A New York State bill (S.8450C/A.10500C), which aims to safeguard the confidentiality of COVID-19 contact tracing information, passed in the State Senate on July 23, 2020, and will soon be transmitted to Governor Andrew Cuomo for his signature or veto.
The bill, which passed in the State Assembly two days earlier, would amend New York’s public health law to require COVID-19 contact tracers and contact tracing entities keep confidential any information that includes or can reveal the identity of: (i) an individual with a confirmed or probable COVID-19 diagnosis; or (ii) his or her possible contacts who may or may not have been exposed to or infected with COVID-19. Under the bill, contact tracers may only disclose the protected information to facilitate further contact tracing or in other limited circumstances, such as disclosures to health care providers if an individual is in immediate need of medical attention and obtaining consent to the disclosure would jeopardize his or her life or health.
In addition, the bill:
- Establishes the required format and contents of a valid confidentiality waiver. Confidentiality waivers pertaining to contact tracing information must be written, informed and voluntary, in language understandable to the individual making the waiver, and must state the scope and limit of the waiver. Waivers must not be part of any other document.
- Specifies that the possession, use, and disclosure of de-identified, aggregate contact tracing information is permissible if certain conditions are met. Namely, the covered person or entity must maintain technical safeguards, policies and procedures that prevent re-identification, and must obtain the New York State Health Commissioner’s (or New York City Commissioner of Health and Mental Hygiene’s) approval to the disclosure, possession and/or use, upon a showing of its purpose, nature, and scope.
- Prohibits a law enforcement agent, law enforcement entity, or immigration authority from serving as a contact tracer or contact tracing entity.
- Prohibits a contact tracer or contact tracing entity from providing contact tracing information to a law enforcement agent, law enforcement entity, or immigration authority. Further, contact tracing information and any evidence derived therefrom may not be subject to or provided in response to any legal process, or be admissible in a judicial or administrative action, without the individual’s consent.
- Requires the New York State Health Commissioner or New York City Commissioner of Health and Mental Hygiene to promulgate regulations under the law. Most significantly, the regulations must include a provision requiring non-governmental contact tracers or contract-tracing entities to, within 30 days of collecting contact tracing information: (i) remove information from its possession or control and deliver it to the appropriate governmental contact tracing entity; (ii) expunge the information from its possession or control; or (iii) de-identify the information. Expungement or de-identification of specific contact tracing information may be postponed for up to 15 days if it is actively being used in contact tracing, provided that the individual provides voluntary informed consent.
When the bill is formally transmitted to Governor Cuomo, he will have ten days (not including Sundays) to sign or veto. If enacted, the law will become effective immediately upon signature. Our team will continue to monitor the bill’s progress and report on significant developments.