^[i] This ground for denial is available under both New York law and HIPAA because both laws establish a right of access when the resident submits a request in writing.  See NY Public Health Law § 18; 45 C.F.R. § 164.524.

 

^[ii]               We believe that both New York law and the Privacy Rule permit denial of access if the information requested is not located within the resident’s designated record set.  Under New York law, residents and other qualified persons are permitted to access resident information maintained or possessed by a health care facility or health care practitioner.   See NY Public Health Law § 18.  Such information is defined (with certain exceptions) to include information relating to the examination, health assignment or treatment of an identifiable subject.  We therefore believe that this right of access under New York law is limited to information which may be used to make decisions about the resident, which, under the Privacy Rule would be called a “designated record set.”

 

^[iii]              Under New York law, health care providers are permitted to deny access to the personal notes and observations of a health care provider.  NY Public Health Law § 18(3)(d).  Under the Privacy Rule, however, access may only be denied for a subset of these personal notes called “psychotherapy notes.”  Residential programs are therefore not permitted to deny access to personal notes and observations that do not qualify as psychotherapy notes, unless another ground for denial under Section 4 of this policy applies.  

 

^[iv]              A covered entity may choose to specify a narrower subset of persons who may make this determination (for example, the Privacy Officer).

 

^[v]               This ground for denial is permitted under both New York law and the Privacy Rule.  See NY Public Health Law § 18(1)(e) (carving out from the definition of resident information which may be accessed any “data disclosed to a practitioner in confidence by other persons on the basis of an express condition that such data would never be disclosed to the subject [resident] or other persons…); 45 C.F.R. § 164.524(a)(2)(v) (permitting denial of access if “the protected health information was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information).

 

^[vi]              This ground for denial would be permitted under both New York law and the Privacy Rule.  See NY Public Health Law § 18(d)(3) (permitting providers to deny access to a resident when such access would “reasonably be expected to cause substantial and identifiable harm to the subject [resident] or others which would outweigh the . . . [resident’s] right of access to the information.”); 45 C.F.R. § 164.524(a)(2)(ii) (permitting denial of an inmate’s request for copies when a correctional institution determines that granting the request would “jeopardize the health, safety, security, custody or rehabilitation of the individual or of other inmates, or the safety of any officer, employee, or other person at the correctional institution or responsible for the transporting of the inmate.”).

 

^[vii]             65 Fed. Reg. at 82,555 (Dec. 28, 2000).

 

^[viii]             Under New York law, a health care provider would be permitted to deny access to the resident if such access could “reasonably be expected to cause substantial and identifiable harm to the subject or others which would outweigh the [resident’s] right of access to the information.”  NY Public Health Law § 18(3)(d).  Under the Privacy Rule, however, access may only be denied if the harm that would occur is an endangerment of the “life or physical safety” of the resident.  See 45 C.F.R. 164.524(a)(3)(i); 65 Fed. Reg. at 82,555 (Dec. 28, 2000).  Because this standard under the Privacy Rule permits denial of access under a narrower set of circumstances, this policy incorporates the Privacy Rule standard instead of the standard under Section 18 of the New York Public Health Law.  Residential programs should modify the current procedure for making such determinations to apply the narrower standard (i.e.,  make sure health care professionals are informed of the new standard).

 

^[ix]              This ground for denial is permitted under both New York law and the Privacy Rule.  See NY Public Health Law § 18(3)(d) (permitting denial of access when such access could “reasonably be expected to cause substantial and identifiable harm to the subject or others which would outweigh the [resident’s] right of access to the information.”); 45 C.F.R. 164.524(a)(3)(ii) (permitting denial of access when the “information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person.”).

 

^[x]               65 Fed. Reg. at 82,556 (Dec. 28, 2000).