Section 18 - [Multiple versions] Access to patient information1. Definitions. For the purpose of this section: (a) "Committee" means a medical access review committee appointed pursuant to subdivision four of this section.(b) "Health care provider" or "provider" means a "health care facility" or a "health care practitioner" as defined by this subdivision.(c) "Health care facility" or "facility" means a hospital as defined in article twenty-eight of this chapter, a home care services agency as defined in article thirty-six of this chapter, a hospice as defined in article forty of this chapter, a health maintenance organization as defined in article forty-four of this chapter, and a shared health facility as defined in article forty-seven of this chapter.(d) "Health care practitioner" or "practitioner" means a person licensed under article one hundred thirty-one, one hundred thirty-one-B, one hundred thirty-two, one hundred thirty-three, one hundred thirty-six, one hundred thirty-nine, one hundred forty-one, one hundred forty-three, one hundred forty-four, one hundred fifty-three, one hundred fifty-four, one hundred fifty-six or one hundred fifty-nine of the education law or a person certified under section twenty-five hundred sixty of this chapter.(e) "Patient information" or "information" means any information concerning or relating to the examination, health assessment including, but not limited to, a health assessment for insurance and employment purposes or treatment of an identifiable subject maintained or possessed by a health care facility or health care practitioner who has provided or is providing services for assessment of a health condition including, but not limited to, a health assessment for insurance and employment purposes or has treated or is treating such subject, except (i) information and clinical records subject to the provisions of section 23.05 or 33.13 of the mental hygiene law, (ii) personal notes and observations of a health care practitioner, provided that such personal notes and observations are maintained by the practitioner and not disclosed by the practitioner to any other person after January first, nineteen hundred eighty-seven, (iii) information maintained by a practitioner, concerning or relating to the prior examination or treatment of a subject received from another practitioner, provided however, that such information may be requested by the subject directly from such other practitioner in accordance with the provisions of this section, and (iv) data disclosed to a practitioner in confidence by other persons on the basis of an express condition that such data would never be disclosed to the subject or other persons, provided that such data has never been disclosed to any other person. If at any time such personal notes and observations or such data is disclosed, it shall be considered patient information for purposes of this section. For purposes of this subdivision, "disclosure to any other person" shall not include disclosures made to practitioners as part of a consultation or referral during the treatment of the subject, to persons reviewing information or records in the ordinary course of ensuring that a provider is in compliance with applicable quality of care, licensure or accreditation standards, to an employee or official of a federal, state or local agency for the sole purpose of conducting an audit in the course of his or her official duties, to the statewide planning and research cooperative system, to other persons pursuant to a court order, to governmental agencies, insurance companies licensed pursuant to the insurance law and other third parties requiring information necessary for payments to be made to or on behalf of patients, to qualified researchers, to the state board for professional medical conduct when such board requests such information in the exercise of its statutory function, to an insurance carrier insuring, or an attorney consulted by, a health care provider, or to a health maintenance organization certified pursuant to article forty-four of this chapter or licensed pursuant to the insurance law, or to the committee or a court pursuant to the provisions of this section. For purposes of this subdivision treatment of a subject shall not include diagnostic services, except mammography, performed by a practitioner at the request of another health care practitioner provided, however, that such information, and mammograms, may be requested by the subject directly from the practitioner at whose request such diagnostic services were performed, in accordance with the provisions of this section.
(f) "Personal notes and observations" means a practitioner's speculations, impressions (other than tentative or actual diagnosis) and reminders, provided such data is maintained by a practitioner.(g) "Qualified person" means any properly identified subject; or a guardian appointed under article eighty-one of the mental hygiene law; or a parent of an infant; or a guardian of an infant appointed under article seventeen of the surrogate's court procedure act or other legally appointed guardian of an infant who may be entitled to request access to a clinical record under paragraph (c) of subdivision two of this section; or a distributee of any deceased subject for whom no personal representative, as defined in the estates, powers and trusts law, has been appointed; or an attorney representing a qualified person or the subject's estate who holds a power of attorney from the qualified person or the subject's estate explicitly authorizing the holder to execute a written request for patient information under this section. A qualified person shall be deemed a "personal representative of the individual" for purposes of the federal health insurance portability and accountability act of 1996 and its implementing regulations.(h) "Subject" means an individual concerning whom patient information is maintained or possessed by a health care provider.(i) "Treating practitioner" means the health care practitioner who has primary responsibility for the care of the subject within the health care facility or if such practitioner is unavailable, a practitioner designated by such facility.(j) "Cease to do business in this state" shall mean any case where a health care provider who has engaged in an on-going practice or business within this state as a health care provider, ceases to engage in such business, provided however, that this term shall not include a health care practitioner whose practice is merged, consolidated, combined, or acquired by another health care provider and he or she continues to provide services including medical care, diagnosis or treatment to patients as an employee, contractor, or owner of the merged, consolidated, combined, or acquired health care provider.2. Access by qualified persons. (a) Subject to the provisions of subdivision three of this section, upon the written request of any subject, a health care provider shall provide an opportunity, within ten days, for such subject to inspect any patient information concerning or relating to the examination or treatment of such subject in the possession of such health care provider.(b) Subject to the provisions of subdivision three of this section, upon the written request of the committee for an incompetent appointed pursuant to article seventy-eight of the mental hygiene law, a health care provider shall provide an opportunity, within ten days, for the inspection by such committee of any patient information concerning the incompetent subject in the possession of such health care provider.(c) Subject to the provisions of subdivision three of this section and except as otherwise provided by law, upon the written request of a parent or guardian of an infant appointed pursuant to article seventeen of the surrogate's court procedure act, or any other legally appointed guardian, a health care provider shall provide an opportunity, within ten days, for such parent or guardian to inspect any patient information maintained or possessed by such provider concerning care and treatment of the infant for which the consent of such parent or guardian was obtained or where care was provided without consent in an emergency which was the result of accidental injury or the unexpected onset of serious illness; provided, however, that such parent or guardian shall not be entitled to inspect or make copies of any patient information concerning the care and treatment of an infant where the health care provider determines that access to the information requested by such parent or guardian would have a detrimental effect on the provider's professional relationship with the infant, or on the care and treatment of the infant, or on the infant's relationship with his or her parents or guardian.(d) Subject to the provisions of subdivision three of this section, upon the written request of any qualified person, a health care provider shall furnish to such person, within a reasonable time, a copy of any patient information requested, and original mammograms requested, which the person is authorized to inspect pursuant to this subdivision. A qualified person may request a physical copy of any patient information requested pursuant to this section.(e) The provider may impose a reasonable charge for all inspections and copies, not exceeding the costs incurred by such provider, provided, however, that a provider may not impose a charge for copying an original mammogram when the original has been furnished to any qualified person and provided, further, that any charge for furnishing an original mammogram pursuant to this section shall not exceed the documented costs associated therewith. However, the reasonable charge for paper copies shall not exceed seventy-five cents per page. A qualified person shall not be denied access to patient information solely because of inability to pay. No charge may be imposed under this section for providing, releasing, or delivering patient information or copies of patient information where requested for the purpose of supporting an application, claim or appeal for any government benefit or program, provided that, where a provider maintains patient information in electronic form, it shall provide the copy in either electronic or paper form, as required by the government benefit or program, or at the patient's request.(f) A provider may place reasonable limitations on the time, place, and frequency of any inspections of patient information.(g) In the event that a practitioner does not have space available to permit the inspection of patient information, the practitioner may, in the alternative, furnish a qualified person a copy of such information within ten days.(h) A provider may request the opportunity to review the patient information with the qualified person requesting such information, but such review shall not be a prerequisite for furnishing the information.(i) A provider may make available for inspection either the original or a copy of patient information.3. Limitations on access. (a) Upon receipt of a written request by a qualified person to inspect or copy patient information, a practitioner may review the information requested. Unless the practitioner determines pursuant to paragraph (d) of this subdivision that (i) the requested review of the information can reasonably be expected to cause substantial and identifiable harm to the subject or others which would outweigh the qualified person's right to access to the information, or (ii) the material requested is personal notes and observations, or the information requested would have a detrimental effect as defined in subdivision two of this section, review of such patient information shall be permitted or copies provided.(b) Upon receipt of a written request by a qualified person to inspect patient information maintained by a facility, the facility shall inform the treating practitioner of the request. The treating practitioner may review the information requested. Unless the treating practitioner determines, pursuant to paragraph (d) of this subdivision that the requested review of the information can reasonably be expected to cause substantial and identifiable harm to the subject or others which would outweigh the qualified person's right of access to the information or would have a detrimental effect as defined in subdivision two of this section, review of such patient information shall be permitted or copies provided.(c) A subject over the age of twelve years may be notified of any request by a qualified person to review his/her patient information, and, if the subject objects to disclosure, the provider may deny the request. In the case of a facility, the treating practitioner shall be consulted.(d) The provider may deny access to all or a part of the information and may grant access to a prepared summary of the information if, after consideration of all the attendant facts and circumstances, the provider determines that (i) the request to review all or a part of the patient information can reasonably be expected to cause substantial and identifiable harm to the subject or others which would outweigh the qualified person's right of access to the information, or would have a detrimental effect as defined in subdivision two of this section, or (ii) the material requested is personal notes and observations. In conducting such review, the provider may consider, among other things, the following factors: (i) the need for, and the fact of, continuing care and treatment;(ii) the extent to which the knowledge of the information may be harmful to the health or safety of the subject or others; (iii)(the extent to which the information contains sensitive material disclosed in confidence to the practitioner or treating practitioner by family members, friends and other persons; (iv) the extent to which the information contains sensitive materials disclosed to the practitioner or the treating practitioner by the subject which would be injurious to the subject's relationships with other persons, except when the subject is requesting information concerning himself or herself; and(v) in the case of a minor making a request for access pursuant to subdivision two of this section, the age of the subject.(e) In the event of a denial of access, the qualified person shall be informed by the provider of such denial, and whether the denial is based on the reasonable expectation that release of the information can reasonably be expected to cause substantial and identifiable harm to the subject or others which outweighs the qualified person's right of access to the information or on the reasonable expectation that release of the information would have a detrimental effect as defined in subdivision two of this section, or on the basis that the materials sought to be reviewed constitute personal notes and observations, and of the qualified person's right to obtain, without cost, a review of the denial by the appropriate medical record access review committee. If the qualified person requests such review, the provider shall, within ten days of receipt of such request, transmit the information including personal notes and observations as defined herein, to the chairman of the appropriate committee with a statement setting forth the specific reasons for which access was denied. After an in camera review of the materials provided and after providing all parties a reasonable opportunity to be heard, the committee shall promptly make a written determination whether the requested review of the information can reasonably be expected to cause substantial and identifiable harm to the subject or others which outweighs the qualified person's right of access to the information pursuant to paragraph (d) of this subdivision or whether the requested review would have a detrimental effect as defined in subdivision two of this section, or whether all or part of the materials sought to be reviewed constitute personal notes and observations, and shall accordingly determine whether access to all or part of such materials shall be granted. In the event that the committee determines that the request for access shall be granted in whole or in part, the committee shall notify all parties and the provider shall grant access pursuant to such determination.(f) In the event that access is denied in whole or in part because the requested review of information can reasonably be expected to cause substantial and identifiable harm to the subject or others which would outweigh the qualified person's right of access to the information, or would have a detrimental effect as defined in subdivision two of this section, the committee shall notify the qualified person of his or her right to seek judicial review of the provider's determination pursuant to this section: provided however, that a determination by the committee as to whether materials sought to be reviewed constitute personal notes and observations shall not be the subject of judicial review. Within thirty days of receiving notification of such decision, the qualified person may commence, upon notice, a special proceeding in supreme court for a judgment requiring the provider to make available the information for inspection or copying. The court upon such application and after an in camera review of the materials provided including the determination and record of the committee, and after providing all parties an opportunity to be heard, shall determine whether there exists a reasonable basis for the denial of access. The relief available pursuant to this section shall be limited to a judgement requiring the provider to make available to the qualified person the requested information for inspection or copying.(g) Where the written request for patient information under this section is signed by a distributee of a deceased subject for whom a personal representative has not been appointed, or from the holder of a power of attorney from such a distributee, a copy of a certified copy of the certificate of death of the subject shall be attached to the written request.(h) Where the written request for patient information under this section is signed by the holder of a power of attorney, a copy of the power of attorney shall be attached to the written request. A written request under this subdivision shall be subject to the duration and terms of the power of attorney.(i) The release of patient information shall be subject to: (i) article twenty-seven-F of this chapter in the case of confidential HIV-related information; (ii) section seventeen of this article and sections twenty-three hundred one, twenty-three hundred six and twenty-three hundred eight of this chapter in the case of termination of a pregnancy and treatment for a sexually transmitted disease; (iii) article thirty-three of the mental hygiene law; and (iv) any other provisions of law creating special requirements relating to the release of patient information, including the federal health insurance portability and accountability act of 1996 and its implementing regulations.4. Medical record access review committees. The commissioner shall designate medical record access review committees to hear appeals of the denial of access to patient information as provided in paragraph (e) of subdivision three of this section. The commissioner shall promulgate rules and regulations necessary to effectuate the provisions of this subdivision.5. Annual report. The commissioner shall submit an annual report on or before December thirty-first to the governor and the legislature. Such report shall include, but not be limited to, the number of requests for committee review of providers' denial of access and the committees' determinations thereon.6. Disclosure to third persons. Whenever a health care provider, as otherwise authorized by law, discloses patient information to a person or entity other than the subject of such information or to other qualified persons, either a copy of the subject's written authorization shall be added to the patient information or the name and address of such third party and a notation of the purpose for the disclosure shall be indicated in the file or record of such subject's patient information maintained by the provider provided, however, that for disclosures made to government agencies making payments on behalf of patients or to insurance companies licensed pursuant to the insurance law such a notation shall only be entered at the time the disclosure is first made. This subdivision shall not apply to disclosure to practitioners or other personnel employed by or under contract with the facility, or to government agencies for purposes of facility inspections or professional conduct investigations. Any disclosure made pursuant to this section shall be limited to that information necessary in light of the reason for disclosure. Information so disclosed should be kept confidential by the party receiving such information and the limitations on such disclosure in this section shall apply to such party.7. Applicability of federal law. Whenever federal law or applicable federal regulations affecting the release of patient information are a condition for the receipt of federal aid, and are inconsistent with the provisions of this section, the provisions of federal law or federal regulations shall be controlling.8. Challenges to accuracy. A qualified person may challenge the accuracy of information maintained in the patient information and may require that a brief written statement prepared by him or her concerning the challenged information be inserted into the patient information. This statement shall become a permanent part of the patient information and shall be released whenever the information at issue is released. This subdivision shall apply only to factual statements and shall not include a provider's observations, inferences or conclusions. A facility may place reasonable restrictions on the time and frequency of any challenges to accuracy.
9. Waivers void. Any agreement by an individual to waive any right to inspect, copy or seek correction of patient information as provided for in this section shall be deemed to be void as against public policy and wholly unenforceable.10. Nothing contained in this section shall restrict, expand or in any way limit the disclosure of any information pursuant to articles twenty-three, thirty-one and forty-five of the civil practice law and rules or section six hundred seventy-seven of the county law.11. No proceeding shall be brought or penalty assessed, except as provided for in this section, against a health care provider, who in good faith, denies access to patient information.12. Immunity from liability. No health care provider shall be subjected to civil liability arising solely from granting or providing access to any patient information in accordance with this section.13.(a) A health care provider which has in its possession patient information and/or patient medical records and which has determined to permanently cease to do business or practice in this state shall, at least thirty days prior to such action, make a good faith effort to notify each of the health care provider's current patients that the office will be closing and to inform each such patient of his or her right to request that his or her patient information and/or patient medical records be sent to a health care provider, health care facility or health care practitioner of the patient's choosing or, alternatively, that such information and records be returned to the patient.(b) The provisions of this subdivision shall not affect any rights afforded pursuant to section seventeen of this title.(c) Nothing in this subdivision shall affect the period of time that a health care provider is lawfully required to retain a patient's medical information and medical records.(d) The provisions of this subdivision shall only apply with respect to a patient whose chart includes written permission to receive the notification described in paragraph (a) of this subdivision.N.Y. Pub. Health Law § 18
Amended by New York Laws 2024, ch. 347,Sec. 1, eff. 9/27/2024.Amended by New York Laws 2019, ch. 426,Secs. 1, 2 eff. 10/29/2019.Amended by New York Laws 2017, ch. 322,Sec. 2, eff. 9/13/2017.