LBD01741-06-6
S. 9269 2
(C) CONTRACTUALLY OBLIGATES ANY RECIPIENT OF THE DEIDENTIFIED INFORMA-
TION TO COMPLY WITH ALL REQUIREMENTS OF THIS SECTION; AND
(D) ANY DEIDENTIFIED INFORMATION NOT OTHERWISE EXEMPT UNDER THIS ARTI-
CLE, ONCE SUBSEQUENTLY REIDENTIFIED SHALL NOT BE CONSIDERED DEIDENTI-
FIED.
2. "REGULATED HEALTH INFORMATION" MEANS ANY INFORMATION THAT:
(A) IS REASONABLY LINKABLE, DIRECTLY OR INDIRECTLY, TO ONE OR MORE
IDENTIFIED OR IDENTIFIABLE INDIVIDUALS, INCLUDING BY FOR EXAMPLE AND
WITHOUT LIMITATION, ANY DATA ASSOCIATED WITH A PERSISTENT UNIQUE IDENTI-
FIER, SUCH AS A COOKIE ID, AN IP ADDRESS, A DEVICE IDENTIFIER OR ANY
OTHER FORM OF PERSISTENT UNIQUE IDENTIFIER; AND
(B) IS COLLECTED OR PROCESSED IN CONNECTION WITH AN IDENTIFIED OR
IDENTIFIABLE INDIVIDUAL'S PAST, PRESENT, OR FUTURE PHYSICAL OR MENTAL
HEALTH STATUS. SUCH STATUS INCLUDES BUT IS NOT LIMITED TO:
(I) INDIVIDUAL HEALTH CONDITIONS, TREATMENTS, DISEASES, OR DIAGNOSES;
(II) SOCIAL, PSYCHOLOGICAL, BEHAVIORAL, AND MEDICAL INTERVENTIONS;
(III) SURGERIES OR MEDICAL PROCEDURES;
(IV) USE OR PURCHASE OF MEDICATION;
(V) BODILY FUNCTIONS, VITAL SIGNS, SYMPTOMS, OR MEASUREMENTS OF THE
INFORMATION;
(VI) DIAGNOSES OR DIAGNOSTIC TESTING, TREATMENT, OR MEDICATION;
(VII) GENDER-AFFIRMING CARE INFORMATION;
(VIII) REPRODUCTIVE OR SEXUAL HEALTH INFORMATION;
(IX) BIOMETRIC DATA;
(X) GENETIC DATA;
(XI) PRECISE LOCATION INFORMATION THAT COULD REASONABLY INDICATE AN
INDIVIDUAL'S ATTEMPT TO ACQUIRE OR RECEIVE HEALTH SERVICES OR SUPPLIES;
(XII) DATA THAT IDENTIFIES AN INDIVIDUAL SEEKING HEALTH CARE SERVICES;
AND
(XIII) ANY INFORMATION THAT A REGULATED ENTITY OR THEIR PROCESSOR,
PROCESSES TO ASSOCIATE OR IDENTIFY AN INDIVIDUAL WITH A PHYSICAL OR
MENTAL HEALTH STATUS, THAT IS DERIVED OR EXTRAPOLATED FROM NONHEALTH
INFORMATION (SUCH AS PROXY, DERIVATIVE, INFERRED, OR EMERGENT DATA BY
ANY MEANS, INCLUDING ALGORITHMS OR MACHINE LEARNING).
REGULATED HEALTH INFORMATION SHALL NOT INCLUDE DEIDENTIFIED INFORMA-
TION.
3. "PROCESS" OR "PROCESSING" MEANS AN OPERATION OR SET OF OPERATIONS
PERFORMED ON REGULATED HEALTH INFORMATION, INCLUDING BUT NOT LIMITED TO
THE COLLECTION, USE, ACCESS, SHARING, SALE, MONETIZATION, ANALYSIS,
RETENTION, CREATION, GENERATION, DERIVATION, RECORDING, ORGANIZATION,
STRUCTURING, STORAGE, DISCLOSURE, TRANSMISSION, LICENSING, OR MODIFICA-
TION OF REGULATED HEALTH INFORMATION.
4. "REGULATED ENTITY" MEANS ANY ENTITY THAT CONTROLS THE PROCESSING OF
REGULATED HEALTH INFORMATION OF AN INDIVIDUAL (A) WHO IS A NEW YORK
RESIDENT OR (B) IS PHYSICALLY PRESENT IN NEW YORK WHILE THAT INDIVIDUAL
IS IN NEW YORK OR (C) IS SEEKING OR RECEIVING SERVICES IN NEW YORK IF
THE ENTITY IS LOCATED IN NEW YORK.
5. "SELL" MEANS TO SHARE REGULATED HEALTH INFORMATION FOR MONETARY OR
OTHER VALUABLE CONSIDERATION. SELLING DOES NOT INCLUDE THE SHARING OF
REGULATED HEALTH INFORMATION FOR MONETARY OR OTHER VALUABLE CONSIDER-
ATION TO A THIRD PARTY AS AN ASSET THAT IS PART OF A MERGER, ACQUISI-
TION, BANKRUPTCY, OR OTHER TRANSACTION IN WHICH THE THIRD PARTY ASSUMES
CONTROL OF ALL OR PART OF THE REGULATED ENTITY'S ASSETS.
6. "SERVICE PROVIDER" MEANS ANY PERSON OR ENTITY THAT PROCESSES REGU-
LATED HEALTH INFORMATION ON BEHALF OF A REGULATED ENTITY. A SERVICE
S. 9269 3
PROVIDER MAY ALSO BE A REGULATED ENTITY DEPENDING UPON THE CONTEXT IN
WHICH REGULATED HEALTH INFORMATION IS PROCESSED.
7. "THIRD PARTY" MEANS A PERSON OR ENTITY OTHER THAN THE INDIVIDUAL,
REGULATED ENTITY, OR SERVICE PROVIDER INVOLVED IN A TRANSACTION OR
OCCURRENCE THAT INVOLVES REGULATED HEALTH INFORMATION. A THIRD PARTY MAY
ALSO BE A REGULATED ENTITY OR SERVICE PROVIDER DEPENDING UPON THE
CONTEXT IN WHICH REGULATED HEALTH INFORMATION IS PROCESSED.
8. "INDIVIDUAL" MEANS A NATURAL PERSON ACTING IN AN INDIVIDUAL OR
HOUSEHOLD CONTEXT.
9. "VERIFIABLE" MEANS TO USE REASONABLE MEANS TO DETERMINE THAT A
REQUEST TO EXERCISE ANY OF THE RIGHTS AFFORDED IN THIS ACT IS BEING MADE
BY, OR ON BEHALF OF, THE INDIVIDUAL WHO IS ENTITLED TO EXERCISE SUCH
RIGHTS WITH RESPECT TO THE REGULATED HEALTH INFORMATION AT ISSUE;
PROVIDED THAT ANY ADDITIONAL PERSONAL INFORMATION A REGULATED ENTITY
REQUESTS FOR THE PURPOSE OF VERIFICATION MUST BE STRICTLY NECESSARY FOR
THE PURPOSE OF CONFIRMING THE IDENTITY OF SUCH INDIVIDUAL AND SHALL NOT
BE PROCESSED OR USED FOR ANY PURPOSE OTHER THAN VERIFYING THE IDENTITY
OF THE INDIVIDUAL AND SHALL BE DELETED IMMEDIATELY UPON VERIFICATION OR
FAILURE TO VERIFY THE INDIVIDUAL. SUCH VERIFICATION SHALL NOT EXTEND THE
MAXIMUM ALLOWABLE TIME WITHIN WHICH THE REGULATED ENTITY MAY SATISFY A
REQUEST BY AN INDIVIDUAL.
§ 1121. REQUIREMENTS FOR COMMUNICATIONS TO INDIVIDUALS. ALL NOTICES,
DISCLOSURES, FORMS, AND OTHER COMMUNICATIONS TO INDIVIDUALS PROVIDED
PURSUANT TO THIS ARTICLE SHALL COMPLY WITH THE FOLLOWING:
1. ALL COMMUNICATIONS SHALL USE PLAIN, STRAIGHTFORWARD LANGUAGE,
AVOIDING TECHNICAL OR LEGAL JARGON, AND MUST BE PROVIDED THROUGH AN
INTERFACE THE INDIVIDUAL REGULARLY USES IN CONNECTION WITH THE REGULATED
ENTITY'S PRODUCT OR SERVICE.
2. ALL COMMUNICATIONS SHALL BE REASONABLY ACCESSIBLE TO INDIVIDUALS
WITH DISABILITIES, INCLUDING BY:
(A) UTILIZING DIGITAL ACCESSIBILITY TOOLS;
(B) FOR NOTICES, COMPLYING WITH GENERALLY RECOGNIZED INDUSTRY STAND-
ARDS, INCLUDING, BUT NOT LIMITED TO, CURRENT STANDARDS SET BY STANDARDS
SETTING BODIES SUCH AS THE WORLD WEB CONSORTIUM, OR OTHER SIMILAR STAND-
ARDS SETTING BODIES AS DETERMINED BY THE ATTORNEY GENERAL; AND
(C) FOR OTHER COMMUNICATIONS, PROVIDING INFORMATION ABOUT HOW AN INDI-
VIDUAL WITH A DISABILITY MAY ACCESS THE COMMUNICATION IN AN ALTERNATIVE
FORMAT.
3. ALL COMMUNICATIONS SHALL BE AVAILABLE IN THE LANGUAGES IN WHICH THE
REGULATED ENTITY PROVIDES INFORMATION VIA ITS WEBSITE AND SERVICES. ANY
DIRECT COMMUNICATION TO AN INDIVIDUAL SHALL BE PROVIDED IN THE LANGUAGE
IN WHICH THE INDIVIDUAL ORDINARILY INTERACTS WITH THE REGULATED ENTITY
OR ITS SERVICE PROVIDER.
4. A REGULATED ENTITY SHALL MAKE ANY NOTICE FOR PROCESSING PURSUANT TO
A PERMISSIBLE PURPOSE, PURSUANT TO SUBPARAGRAPH (II) OF PARAGRAPH (B) OF
SUBDIVISION ONE OF SECTION ELEVEN HUNDRED TWENTY-TWO OF THIS ARTICLE, OR
FORM FOR PROCESSING PURSUANT TO AUTHORIZATION, PURSUANT TO SUBPARAGRAPH
(I) OF PARAGRAPH (B) OF SUBDIVISION ONE OF SECTION ELEVEN HUNDRED TWEN-
TY-TWO OF THIS ARTICLE, PUBLICLY AVAILABLE ON ITS WEBSITE. IF AN AUTHOR-
IZATION FORM IS CUSTOMIZED FOR EACH INDIVIDUAL, THE REGULATED ENTITY MAY
INSTEAD PUBLICLY POST A SAMPLE AUTHORIZATION FORM ON ITS WEBSITE.
§ 1122. LAWFULNESS OF PROCESSING REGULATED HEALTH INFORMATION. 1. IT
SHALL BE UNLAWFUL FOR A REGULATED ENTITY TO:
(A) SELL AN INDIVIDUAL'S REGULATED HEALTH INFORMATION TO A THIRD
PARTY; OR
S. 9269 4
(B) OTHERWISE PROCESS AN INDIVIDUAL'S REGULATED HEALTH INFORMATION
UNLESS:
(I) THE INDIVIDUAL HAS PROVIDED VALID AUTHORIZATION FOR SUCH PROCESS-
ING AS SET FORTH IN PARAGRAPH (B) OF SUBDIVISION TWO OF THIS SECTION; OR
(II) PROCESSING OF AN INDIVIDUAL'S REGULATED HEALTH INFORMATION IS
STRICTLY NECESSARY FOR THE PURPOSE OF:
(A) PROVIDING, MAINTAINING, DEVELOPING, IMPROVING, OR REPAIRING A
SPECIFIC PRODUCT, FEATURE, OR SERVICE REQUESTED BY SUCH INDIVIDUAL, OR
FUNCTIONALITY THEREOF;
(B) CONDUCTING THE REGULATED ENTITY'S INTERNAL BUSINESS OPERATIONS,
WHICH EXCLUDE ANY ACTIVITIES RELATED TO MARKETING, ADVERTISING, RESEARCH
AND DEVELOPMENT, OR PROVIDING PRODUCTS OR SERVICES TO THIRD PARTIES;
(C) PROTECTING AGAINST MALICIOUS, FRAUDULENT, OR ILLEGAL ACTIVITY;
(D) DETECTING, RESPONDING TO, OR PREVENTING SECURITY INCIDENTS OR
THREATS;
(E) PROTECTING THE VITAL INTERESTS OF AN INDIVIDUAL;
(F) INVESTIGATING, ESTABLISHING, EXERCISING, PREPARING FOR, OR DEFEND-
ING LEGAL CLAIMS; OR
(G) COMPLYING WITH THE REGULATED ENTITY'S LEGAL OBLIGATIONS PURSUANT
TO FEDERAL, STATE OR LOCAL LAW OR REGULATION.
2. UNLESS PROCESSING OF AN INDIVIDUAL'S REGULATED HEALTH INFORMATION
IS STRICTLY NECESSARY PURSUANT TO SUBPARAGRAPH (II) OF PARAGRAPH (B) OF
SUBDIVISION ONE OF THIS SECTION, A REGULATED ENTITY THAT PROCESSES REGU-
LATED HEALTH INFORMATION PURSUANT TO VALID AUTHORIZATION AS REQUIRED BY
SUBPARAGRAPH (I) OF PARAGRAPH (B) OF SUBDIVISION ONE OF THIS SECTION
SHALL COMPLY WITH THE FOLLOWING:
(A) A REQUEST FOR AUTHORIZATION TO PROCESS AN INDIVIDUAL'S REGULATED
HEALTH INFORMATION SHALL:
(I) BE MADE SEPARATELY FROM ANY OTHER TRANSACTION OR PART OF A TRANS-
ACTION;
(II) BE WRITTEN IN PLAIN LANGUAGE AND IN NO LESS THAN TWELVE POINT
FONT;
(III) CLEARLY AND CONSPICUOUSLY STATE THAT THE PROCESSING FOR WHICH
THE CONSENT IS REQUESTED IS NOT STRICTLY NECESSARY, AND THAT THE USER
MAY DECLINE WITHOUT PREVENTING CONTINUED USE OF THE WEBSITE, ONLINE
SERVICE, ONLINE APPLICATION, MOBILE DEVICE, CONNECTED DEVICE, OR ANY
OTHER SERVICE THE USER IS REQUESTING OR SIGNING UP FOR;
(IV) BE MADE IN THE ABSENCE OF ANY MECHANISM THAT HAS THE PURPOSE OR
SUBSTANTIAL EFFECT OF OBSCURING, SUBVERTING, OR IMPAIRING AN INDIVID-
UAL'S DECISION-MAKING REGARDING AUTHORIZATION FOR PROCESSING;
(V) IF REQUESTING AUTHORIZATION FOR MULTIPLE CATEGORIES OF PROCESSING
ACTIVITIES, ALLOW THE INDIVIDUAL TO PROVIDE OR WITHHOLD AUTHORIZATION
SEPARATELY FOR EACH CATEGORY OF PROCESSING ACTIVITY; AND
(VI) NOT INCLUDE ANY REQUEST FOR AUTHORIZATION FOR A PROCESSING ACTIV-
ITY FOR WHICH AN INDIVIDUAL HAS WITHHELD OR REVOKED AUTHORIZATION WITHIN
THE PAST NINE MONTHS.
(B) A VALID AUTHORIZATION SHALL INCLUDE:
(I) THE TYPES OF REGULATED HEALTH INFORMATION TO BE PROCESSED;
(II) THE NATURE OF THE PROCESSING ACTIVITY;
(III) THE SPECIFIC PURPOSES FOR SUCH PROCESSING;
(IV) THE NAMES WHERE READILY AVAILABLE, OR CATEGORIES OF SERVICE
PROVIDERS AND THIRD PARTIES TO WHICH THE REGULATED ENTITY MAY DISCLOSE
THE INDIVIDUAL'S REGULATED HEALTH INFORMATION AND THE PURPOSES FOR SUCH
DISCLOSURE, INCLUDING THE CIRCUMSTANCES UNDER WHICH THE REGULATED ENTITY
MAY DISCLOSE REGULATED HEALTH INFORMATION TO LAW ENFORCEMENT;
S. 9269 5
(V) ANY MONETARY OR OTHER VALUABLE CONSIDERATION THE REGULATED ENTITY
MAY RECEIVE IN CONNECTION WITH PROCESSING THE INDIVIDUAL'S REGULATED
HEALTH INFORMATION, WHERE APPLICABLE;
(VI) THAT FAILING TO PROVIDE AUTHORIZATION WILL NOT AFFECT THE INDI-
VIDUAL'S EXPERIENCE OF USING THE REGULATED ENTITY'S PRODUCTS OR
SERVICES;
(VII) THE EXPIRATION DATE OF THE AUTHORIZATION, WHICH MAY BE UP TO ONE
YEAR FROM THE DATE AUTHORIZATION WAS PROVIDED;
(VIII) THE MECHANISM BY WHICH THE INDIVIDUAL MAY REVOKE AUTHORIZATION
PRIOR TO EXPIRATION;
(IX) THE MECHANISM BY WHICH THE INDIVIDUAL MAY REQUEST ACCESS TO AND
DELETION OF THEIR REGULATED HEALTH INFORMATION;
(X) ANY OTHER INFORMATION MATERIAL TO AN INDIVIDUAL'S DECISION-MAKING
REGARDING AUTHORIZATION FOR PROCESSING; AND
(XI) THE SIGNATURE OR OTHER FORM OF UNAMBIGUOUS AFFIRMATIVE CONSENT,
WHICH MAY BE ELECTRONIC, OF THE INDIVIDUAL WHO IS THE SUBJECT OF THE
REGULATED HEALTH INFORMATION, OR A PARENT OR GUARDIAN AUTHORIZED BY LAW
TO TAKE ACTIONS OF LEGAL CONSEQUENCE ON BEHALF OF THE INDIVIDUAL WHO IS
THE SUBJECT OF THE REGULATED HEALTH INFORMATION, AND THE DATE.
(C) (I) A REGULATED ENTITY THAT RECEIVES AUTHORIZATION FOR PROCESSING
SHALL PROVIDE AN EFFECTIVE, EFFICIENT, AND EASY-TO-USE MECHANISM BY
WHICH AN INDIVIDUAL MAY REVOKE AUTHORIZATION AT ANY TIME THROUGH AN
INTERFACE THE INDIVIDUAL REGULARLY USES IN CONNECTION WITH THE REGULATED
ENTITY'S PRODUCT OR SERVICE.
(II) UPON AN INDIVIDUAL'S VERIFIABLE REVOCATION OF AUTHORIZATION, THE
REGULATED ENTITY SHALL IMMEDIATELY CEASE ALL PROCESSING ACTIVITIES FOR
WHICH AUTHORIZATION WAS REVOKED, EXCEPT TO THE EXTENT NECESSARY TO
COMPLY WITH THE REGULATED ENTITY'S LEGAL OBLIGATIONS.
(III) FOR INDIVIDUALS WHO HAVE AN ONLINE ACCOUNT WITH THE REGULATED
ENTITY, THE REGULATED ENTITY MUST PROVIDE, IN A CONSPICUOUS AND EASILY
ACCESSIBLE PLACE WITHIN THE ACCOUNT SETTINGS, A LIST OF ALL PROCESSING
ACTIVITIES FOR WHICH THE INDIVIDUAL HAS PROVIDED AUTHORIZATION AND, FOR
EACH PROCESSING ACTIVITY, ALLOW THE INDIVIDUAL TO REVOKE AUTHORIZATION
IN THE SAME PLACE WITH ONE MOTION OR ACTION.
(D) UPON OBTAINING VALID AUTHORIZATION FROM AN INDIVIDUAL, THE REGU-
LATED ENTITY SHALL PROVIDE THAT INDIVIDUAL A COPY OF THE AUTHORIZATION.
THE AUTHORIZATION SHALL BE PROVIDED IN A MANNER THAT IS CAPABLE OF BEING
RETAINED BY THE INDIVIDUAL.
(E) THE REGULATED ENTITY SHALL LIMIT ITS PROCESSING TO WHAT WAS CLEAR-
LY DISCLOSED TO AN INDIVIDUAL PURSUANT TO PARAGRAPH (B) OF THIS SUBDIVI-
SION WHEN THE REGULATED ENTITY RECEIVED AUTHORIZATION FROM THE INDIVID-
UAL.
(F) IF THE REGULATED ENTITY SEEKS TO MATERIALLY ALTER ITS PROCESSING
ACTIVITIES FOR REGULATED HEALTH INFORMATION COLLECTED PURSUANT TO
AUTHORIZATION, THE REGULATED ENTITY SHALL OBTAIN A NEW AUTHORIZATION FOR
THE NEW OR ALTERED PROCESSING ACTIVITY.
(G) PROVIDING A PRODUCT OR SERVICE REQUESTED BY AN INDIVIDUAL MUST NOT
BE MADE CONTINGENT ON PROVIDING AUTHORIZATION. THE REGULATED ENTITY MUST
NOT DISCRIMINATE AGAINST AN INDIVIDUAL FOR WITHHOLDING AUTHORIZATION,
SUCH AS BY CHARGING DIFFERENT PRICES OR RATES FOR PRODUCTS OR SERVICES,
INCLUDING THROUGH THE USE OF DISCOUNTS OR OTHER BENEFITS, IMPOSING
PENALTIES, OR PROVIDING A DIFFERENT LEVEL OR QUALITY OF SERVICES OR
GOODS TO THE INDIVIDUAL.
3. A REGULATED ENTITY THAT PROCESSES REGULATED HEALTH INFORMATION
PURSUANT TO A PERMISSIBLE PURPOSE PURSUANT TO SUBPARAGRAPH (II) OF PARA-
S. 9269 6
GRAPH (B) OF SUBDIVISION ONE OF THIS SECTION SHALL COMPLY WITH THE
FOLLOWING:
(A) A REGULATED ENTITY SHALL PROVIDE CLEAR AND CONSPICUOUS NOTICE THAT
DESCRIBES:
(I) THE TYPES OF REGULATED HEALTH INFORMATION TO BE PROCESSED;
(II) THE NATURE OF THE PROCESSING ACTIVITY;
(III) THE SPECIFIC PURPOSES FOR SUCH PROCESSING;
(IV) THE NAMES WHERE READILY AVAILABLE, OR CATEGORIES OF SERVICE
PROVIDERS AND THIRD PARTIES TO WHICH THE REGULATED ENTITY MAY DISCLOSE
THE INDIVIDUAL'S REGULATED HEALTH INFORMATION AND THE PURPOSES FOR SUCH
DISCLOSURE, INCLUDING THE CIRCUMSTANCES UNDER WHICH THE REGULATED ENTITY
MAY DISCLOSE REGULATED HEALTH INFORMATION TO LAW ENFORCEMENT; AND
(V) THE MECHANISM BY WHICH THE INDIVIDUAL MAY REQUEST ACCESS TO AND
DELETION OF THEIR REGULATED HEALTH INFORMATION.
(B) IF THE REGULATED ENTITY MATERIALLY ALTERS ITS PROCESSING ACTIV-
ITIES FOR REGULATED HEALTH INFORMATION COLLECTED PURSUANT TO A PERMISSI-
BLE PURPOSE, THE REGULATED ENTITY MUST PROVIDE A CLEAR AND CONSPICUOUS
NOTICE IN PLAIN LANGUAGE, SEPARATE FROM A PRIVACY POLICY, TERMS OF
SERVICE, OR SIMILAR DOCUMENT, THAT DESCRIBES ANY MATERIAL CHANGES TO THE
PROCESSING ACTIVITIES AND PROVIDE THE INDIVIDUAL WITH AN OPPORTUNITY TO
REQUEST DELETION OF THEIR REGULATED HEALTH INFORMATION.
§ 1123. INDIVIDUAL RIGHTS. 1. (A) A REGULATED ENTITY SHALL MAKE AVAIL-
ABLE AN EFFECTIVE, EFFICIENT, AND EASY-TO-USE MECHANISM THROUGH AN
INTERFACE THE INDIVIDUAL REGULARLY USES IN CONNECTION WITH THE REGULATED
ENTITY'S PRODUCT OR SERVICE BY WHICH AN INDIVIDUAL MAY MAKE VERIFIABLE
REQUESTS UNDER THIS SECTION.
(B) THE REGULATED ENTITY SHALL, WITHOUT UNDUE DELAY AND NO LATER THAN
WITHIN THIRTY DAYS OF RECEIVING A VERIFIABLE ACCESS REQUEST, MAKE AVAIL-
ABLE A COPY OF ALL REGULATED HEALTH INFORMATION ABOUT THE INDIVIDUAL
THAT THE REGULATED ENTITY MAINTAINS OR THAT SERVICE PROVIDERS MAINTAIN
ON BEHALF OF THE REGULATED ENTITY. A REGULATED ENTITY MAY EXTEND THE
PERIOD WITHIN WHICH TO MAKE AVAILABLE SUCH COPY ONE TIME BY THIRTY ADDI-
TIONAL DAYS WHEN REASONABLY NECESSARY, AS LONG AS THE REGULATED ENTITY
PROVIDES NOTICE OF SUCH EXTENSION TO THE INDIVIDUAL DURING THE ORIGINAL
THIRTY DAY PERIOD.
2. (A) A REGULATED ENTITY SHALL MAKE AVAILABLE AN EFFECTIVE, EFFI-
CIENT, AND EASY-TO-USE MECHANISM THROUGH AN INTERFACE THE INDIVIDUAL
REGULARLY USES IN CONNECTION WITH THE REGULATED ENTITY'S PRODUCT OR
SERVICE BY WHICH AN INDIVIDUAL MAY REQUEST THE DELETION OF THEIR REGU-
LATED HEALTH INFORMATION.
(B) AN INDIVIDUAL'S REQUEST TO DELETE OR CANCEL THEIR ONLINE ACCOUNT
SHALL BE TREATED AS A REQUEST TO DELETE THE INDIVIDUAL'S REGULATED
HEALTH INFORMATION.
(C) THE REGULATED ENTITY SHALL, WITHOUT UNDUE DELAY AND NO LATER THAN
WITHIN THIRTY DAYS OF RECEIVING A VERIFIABLE DELETION REQUEST:
(I) DELETE ALL REGULATED HEALTH INFORMATION ASSOCIATED WITH THE INDI-
VIDUAL IN THE REGULATED ENTITY'S POSSESSION OR CONTROL, EXCEPT TO THE
EXTENT NECESSARY TO COMPLY WITH THE REGULATED ENTITY'S LEGAL OBLI-
GATIONS; AND
(II) UNLESS IT PROVES IMPOSSIBLE OR INVOLVES DISPROPORTIONATE EFFORT
THAT IS DOCUMENTED IN WRITING BY THE REGULATED ENTITY, COMMUNICATE SUCH
REQUEST TO EACH SERVICE PROVIDER OR THIRD PARTY THAT PROCESSED THE INDI-
VIDUAL'S REGULATED HEALTH INFORMATION IN CONNECTION WITH A TRANSACTION
INVOLVING THE REGULATED ENTITY OCCURRING WITHIN ONE YEAR PRECEDING THE
INDIVIDUAL'S REQUEST.
S. 9269 7
(D) ANY SERVICE PROVIDER OR THIRD PARTY THAT RECEIVES NOTICE OF AN
INDIVIDUAL'S DELETION REQUEST SHALL WITHIN THIRTY DAYS DELETE ALL REGU-
LATED HEALTH INFORMATION ASSOCIATED WITH THE INDIVIDUAL IN ITS
POSSESSION OR CONTROL, EXCEPT TO THE EXTENT NECESSARY TO COMPLY WITH ITS
LEGAL OBLIGATIONS.
3. ANY RIGHT SET FORTH IN THIS SECTION MAY BE EXERCISED AT ANY TIME BY
THE INDIVIDUAL WHO IS THE SUBJECT OF THE REGULATED HEALTH INFORMATION OR
AN AGENT AUTHORIZED BY SUCH INDIVIDUAL.
§ 1124. SECURITY. 1. A REGULATED ENTITY SHALL DEVELOP, IMPLEMENT, AND
MAINTAIN REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS
TO PROTECT THE SECURITY, CONFIDENTIALITY, AND INTEGRITY OF REGULATED
HEALTH INFORMATION.
2. A REGULATED ENTITY MUST SECURELY DISPOSE OF AN INDIVIDUAL'S REGU-
LATED HEALTH INFORMATION PURSUANT TO A PUBLICLY AVAILABLE RETENTION
SCHEDULE WITHIN A REASONABLE TIME, AND IN NO EVENT LATER THAN SIXTY
DAYS, AFTER IT IS NO LONGER NECESSARY TO MAINTAIN FOR THE PERMISSIBLE
PURPOSE OR PURPOSES IDENTIFIED IN THE NOTICE OR FOR WHICH THE INDIVIDUAL
PROVIDED VALID AUTHORIZATION.
§ 1125. SERVICE PROVIDERS. 1. ANY PROCESSING OF REGULATED HEALTH
INFORMATION BY A SERVICE PROVIDER ON BEHALF OF A REGULATED ENTITY SHALL
BE GOVERNED BY A WRITTEN, BINDING AGREEMENT. SUCH AGREEMENT SHALL CLEAR-
LY SET FORTH INSTRUCTIONS FOR PROCESSING REGULATED HEALTH INFORMATION,
THE NATURE AND PURPOSE OF PROCESSING, THE DURATION OF PROCESSING, AND
THE RIGHTS AND OBLIGATIONS OF BOTH PARTIES.
2. AN AGREEMENT PURSUANT TO SUBDIVISION ONE OF THIS SECTION SHALL
REQUIRE THAT THE SERVICE PROVIDER:
(A) ENSURE THAT EACH PERSON PROCESSING REGULATED HEALTH INFORMATION IS
SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO SUCH INFORMATION;
(B) PROTECT REGULATED HEALTH INFORMATION IN A MANNER CONSISTENT WITH
THE REQUIREMENTS OF THIS ARTICLE;
(C) PROCESS REGULATED HEALTH INFORMATION ONLY WHEN AND TO THE EXTENT
NECESSARY TO COMPLY WITH ITS OBLIGATIONS TO THE REGULATED ENTITY;
(D) NOT COMBINE THE REGULATED HEALTH INFORMATION WHICH THE SERVICE
PROVIDER RECEIVES FROM OR ON BEHALF OF THE REGULATED ENTITY WITH ANY
OTHER PERSONAL INFORMATION WHICH THE SERVICE PROVIDER RECEIVES FROM OR
ON BEHALF OF ANOTHER PARTY OR COLLECTS FROM ITS OWN RELATIONSHIP WITH
INDIVIDUALS;
(E) COMPLY WITH ANY EXERCISES OF AN INDIVIDUAL'S RIGHTS UNDER SECTION
ELEVEN HUNDRED TWENTY-THREE OF THIS ARTICLE UPON THE REQUEST OF THE
REGULATED ENTITY AND NOTIFY ANY SERVICE PROVIDERS OR THIRD PARTIES TO
WHICH IT DISCLOSED REGULATED HEALTH INFORMATION OF THE REQUEST;
(F) DELETE OR RETURN ALL REGULATED HEALTH INFORMATION TO THE REGULATED
ENTITY AT THE END OF THE PROVISION OF SERVICES, UNLESS RETENTION OF THE
REGULATED HEALTH INFORMATION IS REQUIRED BY LAW;
(G) UPON THE REASONABLE REQUEST OF THE REGULATED ENTITY, MAKE AVAIL-
ABLE TO THE REGULATED ENTITY ALL DATA IN ITS POSSESSION NECESSARY TO
DEMONSTRATE THE SERVICE PROVIDER'S COMPLIANCE WITH THE OBLIGATIONS IN
THIS SECTION;
(H) ALLOW, AND COOPERATE WITH, REASONABLE ASSESSMENTS BY THE REGULATED
ENTITY OR THE REGULATED ENTITY'S DESIGNATED ASSESSOR FOR PURPOSES OF
EVALUATING COMPLIANCE WITH THE OBLIGATIONS OF THIS ARTICLE. ALTERNA-
TIVELY, THE SERVICE PROVIDER MAY ARRANGE FOR A QUALIFIED AND INDEPENDENT
ASSESSOR TO CONDUCT AN ASSESSMENT OF THE SERVICE PROVIDER'S POLICIES AND
TECHNICAL AND ORGANIZATIONAL MEASURES IN SUPPORT OF THE OBLIGATIONS
UNDER THIS ARTICLE USING AN APPROPRIATE AND ACCEPTED CONTROL STANDARD OR
FRAMEWORK AND ASSESSMENT PROCEDURE FOR SUCH ASSESSMENTS. THE SERVICE
S. 9269 8
PROVIDER SHALL PROVIDE A REPORT OF SUCH ASSESSMENT TO THE REGULATED
ENTITY UPON REQUEST;
(I) NOTIFY THE REGULATED ENTITY A REASONABLE TIME IN ADVANCE BEFORE
DISCLOSING OR TRANSFERRING REGULATED HEALTH INFORMATION TO ANY FURTHER
SERVICE PROVIDERS, WHICH MAY BE IN THE FORM OF A REGULARLY UPDATED LIST
OF FURTHER SERVICE PROVIDERS THAT MAY ACCESS REGULATED HEALTH INFORMA-
TION; AND
(J) ENGAGE ANY FURTHER SERVICE PROVIDER PURSUANT TO A WRITTEN, BINDING
AGREEMENT THAT INCLUDES THE CONTRACTUAL REQUIREMENTS PROVIDED IN THIS
SECTION, CONTAINING AT MINIMUM THE SAME OBLIGATIONS THAT THE SERVICE
PROVIDER HAS ENTERED INTO WITH REGARD TO REGULATED HEALTH INFORMATION.
§ 1126. EXEMPTIONS. NOTHING IN THIS ARTICLE SHALL APPLY TO THE FOLLOW-
ING, AND THE ATTORNEY GENERAL MAY PROMULGATE RULES AND REGULATIONS SPEC-
IFYING ADDITIONAL EXCEPTIONS FOR REGULATED HEALTH INFORMATION THAT IS
SUBJECT TO AND PROCESSED IN COMPLIANCE WITH ANY FEDERAL LAW THAT IS AS
PROTECTIVE OR MORE PROTECTIVE OF INDIVIDUAL PRIVACY THAN THIS CHAPTER:
1. LOCAL, STATE, OR FEDERAL GOVERNMENTS AND THEIR AGENCIES, AUTHORI-
TIES OR PUBLIC CORPORATIONS AS DEFINED IN SECTION SIXTY-SIX OF THE
GENERAL CONSTRUCTION LAW OR INFORMATION PROCESSED BY OR ON BEHALF OF
SUCH GOVERNMENTAL ENTITIES PROVIDED THAT THE INFORMATION IS ONLY PROC-
ESSED FOR GOVERNMENTAL PURPOSES;
2. INFORMATION THAT MEETS THE DEFINITION OF PROTECTED HEALTH INFORMA-
TION FOR PURPOSES OF THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY
ACT OF 1996 (PUBLIC LAW 104-191) AND IMPLEMENTING REGULATIONS AS WELL AS
THE HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT
(PUBLIC LAW 111-5) AND IMPLEMENTING REGULATIONS;
3. ANY COVERED ENTITY GOVERNED BY THE PRIVACY, SECURITY, AND BREACH
NOTIFICATION RULES ISSUED BY THE UNITED STATES DEPARTMENT OF HEALTH AND
HUMAN SERVICES, PARTS 160 AND 164 OF TITLE 45 OF THE CODE OF FEDERAL
REGULATIONS (CFR), ESTABLISHED PURSUANT TO THE HEALTH INSURANCE PORTA-
BILITY AND ACCOUNTABILITY ACT OF 1996 (PUBLIC LAW 104-191);
4. ANY BUSINESS ASSOCIATE GOVERNED BY THE PRIVACY, SECURITY, AND
BREACH NOTIFICATION RULES ISSUED BY THE UNITED STATES DEPARTMENT OF
HEALTH AND HUMAN SERVICES, PARTS 160 AND 164 OF TITLE 45 OF THE CODE OF
FEDERAL REGULATIONS (CFR), ESTABLISHED PURSUANT TO THE HEALTH INSURANCE
PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (PUBLIC LAW 104-191) TO THE
EXTENT THE BUSINESS ASSOCIATE MAINTAINS THE INFORMATION IN THE SAME
MANNER AS DESCRIBED IN SUBDIVISION TWO OF THIS SECTION FOR PROTECTED
HEALTH INFORMATION OR DEIDENTIFIES SUCH INFORMATION IN ACCORDANCE WITH
REQUIREMENTS FOR DEIDENTIFICATION SET FORTH IN SECTION ELEVEN HUNDRED
TWENTY OF THIS ARTICLE;
5. A PROGRAM OR QUALIFIED SERVICE ORGANIZATION OR RECORDS SUBJECT TO
42 USC SECTION 290DD-2 AND 42 CFR PART 2;
6. INFORMATION COLLECTED AS PART OF A CLINICAL TRIAL SUBJECT TO THE
FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS, ALSO KNOWN AS THE
COMMON RULE, PURSUANT TO GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE
INTERNATIONAL COUNCIL FOR HARMONISATION OR PURSUANT TO HUMAN SUBJECT
PROTECTION REQUIREMENTS OF THE UNITED STATES FOOD AND DRUG ADMINIS-
TRATION;
7. INFORMATION AND DOCUMENTS LAWFULLY SUBJECT TO THE FEDERAL HEALTH
CARE QUALITY IMPROVEMENT ACT OF 1986 (42 USC SECTIONS 11101 - 11152),
AND IMPLEMENTING FEDERAL REGULATIONS;
8. PATIENT SAFETY WORK PRODUCT SUBJECT TO 42 CFR PART 3, ESTABLISHED
PURSUANT TO 42 USC SECTIONS 299B-21 THROUGH 299B-26;
9. DEIDENTIFIED PROTECTED HEALTH INFORMATION, AS DEFINED IN THE HEALTH
INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (PUBLIC LAW
S. 9269 9
104-191), THAT IS DEIDENTIFIED IN ACCORDANCE WITH THE REQUIREMENTS FOR
DEIDENTIFICATION SET FORTH IN 45 CFR SECTION 164.514;
10. IDENTIFIABLE PRIVATE INFORMATION FOR PURPOSES OF THE FEDERAL POLI-
CY FOR THE PROTECTION OF HUMAN SUBJECTS, 45 C.F.R. PART 46; IDENTIFIABLE
PRIVATE INFORMATION THAT IS OTHERWISE INFORMATION COLLECTED AS PART OF
HUMAN SUBJECTS RESEARCH PURSUANT TO THE GOOD CLINICAL PRACTICE GUIDE-
LINES ISSUED BY THE INTERNATIONAL COUNCIL FOR HARMONISATION; THE
PROTECTION OF HUMAN SUBJECTS UNDER 21 C.F.R. PARTS 50 AND 56; DATA USED
OR SHARED IN RESEARCH, AS DEFINED IN 45 CFR 164.501, AND SUBJECT TO 45
CFR 164.512(I); OR DATA USED OR SHARED IN RESEARCH CONDUCTED IN ACCORD-
ANCE WITH ONE OR MORE OF THE REQUIREMENTS SET FORTH IN THIS SECTION;
11. DATA USED OR DISCLOSED ONLY FOR ONE OR MORE OF THE FOLLOWING:
(A) PRODUCT REGISTRATION AND TRACKING CONSISTENT WITH APPLICABLE
UNITED STATES FOOD AND DRUG ADMINISTRATION REGULATIONS AND GUIDANCE;
(B) PUBLIC HEALTH ACTIVITIES AND PURPOSES AS DESCRIBED IN AND SUBJECT
TO 45 CFR SECTION 164.512;
(C) PART OF A LIMITED DATA SET, AS DEFINED, AND IS USED, DISCLOSED,
AND MAINTAINED IN THE MANNER REQUIRED BY 45 CFR SECTION 164.514; OR
(D) ACTIVITIES RELATED TO QUALITY, SAFETY, OR EFFECTIVENESS REGULATED
BY THE UNITED STATES FOOD AND DRUG ADMINISTRATION;
12. INFORMATION SUBJECT TO THE TRUSTED EXCHANGE FRAMEWORK AND COMMON
AGREEMENT (TEFCA) CREATED BY THE U.S. DEPARTMENT OF HEALTH & HUMAN
SERVICES ASSISTANT SECRETARY FOR TECHNOLOGY POLICY (ASTP), OR THROUGH
OTHER NETWORKS THAT EXCHANGE INFORMATION ABOUT INDIVIDUALS, INCLUDING
BUT NOT LIMITED TO HEALTH INFORMATION OR SOCIAL SERVICES INFORMATION,
AND ARE APPROVED IN ACCORDANCE WITH THE STATEWIDE COMMON PARTICIPATION
AGREEMENT AND POLICIES AND PROCEDURES ADOPTED PURSUANT TO 10 NYCRR PART
300;
13. INFORMATION SPECIFICALLY FOR A QUALITY ASSURANCE COMMITTEE, PEER
REVIEW COMMITTEE, OR QUALITY IMPROVEMENT COMMITTEE FOR PURPOSES OF
SECTION TWENTY-EIGHT HUNDRED FIVE-J, TWENTY-EIGHT HUNDRED FIVE-K, OR
TWENTY-EIGHT HUNDRED FIVE-L OF THE PUBLIC HEALTH LAW;
14. HEALTH INFORMATION COLLECTED, USED, OR DISCLOSED SUBJECT TO
SECTION EIGHTEEN OF THE PUBLIC HEALTH LAW;
15. DIRECTORY INFORMATION SUBJECT TO THE FAMILY EDUCATIONAL RIGHTS AND
PRIVACY ACT, 20 U.S.C. §§ 1232G ET SEQ., AS AMENDED FROM TIME TO TIME;
16. PERSONAL INFORMATION SUBJECT TO THE FAIR CREDIT REPORTING ACT (15
U.S.C. 1681 ET SEQ.) AND IMPLEMENTING REGULATIONS WHEN USED FOR THE
PURPOSE OF FURNISHING A CONSUMER CREDIT REPORT UNDER THE FAIR CREDIT
REPORTING ACT (15 U.S.C. 1681 ET SEQ.) AND IMPLEMENTING REGULATIONS;
17. DATA USED FOR RESEARCH AND DEVELOPMENT ONLY IF DEIDENTIFIED IN
ACCORDANCE WITH THE REQUIREMENTS FOR DEIDENTIFICATION SET FORTH IN
SECTION ELEVEN HUNDRED TWENTY OF THIS ARTICLE, AND REVIEWED AND APPROVED
BY AN INSTITUTIONAL REVIEW BOARD;
18. ANY OTHER INFORMATION, WHICH MAY BE DEEMED TO BE REGULATED HEALTH
INFORMATION UNDER THIS SECTION, BUT WHICH IS SUBJECT TO, AND WHICH IS
PROCESSED IN COMPLIANCE WITH, ANY OTHER PRIVACY LAWS OR REGULATIONS THAT
ARE AS OR MORE PROTECTIVE OF INDIVIDUAL PRIVACY THAN THIS CHAPTER;
19. INFORMATION THAT:
(A) IS COLLECTED BY A BUSINESS ABOUT AN INDIVIDUAL IN THE COURSE OF
THE INDIVIDUAL ACTING AS A JOB APPLICANT TO, AN EMPLOYEE OF, OWNER OF,
DIRECTOR OF, OFFICER OF, MEDICAL STAFF MEMBER OF, OR INDEPENDENT
CONTRACTOR OF, THAT BUSINESS TO THE EXTENT THAT THE INDIVIDUAL'S
PERSONAL INFORMATION IS COLLECTED AND USED BY THE BUSINESS SOLELY WITHIN
THE CONTEXT OF THE INDIVIDUAL'S ROLE OR FORMER ROLE AS A JOB APPLICANT
S. 9269 10
TO, AN EMPLOYEE OF, OWNER OF, DIRECTOR OF, OFFICER OF, MEDICAL STAFF
MEMBER OF, OR AN INDEPENDENT CONTRACTOR OF, THAT BUSINESS;
(B) IS COLLECTED BY A BUSINESS THAT IS EMERGENCY CONTACT INFORMATION
OF THE INDIVIDUAL ACTING AS A JOB APPLICANT TO, AN EMPLOYEE OF, OWNER
OF, DIRECTOR OF, OFFICER OF, MEDICAL STAFF MEMBER OF, OR INDEPENDENT
CONTRACTOR OF, THAT BUSINESS TO THE EXTENT THAT THE INFORMATION IS
COLLECTED AND USED SOLELY WITHIN THE CONTEXT OF HAVING AN EMERGENCY
CONTACT ON FILE; OR
(C) IS NECESSARY FOR THE BUSINESS TO RETAIN TO ADMINISTER BENEFITS FOR
ANOTHER INDIVIDUAL RELATING TO THE INDIVIDUAL ACTING AS A JOB APPLICANT
TO, AN EMPLOYEE OF, OWNER OF, DIRECTOR OF, OFFICER OF, MEDICAL STAFF
MEMBER OF, OR INDEPENDENT CONTRACTOR OF, THAT BUSINESS TO THE EXTENT
THAT THE INFORMATION IS COLLECTED AND USED SOLELY WITHIN THE CONTEXT OF
ADMINISTERING THOSE BENEFITS;
20. INFORMATION COLLECTED, CREATED OR MAINTAINED PURSUANT TO SECTIONS
33.13 AND 33.16 OF THE MENTAL HYGIENE LAW; OR
21. ENTITIES LICENSED, REGISTERED OR CERTIFIED BY THE OFFICE OF CHIL-
DREN AND FAMILY SERVICES, WHICH ARE REQUIRED TO PROCESS INFORMATION BY
THE REGULATIONS OF SUCH OFFICE.
§ 1127. ENFORCEMENT. 1. WHENEVER IT APPEARS TO THE ATTORNEY GENERAL,
EITHER UPON COMPLAINT OR OTHERWISE, THAT ANY PERSON OR PERSONS, WITHIN
OR OUTSIDE THE STATE, HAS ENGAGED IN OR IS ABOUT TO ENGAGE IN ANY OF THE
ACTS OR PRACTICES STATED TO BE UNLAWFUL UNDER THIS ARTICLE, THE ATTORNEY
GENERAL MAY BRING AN ACTION OR SPECIAL PROCEEDING IN THE NAME AND ON
BEHALF OF THE PEOPLE OF THE STATE OF NEW YORK TO ENJOIN ANY VIOLATION OF
THIS ARTICLE, TO OBTAIN RESTITUTION OF ANY MONEYS OR PROPERTY OBTAINED
DIRECTLY OR INDIRECTLY BY ANY SUCH VIOLATION, TO OBTAIN DISGORGEMENT OF
ANY PROFITS OBTAINED DIRECTLY OR INDIRECTLY BY ANY SUCH VIOLATION, TO
OBTAIN CIVIL PENALTIES OF NOT MORE THAN FIFTEEN THOUSAND DOLLARS PER
VIOLATION AND TO OBTAIN ANY SUCH OTHER AND FURTHER RELIEF AS THE COURT
MAY DEEM PROPER, INCLUDING PRELIMINARY RELIEF. IN DETERMINING THE
PENALTY, THE COURT SHALL CONSIDER THE SEVERITY OF THE VIOLATION AND THE
REGULATED ENTITY'S GOOD FAITH EFFORT TO COMPLY WITH THE REQUIREMENTS OF
THIS ARTICLE.
2. THE REMEDIES PROVIDED BY THIS SECTION SHALL BE IN ADDITION TO ANY
OTHER LAWFUL REMEDY AVAILABLE.
3. ANY ACTION OR SPECIAL PROCEEDING BROUGHT BY THE ATTORNEY GENERAL
PURSUANT TO THIS SECTION MUST BE COMMENCED WITHIN SIX YEARS OF THE DATE
ON WHICH THE ATTORNEY GENERAL BECAME AWARE OF THE VIOLATION.
4. IN CONNECTION WITH ANY PROPOSED ACTION OR SPECIAL PROCEEDING UNDER
THIS SECTION, THE ATTORNEY GENERAL IS AUTHORIZED TO TAKE PROOF AND MAKE
A DETERMINATION OF THE RELEVANT FACTS, AND TO ISSUE SUBPOENAS IN ACCORD-
ANCE WITH THE CIVIL PRACTICE LAW AND RULES. THE ATTORNEY GENERAL MAY
ALSO REQUIRE SUCH OTHER DATA AND INFORMATION AS THEY MAY DEEM RELEVANT
AND MAY REQUIRE WRITTEN RESPONSES TO QUESTIONS UNDER OATH. SUCH POWER OF
SUBPOENA AND EXAMINATION SHALL NOT ABATE OR TERMINATE BY REASON OF ANY
ACTION OR SPECIAL PROCEEDING BROUGHT BY THE ATTORNEY GENERAL UNDER THIS
ARTICLE.
5. THIS SECTION SHALL APPLY TO ALL ACTS DECLARED TO BE UNLAWFUL IN
THIS ARTICLE, WHETHER OR NOT SUBJECT TO ANY OTHER LAW OF THIS STATE, AND
SHALL NOT SUPERSEDE, AMEND OR REPEAL ANY OTHER LAW OF THIS STATE UNDER
WHICH THE ATTORNEY GENERAL IS AUTHORIZED TO TAKE ANY ACTION OR CONDUCT
ANY INQUIRY.
6. THE ATTORNEY GENERAL MAY PROMULGATE SUCH RULES AND REGULATIONS AS
ARE NECESSARY TO EFFECTUATE AND ENFORCE THE PROVISIONS OF THIS SECTION.
S. 9269 11
§ 1128. CONTRACTS AND WAIVERS VOID AND UNENFORCEABLE. 1. ANY CONTRAC-
TUAL PROVISION INCONSISTENT WITH THIS ARTICLE SHALL BE VOID AND UNEN-
FORCEABLE.
2. ANY WAIVER BY ANY INDIVIDUAL OF THE PROVISIONS OF THIS ARTICLE
SHALL BE VOID AND UNENFORCEABLE.
§ 1129. CONSTRUCTION. NOTHING IN THIS ARTICLE SHALL BE CONSTRUED TO
RESTRICT, INVALIDATE OR LIMIT THE AUTHORITY, POWER, OR PROCEDURES ESTAB-
LISHED UNDER ANY LAW PROVIDING FOR THE REPORTING OF DISEASE OR INJURY,
CHILD ABUSE, BIRTH, OR DEATH, PUBLIC HEALTH SURVEILLANCE, OR DISCLOSURES
TO THE NEW YORK STATE DEPARTMENT OF HEALTH FOR PUBLIC HEALTH ACTIVITIES,
OR HEALTH OVERSIGHT ACTIVITIES, INCLUDING, BUT NOT LIMITED TO, ANY
DISCLOSURES PERMITTED BY 45 CFR 164.512(B) AND (D).
§ 2. Severability. If any clause, sentence, paragraph, subdivision,
section or part of this act shall be adjudged by any court of competent
jurisdiction to be invalid, such judgment shall not affect, impair, or
invalidate the remainder thereof, but shall be confined in its operation
to the clause, sentence, paragraph, subdivision, section or part thereof
directly involved in the controversy in which such judgment shall have
been rendered. It is hereby declared to be the intent of the legislature
that this act would have been enacted even if such invalid provisions
had not been included herein.
§ 3. This act shall take effect 6 months after it shall have become a
law. Effective immediately, the addition, amendment and/or repeal of any
rule or regulation necessary for the implementation of this act on its
effective date are authorized to be made and completed on or before such
effective date.
