Each health care provider and health facility employing
persons or contracting with persons to perform any activity related to such
provider's or facility's rendering of health services shall develop and
implement policies and procedures to maintain the confidentiality of
confidential HIV-related information. Such policies and procedures shall assure
that such information is disclosed to employees or contractors only when
appropriate under this Part. Such policies and procedures shall include:
(a) initial employee education inservice
education of employees regarding the legal prohibition against unauthorized
disclosure in Public Health Law article 27-F and provisions of article 21,
title III. Updates should be provided to all employees in cases of changes to
relevant laws or regulations. A list of all employees who have had such
training must be maintained by health care providers and health facilities.
Health care providers and health facilities contracting with others for
services in which HIV-related information may be disclosed to such contractors,
must document evidence that such contractors have been informed of the
confidentiality and disclosure requirements of this Part;
(b) maintenance of a list of job titles and
the specific employee functions within those titles for which employees are
authorized to access such information. This list shall describe the limits of
such access to information and must be provided to the employees during
employee education sessions;
(c) a
requirement that only full-time or part-time employees, contractors and
medical, nursing or health-related students who have received such education on
HIV confidentiality, or can document that they have received such education or
training, shall have access to confidential HIV-related information while
performing the authorized functions listed under paragraph (2) of this
subdivision;
(d) protocols for
ensuring that records, including records which are stored electronically, are
maintained securely and used for the purpose intended;
(e) procedures for handling requests by other
parties for confidential HIV-related information;
(f) protocols prohibiting
employees/agents/contractors from discriminating against persons having or
suspected of having HIV infection; and
(g) review of the policies and procedures on
at least an annual basis.