(a) No confidential HIV-related information shall be disclosed pursuant to a general release. Disclosure is permitted for HIV-related information pursuant to a specific release form which has been developed or approved by the New York State Department of Health. The release must be signed by the protected individual, or if the protected individual lacks capacity to consent, by a person authorized pursuant to law to consent to health care for the individual.

(b) All written disclosures of confidential HIV-related information shall be securely packaged and be accompanied by a statement prohibiting redisclosure. The statement shall include the following language or substantially similar language: “This information has been disclosed to you from confidential records which are protected by State law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of State law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is not sufficient authorization for further disclosure. Disclosure of confidential HIV information that occurs as the result of a general authorization for the release of medical or other information will be a violation of the State law and may result in a fine or a jail sentence or both.”

(c) If oral disclosures are necessary, they must be accompanied or followed as soon as possible, but no later than 10 days, by the statement required by subdivision (b) of this section.

(d) The statement required by subdivisions (b) and (c) of this section is not required for release to the protected person or to his or her legal representative, for releases made by a physician or public health officer to a contact, or for releases made by a physician to a person authorized pursuant to law to consent to the health care of the protected person when the person has been counseled and the disclosure is medically necessary pursuant to Public Health Law, section 2782(4)(e). For disclosures of confidential HIV-related information from the patient's medical record to persons who are permitted access to this information pursuant to section 7064.8(a)(3), (4), (6), (7), (9) and (10) and section 7064.8(e) and (f) of this Part, it shall be sufficient for the statement required by subdivisions (b) and (c) of this section to appear in the medical record itself.