange, provide or use any individual identifying information to any
15 person or entity for the purpose of marketing.
16 3. Notwithstanding subdivision two of this section, and subject to
17 otherwise applicable law, individual identifying information may be:
18 (a) disclosed, sold, transferred or exchanged to:
19 (i) the patient who is the subject of the information, or a person
20 authorized to make health care decisions for the patient;
21 (ii) a health care provider providing care or treatment to the
22 patient, for the purpose of such care or treatment; or a health informa-
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD02658-01-9
A. 230 2
1 tion system subject to regulations of the department, for the purpose of
2 such care or treatment;
3 (iii) an officer, inspector or investigator for a government health,
4 licensing or law enforcement agency acting under appropriate legal
5 authority;
6 (iv) a person authorized by a court order or a subpoena to receive
7 such information;
8 (v) the patient's health plan, insurer, or third party payer, or an
9 agent thereof, for the purpose of payment or reimbursement for health
10 care services, including determining compliance with the terms of cover-
11 age or medical necessity, or utilization review;
12 (vi) a person or entity to whom, and for a purpose for which, disclo-
13 sure or transfer is otherwise explicitly authorized or required by law;
14 (vii) a person or entity, for the purpose of conducting quality assur-
15 ance or evaluating the performance of an ambulance service, advanced
16 life support first response service, or any employee, member or agent
17 thereof;
18 (viii) a person or entity acting as an employee or agent of a person
19 or entity under any preceding paragraph of this subdivision, for the
20 purpose of and consistent with that paragraph; or
21 (ix) a government entity as provided by law; and
22 (b) used by such ambulance service, advanced life support first
23 responder service, or employee, member or agent thereof, for training,
24 promotion, staff recognition or recruitment purposes, consistent with
25 applicable law, provided the patient or a qualified person as defined by
26 paragraph (G) of subdivision one of section eighteen of this chapter has
27 provided consent to such use in a separate, stand-alone document. Such
28 consent shall be limited to the particular type or types of use and
29 specific transaction or transactions for which such consent is given.
30 4. Nothing in this section shall prohibit the collection, use, trans-
31 fer, or sale of patient data by zip code, geographic region, or medical
32 specialty for marketing purposes, providing it does not contain individ-
33 ual identifying information.
34 5. This section shall not prevent a person from disclosing, selling,
35 transferring, or exchanging for value his or her own individual identi-
36 fying information, for any purpose; provided that the information does
37 not include individual identifying information pertaining to any other
38 person.
39 6. This section does not prohibit a not-for-profit or governmental
40 ambulance service or advanced life support first response service, or
41 agent thereof, from using a patient's name and address in order to
42 contact such patient or a family member at such address with requests
43 for donations to such service; providing that such use shall not include
44 disclosing any individual identifying information.
45 7. No person or entity to whom or which individual identifying infor-
46 mation is disclosed, sold, transferred or exchanged shall disclose,
47 sell, transfer or exchange it to any person or entity other than for the
48 lawful purpose for which it was disclosed, sold, transferred or
49 exchanged to the person or entity, and without satisfactory assurance
50 that the recipient will safeguard the records from being disclosed or
51 used for marketing purposes.
52 8. This section does not authorize any disclosure, sale, transfer, or
53 exchange of individual identifying information that is not otherwise
54 authorized or required by law.
55 9. In addition to the commissioner's authority to enforce this section
56 under section three thousand twelve of this article, the attorney gener-
A. 230 3
1 al shall have the authority to bring an action to enforce compliance
2 with this section without referral by the commissioner.
3 § 2. This act shall take effect on the one hundred eightieth day after
4 it shall have become a law; provided that, effective immediately, the
5 commissioner of health may make regulations and take other actions
6 reasonably necessary to implement this act on such date.