Sec. 807.5. Policies and procedures

(a) All providers of substance use disorder services must develop and implement written policies, procedures and methods governing the provision of HIV prevention education, testing, counseling, and the confidentiality of HIV-related information pursuant to this Part and laws and regulations of the Department of Health.

(b) Policies and procedures must specify each staff who has access to confidential HIV-related information, and the education and training such staff must receive at least annually, in order to minimize the number of individuals with access to such information.

(c) Policies and procedures must require that each staff of the program authorized to access confidential HIV-related information be advised in writing and sign a statement attesting to the following:

(1) they will not examine HIV-related information in the treatment/recovery plan unless required to in the course of their duties and responsibilities;

(2) they will not remove or copy any such documents or computer data unless they are acting within the scope of their assigned duties;

(3) they will not disclose HIV-related information unless necessary and in compliance with this Part and all other State and Federal laws; and

(4) that violation may lead to disciplinary action, including suspension or dismissal, as well as arrest and criminal prosecution.

(d) Policies and procedures must ensure that records, including records stored electronically, are maintained securely.

(e) Policies and procedures must specify procedures for handling requests for HIV-related information by outside parties pursuant to the requirements of this Part, article 27F of the Public Health Law and all other State and Federal laws.