(a) the protected individual or, when the protected individual lacks capacity to consent, a person authorized pursuant to law to consent to health care for the individual;

(b) any person to whom disclosure is authorized pursuant to a release of confidential HIV related information;

(c) an agent or employee of a health facility or health care provider if (1) the agent or employee is permitted to access medical records, (2) the health facility or health care provider itself is authorized to obtain the HIV related information, and (3) the agent or employee provides health care to the protected individual, or maintains or processes medical records for billing or reimbursement;

(d) a health care provider or health facility when knowledge of the HIV related information is necessary to provide appropriate care or treatment to the protected individual, a child of the individual, a contact of the protected individual or a person authorized to consent to health care for such a contact;

(e) a health facility or health care provider, in relation to the procurement, processing, distributing or use of a human body or a human body part, including organs, tissues, eyes, bones, arteries, blood, semen, or other body fluids, for use in medical education, research, therapy, or for transplantation to individuals;

(f) health facility staff committees or accreditation or oversight review organizations authorized to access medical records; provided that such committees or organizations may only disclose confidential HIV related information: (1) back to the facility or provider of a health or social service; (2) to carry out the monitoring, evaluation, or service review for which it was obtained; or (3) to a federal, state or local government agency for the purposes of and subject to the conditions provided in subdivision six of this section;

(g) a federal, state, county or local health officer when such disclosure is mandated by federal or state law;

(h) an authorized agency in connection with foster care or adoption of a child. Such agency shall be authorized to redisclose such information only pursuant to this article or in accordance with the provisions of subdivision eight of section three hundred seventy-two and section three hundred seventy-three-a of the social services law;

(i) third party reimbursers or their agents to the extent necessary to reimburse health care providers for health services; provided that, where necessary, an otherwise appropriate authorization for such disclosure has been secured by the provider;

(j) an insurance institution, for other than the purpose set forth in paragraph (i) of this subdivision, provided the insurance institution secures a dated and written authorization that indicates that health care providers, health facilities, insurance institutions, and other persons are authorized to disclose information about the protected individual, the nature of the information to be disclosed, the purposes for which the information is to be disclosed and which is signed by: (1) the protected individual; (2) if the protected individual lacks the capacity to consent, such other person authorized pursuant to law to consent for such individual; or (3) if the protected individual is deceased, the beneficiary or claimant for benefits under an insurance policy, a health services plan, or an employee welfare benefit plan as defined in 29 U.S.C. 1002(1), covering such protected individual;

(k) any person to whom disclosure is ordered by a court of competent jurisdiction pursuant to section twenty-seven hundred eighty-five of this article;

(l) an employee or agent of the department of corrections and community supervision, in accordance with paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, to the extent the employee or agent is authorized to access records containing such information in order to carry out the department's functions, powers and duties with respect to the protected individual, pursuant to section two hundred fifty-nine-a of the executive law;

(m) an employee or agent of the office of probation and correctional alternatives or any local probation department, in accordance with paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, to the extent the employee or agent is authorized to access records containing such information in order to carry out the office's or department's functions, powers and duties with respect to the protected individual, pursuant to articles twelve and twelve-A of the executive law;

(n) a medical director of a local correctional facility as defined in section forty of the correction law, in accordance with paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, to the extent the medical director is authorized to access records containing such information in order to carry out his or her functions, powers and duties with respect to the protected individual; or

(o) an employee or agent of the commission of correction, in accordance with paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, to the extent the employee or agent is authorized to access records containing such information in order to carry out the commission's functions, powers and duties with respect to the protected individual, pursuant to article three of the correction law.

(p) an attorney appointed to represent a minor pursuant to the social services law or the family court act, with respect to confidential HIV related information relating to the minor and for the purpose of representing the minor. If the minor has the capacity to consent, the minor's attorney may not redisclose confidential HIV related information without the minor's permission. If the minor lacks capacity to consent, the minor's attorney may redisclose confidential HIV related information for the sole purpose of representing the minor. This paragraph shall not limit the ability of the minor's attorney to seek relief under section twenty-seven hundred eighty-five of this chapter.

(q) an executor or an administrator of an estate shall have access to the confidential HIV information of a deceased person as needed to fulfill his or her responsibilities/duties as an executor or administrator.

(r) qualified researchers for medical research purposes upon the approval of a research protocol by a human research review committee established and approved under the provisions of article twenty-four-A of this chapter or by an institutional review board established and approved under the provisions of 45 CFR part 46 or 42 USC 300 V-1, for the purpose of reviewing and monitoring research involving human subjects, provided that in no event shall any qualified researcher disclose information tending to identify the subjects of the research. 2. A state, county or local health officer may disclose confidential HIV related information when:

(a) disclosure is specifically authorized or required by federal or state law; or

(b) disclosure is made pursuant to a release of confidential HIV related information; or

(c) disclosure is requested by a physician pursuant to subdivision four of this section; or

(d) disclosure is authorized by court order pursuant to the provisions of section twenty-seven hundred eighty-five of this article. 3. No person to whom confidential HIV related information has been disclosed pursuant to this article shall disclose the information to another person except as authorized by this article, provided, however, that the provisions of this subdivision shall not apply:

(a) to the protected individual; or

(b) to a natural person who is authorized pursuant to law to consent to health care for the protected individual; or

(c) to a protected individual's foster parent as defined in section three hundred seventy-one of the social services law and subject to regulations promulgated pursuant to paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, for the purpose of providing care, treatment or supervision of the protected individual; or

(d) a prospective adoptive parent as specified in section three hundred seventy-three-a of the social services law and subject to regulations promulgated pursuant to paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article with whom a child who is the protected individual has been placed for adoption; or

(e) to a relative or other person legally responsible to whom a child who is the protected individual is to be placed or discharged pursuant to section ten hundred seventeen or ten hundred fifty-five of the family court act and subject to regulations promulgated pursuant to paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article, for the purpose of providing care, treatment or supervision of the protected individual. 4. (a) A physician may disclose confidential HIV related information under the following conditions:

(1) disclosure is made to a contact, to a public health officer for the purpose of making the disclosure to said contact and pursuant to section twenty-one hundred thirty of this chapter; or

(2) the physician believes disclosure is medically appropriate and there is a significant risk of infection to the contact; and

(3) the physician has counseled the protected individual regarding the need to notify the contact; and

(4) the physician has informed the protected individual of his or her intent to make such disclosure to a contact, the physician's responsibility to report the infected individual's case pursuant to section twenty-one hundred thirty of this chapter and has given the protected individual the opportunity to express a preference as to whether disclosure should be made by the physician directly or to a public health officer for the purpose of said disclosure. If the protected individual expresses a preference for disclosure by a public health officer, the physician shall honor such preference.

(5) If a physician chooses to make a notification pursuant to this section, he or she shall report to the municipal health commissioner of district health officer on his or her efforts to notify the contacts of the protected individual. Such report shall be in a manner and on forms prescribed by the commissioner and shall include the identity of the protected individual and any contacts as well as information as to whether the contacts were successfully notified.

(6) Within a reasonable time of receiving a report that a physician or his or her designated agent did not notify or verify notification of contacts provided by the protected individual, the health commissioner or district health officer of the municipality from which the report originates shall take reasonable measures to notify such contacts and otherwise comply with the provisions of this chapter.

(b) When making such disclosures to the contact, the physician or public health officer shall provide or make referrals for the provision of the appropriate medical advice and counseling for coping with the emotional consequences of learning the information and for changing behavior to prevent transmission or contraction of HIV infection. The physician or public health officer shall not disclose the identity of the protected individual or the identity of any other contact. A physician or public health officer making a notification pursuant to this subdivision shall make such disclosure in person, except where circumstances reasonably prevent doing so.

(c) A physician or public health officer shall have no obligation to identify or locate any contact except as provided pursuant to title three of article twenty-one of this chapter.

(d) A physician may, upon the consent of a parent or guardian, disclose confidential HIV related information to a state, county, or local health officer for the purpose of reviewing the medical history of a child to determine the fitness of the child to attend school.

(e) A physician may disclose confidential HIV related information pertaining to a protected individual to a person (known to the physician) authorized pursuant to law to consent to health care for a protected individual when the physician reasonably believes that: (1) disclosure is medically necessary in order to provide timely care and treatment for the protected individual; and (2) after appropriate counseling as to the need for such disclosure, the protected individual will not inform a person authorized by law to consent to health care; provided, however, that the physician shall not make such disclosure if, in the judgment of the physician: (A) the disclosure would not be in the best interest of the protected individual; or (B) the protected individual is authorized pursuant to law to consent to such care and treatment. Any decision or action by a physician under this paragraph, and the basis therefor, shall be recorded in the protected individual's medical record. 5. (a) Whenever disclosure of confidential HIV related information is made pursuant to this article, except for disclosures made pursuant to paragraphs (a), (d) and (i) of subdivision one of this section or paragraph (a) or (e) of subdivision four of this section, such disclosure shall be accompanied or followed by a statement in writing which includes the following or substantially similar language: "This information has been disclosed to you from confidential records which are protected by state law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of state law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is NOT sufficient authorization for further disclosure." An oral disclosure shall be accompanied or followed by such a notice within ten days.

(b) Except for disclosures made pursuant to paragraph (c) of subdivision one of this section, or to persons reviewing information or records in the ordinary course of ensuring that a health facility is in compliance with applicable quality of care standards or any other authorized program evaluation, program monitoring or service review, or to governmental agents requiring information necessary for payments to be made on behalf of patients or clients pursuant to contract or in accordance to law, a notation of all such disclosures shall be placed in the medical record of a protected individual, who shall be informed of such disclosures upon request; provided, however, that for disclosures made to insurance institutions such a notation need only be entered at the time the disclosure is first made. 6. (a) The provisions of this subdivision shall apply where a provider of a health or social service possesses confidential HIV related information relating to individuals who are recipients of the service, and a federal, state or local government agency supervises or monitors the provider or administers the program under which the service is provided.

(b) Confidential HIV related information relating to a recipient of such service may be disclosed in accordance with regulations promulgated pursuant to paragraph (a) of subdivision two of section twenty-seven hundred eighty-six of this article to an authorized employee or agent of such provider or government agency, when reasonably necessary for such supervision, monitoring, administration, or provision of such service. The term "authorized employee or agent", as used in this subdivision shall only include any employee or agent who would, in the ordinary course of business of the provider or government agency, have access to records relating to the care of, treatment of, or provision of a health or social service to the protected individual. 7. Nothing in this section shall limit a person's or agency's responsibility or authority to report, investigate, or redisclose, child protective and adult protective services information in accordance with title six of article six and titles one and two of article nine-B of the social services law, or to provide or monitor the provision of child and adult protective or preventive services. 8. Confidential HIV related information shall be recorded in the medical record of the protected individual. The provisions of this section shall not prohibit the listing of acquired immune deficiency syndrome, HIV related illness or HIV infection in a certificate of death, autopsy report or related documents prepared pursuant to article forty-one of this chapter or other applicable laws, ordinances, rules or regulations relating to the documentation of cause of death, nor shall this section be construed to modify any laws, ordinances, rules or regulations relative to access to death certificates, autopsy reports or such other related documents. Under no circumstances shall confidential HIV related information be disclosable pursuant to article six of the public officers law. Notwithstanding the foregoing, confidential HIV information obtained pursuant to section 390.15 of the criminal procedure law or section 347.1 of the family court act by either court order or consent of the protected individual shall not be recorded in the medical record of the protected individual unless he or she consents to the recording of such information in a written statement containing the relevant information specified in subdivision two of section two thousand seven hundred eighty-one of this article. 9. Confidential HIV related information shall be disclosed upon the request of the health care worker HIV/HBV advisory panel, established pursuant to article twenty-seven-DD of this chapter, to the panel or its designee only when reasonably necessary for the evaluation of a worker who has voluntarily sought the panel's review.