N.Y. Comp. Codes R. & Regs. tit. 12 § 325-5.8
Misuse of confidential information; penalties. A health insurer and HIMP agent receiving information pursuant to subdivisions (d) and (h) of section 13 of the Workers' Compensation Law and this Subpart shall use such information solely for the purpose of seeking reimbursement from the employer, workers' compensation insurance carrier or special fund. Every agreement between a health insurer and a HIMP agent shall specify that the HIMP agent may be terminated by the Board for misuse of confidential information. Upon notification to the Chair that either a health insurer or a HIMP agent has used such information for purposes other than those stated above, an administrative hearing shall be held before an employee of the Board, designated by the Chair to conduct such hearings. The Chair, upon a finding that such information has been used by a health insurer or a HIMP agent for purposes other than that stated above, may, after such hearing, impose a penalty of not more than $10,000, and may prohibit such health insurer and HIMP agent from receiving information under subdivisions (d) and (h) of section 13 of the Workers' Compensation Law and this Subpart, for a period of up to three years. Additionally, a health insurer and HIMP agent receiving information pursuant to subdivision (h) of section 13 of the Workers' Compensation Law and this Subpart, shall comply with all applicable federal and state laws and regulations regarding the confidentiality of such information, including but not limited to section 110-a of the Workers' Compensation Law. In addition to any other available penalty or remedy at law, the Chair, upon a finding that such information has been used by a HIMP agent for purposes other than as stated above, may immediately terminate such individual or entity's status as a HIMP agent.
N.Y. Comp. Codes R. & Regs. Tit. 12 § 325-5.8