New York Enacts Law to Stop Ambulance Services and First Responders from Selling Patient Information | Practical Law

New York Enacts Law to Stop Ambulance Services and First Responders from Selling Patient Information | Practical Law

The Governor of New York has signed S. 4119, which prohibits ambulance and first responder service providers from selling private patient information to third parties for marketing purposes.

New York Enacts Law to Stop Ambulance Services and First Responders from Selling Patient Information

by Practical Law Data Privacy Advisor
Published on 08 Oct 2019 • New York, USA (National/Federal)
The Governor of New York has signed S. 4119, which prohibits ambulance and first responder service providers from selling private patient information to third parties for marketing purposes.
On October 7, 2019, New York Governor Andrew Cuomo signed S. 4119, which amends the public health law to add a section on patient privacy. The new law prohibits ambulance and advanced life support first response services from disclosing, selling, transferring, exchanging, providing, or using information that identifies an individual patient to third parties for marketing purposes.
However, the law permits disclosure of a patient's identifying information to certain individuals, for example:
  • The patient who is the subject of the information or their authorized health care decisionmaker.
  • A health care provider, or health information system, for the purposes of providing care or treatment.
  • Law enforcement personnel.
  • A person authorized by court order or subpoena.
  • The patient’s health plan, insurer, or third-party payer for the purpose of payment or reimbursement.
The law allows ambulance services and other first responders to disclose other patient data, such as zip code, geographic region, or medical specialty, for marketing purposes if it does not contain identifying information. Likewise, a not-for-profit or governmental ambulance or advanced life support first response service may use a patient’s name and address to solicit a donation to the service, provided they do not disclose other individual identifying information.
The legislature passed this law as a result of a 2014 Fire Department of New York (FDNY) privacy notice that disclosed that the FDNY may sell or use patient protected health information for fundraising and marketing purposes. The FDNY has since changed its privacy policy.
The law will take effect on April 4, 2020.