New York Laws
Title 2 - General Provisions
18 - Access to Patient Information.

(a) "Committee" means a medical access review committee appointed
pursuant to subdivision four of this section.
(b) "Health care provider" or "provider" means a "health care
facility" or a "health care practitioner" as defined by this
subdivision.
(c) "Health care facility" or "facility" means a hospital as defined
in article twenty-eight of this chapter, a home care services agency as
defined in article thirty-six of this chapter, a hospice as defined in
article forty of this chapter, a health maintenance organization as
defined in article forty-four of this chapter, and a shared health
facility as defined in article forty-seven of this chapter.
(d) "Health care practitioner" or "practitioner" means a person
licensed under article one hundred thirty-one, one hundred thirty-one-B,
one hundred thirty-two, one hundred thirty-three, one hundred
thirty-six, one hundred thirty-nine, one hundred forty-one, one hundred
forty-three, one hundred forty-four, one hundred fifty-three, one
hundred fifty-four, one hundred fifty-six or one hundred fifty-nine of
the education law or a person certified under section twenty-five
hundred sixty of this chapter.
(e) "Patient information" or "information" means any information
concerning or relating to the examination, health assessment including,
but not limited to, a health assessment for insurance and employment
purposes or treatment of an identifiable subject maintained or possessed
by a health care facility or health care practitioner who has provided
or is providing services for assessment of a health condition including,
but not limited to, a health assessment for insurance and employment
purposes or has treated or is treating such subject, except (i)
information and clinical records subject to the provisions of section
23.05 or 33.13 of the mental hygiene law, (ii) personal notes and
observations of a health care practitioner, provided that such personal
notes and observations are maintained by the practitioner and not
disclosed by the practitioner to any other person after January first,
nineteen hundred eighty-seven, (iii) information maintained by a
practitioner, concerning or relating to the prior examination or
treatment of a subject received from another practitioner, provided
however, that such information may be requested by the subject directly
from such other practitioner in accordance with the provisions of this
section, and (iv) data disclosed to a practitioner in confidence by
other persons on the basis of an express condition that such data would
never be disclosed to the subject or other persons, provided that such
data has never been disclosed to any other person. If at any time such
personal notes and observations or such data is disclosed, it shall be
considered patient information for purposes of this section. For
purposes of this subdivision, "disclosure to any other person" shall not
include disclosures made to practitioners as part of a consultation or
referral during the treatment of the subject, to persons reviewing
information or records in the ordinary course of ensuring that a
provider is in compliance with applicable quality of care, licensure or
accreditation standards, to an employee or official of a federal, state
or local agency for the sole purpose of conducting an audit in the
course of his or her official duties, to the statewide planning and
research cooperative system, to other persons pursuant to a court order,
to governmental agencies, insurance companies licensed pursuant to the
insurance law and other third parties requiring information necessary
for payments to be made to or on behalf of patients, to qualified
researchers, to the state board for professional medical conduct when

such board requests such information in the exercise of its statutory
function, to an insurance carrier insuring, or an attorney consulted by,
a health care provider, or to a health maintenance organization
certified pursuant to article forty-four of this chapter or licensed
pursuant to the insurance law, or to the committee or a court pursuant
to the provisions of this section.
For purposes of this subdivision treatment of a subject shall not
include diagnostic services, except mammography, performed by a
practitioner at the request of another health care practitioner
provided, however, that such information, and mammograms, may be
requested by the subject directly from the practitioner at whose request
such diagnostic services were performed, in accordance with the
provisions of this section.
(f) "Personal notes and observations" means a practitioner's
speculations, impressions (other than tentative or actual diagnosis) and
reminders, provided such data is maintained by a practitioner.
(g) "Qualified person" means any properly identified subject; or a
guardian appointed under article eighty-one of the mental hygiene law;
or a parent of an infant; or a guardian of an infant appointed under
article seventeen of the surrogate's court procedure act or other
legally appointed guardian of an infant who may be entitled to request
access to a clinical record under paragraph (c) of subdivision two of
this section; or a distributee of any deceased subject for whom no
personal representative, as defined in the estates, powers and trusts
law, has been appointed; or an attorney representing a qualified person
or the subject's estate who holds a power of attorney from the qualified
person or the subject's estate explicitly authorizing the holder to
execute a written request for patient information under this section. A
qualified person shall be deemed a "personal representative of the
individual" for purposes of the federal health insurance portability and
accountability act of 1996 and its implementing regulations.
(h) "Subject" means an individual concerning whom patient information
is maintained or possessed by a health care provider.
(i) "Treating practitioner" means the health care practitioner who has
primary responsibility for the care of the subject within the health
care facility or if such practitioner is unavailable, a practitioner
designated by such facility.
(j) "Cease to do business in this state" shall mean any case where a
health care provider who has engaged in an on-going practice or business
within this state as a health care provider, ceases to engage in such
business, provided however, that this term shall not include a health
care practitioner whose practice is merged, consolidated, combined, or
acquired by another health care provider and he or she continues to
provide services including medical care, diagnosis or treatment to
patients as an employee, contractor, or owner of the merged,
consolidated, combined, or acquired health care provider.
2. Access by qualified persons. (a) Subject to the provisions of
subdivision three of this section, upon the written request of any
subject, a health care provider shall provide an opportunity, within ten
days, for such subject to inspect any patient information concerning or
relating to the examination or treatment of such subject in the
possession of such health care provider.
(b) Subject to the provisions of subdivision three of this section,
upon the written request of the committee for an incompetent appointed
pursuant to article seventy-eight of the mental hygiene law, a health
care provider shall provide an opportunity, within ten days, for the
inspection by such committee of any patient information concerning the
incompetent subject in the possession of such health care provider.
(c) Subject to the provisions of subdivision three of this section and
except as otherwise provided by law, upon the written request of a
parent or guardian of an infant appointed pursuant to article seventeen
of the surrogate's court procedure act, or any other legally appointed
guardian, a health care provider shall provide an opportunity, within
ten days, for such parent or guardian to inspect any patient information
maintained or possessed by such provider concerning care and treatment
of the infant for which the consent of such parent or guardian was
obtained or where care was provided without consent in an emergency
which was the result of accidental injury or the unexpected onset of
serious illness; provided, however, that such parent or guardian shall
not be entitled to inspect or make copies of any patient information
concerning the care and treatment of an infant where the health care
provider determines that access to the information requested by such
parent or guardian would have a detrimental effect on the provider's
professional relationship with the infant, or on the care and treatment
of the infant, or on the infant's relationship with his or her parents
or guardian.
(d) Subject to the provisions of subdivision three of this section,
upon the written request of any qualified person, a health care provider
shall furnish to such person, within a reasonable time, a copy of any
patient information requested, and original mammograms requested, which
the person is authorized to inspect pursuant to this subdivision.
(e) The provider may impose a reasonable charge for all inspections
and copies, not exceeding the costs incurred by such provider, provided,
however, that a provider may not impose a charge for copying an original
mammogram when the original has been furnished to any qualified person
and provided, further, that any charge for furnishing an original
mammogram pursuant to this section shall not exceed the documented costs
associated therewith. However, the reasonable charge for paper copies
shall not exceed seventy-five cents per page. A qualified person shall
not be denied access to patient information solely because of inability
to pay. No charge may be imposed under this section for providing,
releasing, or delivering patient information or copies of patient
information where requested for the purpose of supporting an
application, claim or appeal for any government benefit or program,
provided that, where a provider maintains patient information in
electronic form, it shall provide the copy in either electronic or paper
form, as required by the government benefit or program, or at the
patient's request.
(f) A provider may place reasonable limitations on the time, place,
and frequency of any inspections of patient information.
(g) In the event that a practitioner does not have space available to
permit the inspection of patient information, the practitioner may, in
the alternative, furnish a qualified person a copy of such information
within ten days.
(h) A provider may request the opportunity to review the patient
information with the qualified person requesting such information, but
such review shall not be a prerequisite for furnishing the information.
(i) A provider may make available for inspection either the original
or a copy of patient information.
3. Limitations on access. (a) Upon receipt of a written request by a
qualified person to inspect or copy patient information, a practitioner
may review the information requested. Unless the practitioner determines
pursuant to paragraph (d) of this subdivision that (i) the requested
review of the information can reasonably be expected to cause
substantial and identifiable harm to the subject or others which would
outweigh the qualified person's right to access to the information, or

(ii) the material requested is personal notes and observations, or the
information requested would have a detrimental effect as defined in
subdivision two of this section, review of such patient information
shall be permitted or copies provided.
(b) Upon receipt of a written request by a qualified person to inspect
patient information maintained by a facility, the facility shall inform
the treating practitioner of the request. The treating practitioner may
review the information requested. Unless the treating practitioner
determines, pursuant to paragraph (d) of this subdivision that the
requested review of the information can reasonably be expected to cause
substantial and identifiable harm to the subject or others which would
outweigh the qualified person's right of access to the information or
would have a detrimental effect as defined in subdivision two of this
section, review of such patient information shall be permitted or copies
provided.
(c) A subject over the age of twelve years may be notified of any
request by a qualified person to review his/her patient information,
and, if the subject objects to disclosure, the provider may deny the
request. In the case of a facility, the treating practitioner shall be
consulted.
(d) The provider may deny access to all or a part of the information
and may grant access to a prepared summary of the information if, after
consideration of all the attendant facts and circumstances, the provider
determines that (i) the request to review all or a part of the patient
information can reasonably be expected to cause substantial and
identifiable harm to the subject or others which would outweigh the
qualified person's right of access to the information, or would have a
detrimental effect as defined in subdivision two of this section, or
(ii) the material requested is personal notes and observations. In
conducting such review, the provider may consider, among other things,
the following factors: (i) the need for, and the fact of, continuing
care and treatment; (ii) the extent to which the knowledge of the
information may be harmful to the health or safety of the subject or
others; (iii) the extent to which the information contains sensitive
material disclosed in confidence to the practitioner or treating
practitioner by family members, friends and other persons; (iv) the
extent to which the information contains sensitive materials disclosed
to the practitioner or the treating practitioner by the subject which
would be injurious to the subject's relationships with other persons,
except when the subject is requesting information concerning himself or
herself; and (v) in the case of a minor making a request for access
pursuant to subdivision two of this section, the age of the subject.
(e) In the event of a denial of access, the qualified person shall be
informed by the provider of such denial, and whether the denial is based
on the reasonable expectation that release of the information can
reasonably be expected to cause substantial and identifiable harm to the
subject or others which outweighs the qualified person's right of access
to the information or on the reasonable expectation that release of the
information would have a detrimental effect as defined in subdivision
two of this section, or on the basis that the materials sought to be
reviewed constitute personal notes and observations, and of the
qualified person's right to obtain, without cost, a review of the denial
by the appropriate medical record access review committee. If the
qualified person requests such review, the provider shall, within ten
days of receipt of such request, transmit the information including
personal notes and observations as defined herein, to the chairman of
the appropriate committee with a statement setting forth the specific
reasons for which access was denied. After an in camera review of the

materials provided and after providing all parties a reasonable
opportunity to be heard, the committee shall promptly make a written
determination whether the requested review of the information can
reasonably be expected to cause substantial and identifiable harm to the
subject or others which outweighs the qualified person's right of access
to the information pursuant to paragraph (d) of this subdivision or
whether the requested review would have a detrimental effect as defined
in subdivision two of this section, or whether all or part of the
materials sought to be reviewed constitute personal notes and
observations, and shall accordingly determine whether access to all or
part of such materials shall be granted. In the event that the committee
determines that the request for access shall be granted in whole or in
part, the committee shall notify all parties and the provider shall
grant access pursuant to such determination.
(f) In the event that access is denied in whole or in part because the
requested review of information can reasonably be expected to cause
substantial and identifiable harm to the subject or others which would
outweigh the qualified person's right of access to the information, or
would have a detrimental effect as defined in subdivision two of this
section, the committee shall notify the qualified person of his or her
right to seek judicial review of the provider's determination pursuant
to this section: provided however, that a determination by the committee
as to whether materials sought to be reviewed constitute personal notes
and observations shall not be the subject of judicial review. Within
thirty days of receiving notification of such decision, the qualified
person may commence, upon notice, a special proceeding in supreme court
for a judgment requiring the provider to make available the information
for inspection or copying. The court upon such application and after an
in camera review of the materials provided including the determination
and record of the committee, and after providing all parties an
opportunity to be heard, shall determine whether there exists a
reasonable basis for the denial of access. The relief available pursuant
to this section shall be limited to a judgement requiring the provider
to make available to the qualified person the requested information for
inspection or copying.
(g) Where the written request for patient information under this
section is signed by a distributee of a deceased subject for whom a
personal representative has not been appointed, or from the holder of a
power of attorney from such a distributee, a copy of a certified copy of
the certificate of death of the subject shall be attached to the written
request.
(h) Where the written request for patient information under this
section is signed by the holder of a power of attorney, a copy of the
power of attorney shall be attached to the written request. A written
request under this subdivision shall be subject to the duration and
terms of the power of attorney.
(i) The release of patient information shall be subject to: (i)
article twenty-seven-F of this chapter in the case of confidential
HIV-related information; (ii) section seventeen of this article and
sections twenty-three hundred one, twenty-three hundred six and
twenty-three hundred eight of this chapter in the case of termination of
a pregnancy and treatment for a sexually transmitted disease; (iii)
article thirty-three of the mental hygiene law; and (iv) any other
provisions of law creating special requirements relating to the release
of patient information, including the federal health insurance
portability and accountability act of 1996 and its implementing
regulations.

4. Medical record access review committees. The commissioner shall
designate medical record access review committees to hear appeals of the
denial of access to patient information as provided in paragraph (e) of
subdivision three of this section. The commissioner shall promulgate
rules and regulations necessary to effectuate the provisions of this
subdivision.
5. Annual report. The commissioner shall submit an annual report on or
before December thirty-first to the governor and the legislature. Such
report shall include, but not be limited to, the number of requests for
committee review of providers' denial of access and the committees'
determinations thereon.
6. Disclosure to third persons. Whenever a health care provider, as
otherwise authorized by law, discloses patient information to a person
or entity other than the subject of such information or to other
qualified persons, either a copy of the subject's written authorization
shall be added to the patient information or the name and address of
such third party and a notation of the purpose for the disclosure shall
be indicated in the file or record of such subject's patient information
maintained by the provider provided, however, that for disclosures made
to government agencies making payments on behalf of patients or to
insurance companies licensed pursuant to the insurance law such a
notation shall only be entered at the time the disclosure is first made.
This subdivision shall not apply to disclosure to practitioners or other
personnel employed by or under contract with the facility, or to
government agencies for purposes of facility inspections or professional
conduct investigations. Any disclosure made pursuant to this section
shall be limited to that information necessary in light of the reason
for disclosure. Information so disclosed should be kept confidential by
the party receiving such information and the limitations on such
disclosure in this section shall apply to such party.
7. Applicability of federal law. Whenever federal law or applicable
federal regulations affecting the release of patient information are a
condition for the receipt of federal aid, and are inconsistent with the
provisions of this section, the provisions of federal law or federal
regulations shall be controlling.
8. Challenges to accuracy. A qualified person may challenge the
accuracy of information maintained in the patient information and may
require that a brief written statement prepared by him or her concerning
the challenged information be inserted into the patient information.
This statement shall become a permanent part of the patient information
and shall be released whenever the information at issue is released.
This subdivision shall apply only to factual statements and shall not
include a provider's observations, inferences or conclusions.
A facility may place reasonable restrictions on the time and frequency
of any challenges to accuracy.
9. Waivers void. Any agreement by an individual to waive any right to
inspect, copy or seek correction of patient information as provided for
in this section shall be deemed to be void as against public policy and
wholly unenforceable.
10. Nothing contained in this section shall restrict, expand or in any
way limit the disclosure of any information pursuant to articles
twenty-three, thirty-one and forty-five of the civil practice law and
rules or section six hundred seventy-seven of the county law.
11. No proceeding shall be brought or penalty assessed, except as
provided for in this section, against a health care provider, who in
good faith, denies access to patient information.

12. Immunity from liability. No health care provider shall be
subjected to civil liability arising solely from granting or providing
access to any patient information in accordance with this section.
13. (a) A health care provider which has in its possession patient
information and/or patient medical records and which has determined to
permanently cease to do business or practice in this state shall, at
least thirty days prior to such action, make a good faith effort to
notify each of the health care provider's current patients that the
office will be closing and to inform each such patient of his or her
right to request that his or her patient information and/or patient
medical records be sent to a health care provider, health care facility
or health care practitioner of the patient's choosing or, alternatively,
that such information and records be returned to the patient.
(b) The provisions of this subdivision shall not affect any rights
afforded pursuant to section seventeen of this title.
(c) Nothing in this subdivision shall affect the period of time that a
health care provider is lawfully required to retain a patient's medical
information and medical records.
(d) The provisions of this subdivision shall only apply with respect
to a patient whose chart includes written permission to receive the
notification described in paragraph (a) of this subdivision.
* NB There are 2 § 18's