New York Consolidated Laws, General Business Law - GBS § 394-h. Electronic health information protections

a. Electronic health information.  The term “electronic health information” means any information in any electronic format or media that relates to an individual or a device that is reasonably linkable to an individual or individuals in connection with any past, present, or future disability, physical health condition, or mental health condition;  the search for or attempt to obtain health care services;  any past, present, or future treatment or other health care services for a disability, physical health condition, or mental health condition;  location information associated with a health care facility;  or the past, present, or future payment for health care services.  For the avoidance of doubt, any inference drawn or data derived about an individual or a device that is reasonably linkable to an individual or individuals that relates to any of these topics in any electronic format or media is considered electronic health information.  Electronic health information does not include deidentified information.

b. Law enforcement agency.  The term “law enforcement agency” shall have the same meaning as in subdivision four of section 705.00 of the criminal procedure law.

c. Law enforcement officer.  The term “law enforcement officer” means a police officer or peace officer as defined in section 1.20 of the criminal procedure law.

a. Information processed by local, state, and federal governments, and municipal corporations;

b. Protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5);

c. Any covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the covered entity maintains patient information in the same manner as protected health information as described in paragraph b of this subdivision;

d. Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration;

e. Information processed pursuant to the federal Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g) and its implementing regulations;

f. Information processed pursuant to section two-d of the education law;  and

g. Information processed pursuant to the federal Driver's Privacy Protection Act of 1994 (18 U.S.C. Sec. 2721 et seq).