N.Y. ISC Law § 321

§ 321. Medical information exchange centers. (a) Whenever any\ninsurance company (which is a member of a medical information exchange\ncenter or which otherwise may transmit medical information in whatever\nmanner to any other similar facility including but not limited to an\nelectronic data facility used by two or more insurance companies to\ndetermine or aid in determining the insurability of applicants) requests\nmedical information from any applicant for personal insurance, it shall\nnot transmit, nor be considered to have obtained the applicant's\ninformed consent to transmit, the information to any such facility\nunless such company furnishes such applicant with a clear and\nconspicuous notice disclosing:\n (1) a description of such facility and its operations, including its\nname, address and telephone number where it may be contacted to request\ndisclosure of any medical information transmitted to it;\n (2) the circumstances under which such facility may release such\nmedical information to other persons; and\n (3) such applicant's rights to request such facility to arrange\ndisclosure of the nature and substance of any information in its files\npertaining to him, and to seek correction of any inaccuracies or\nincompleteness of such information.\n (b) Such notice shall be given to all applicants when any application\nfor personal insurance is completed.\n (c) No such facility shall release, transmit or otherwise communicate\nany medical information it may have to any other person unless such\nother person shall have in its possession a written instrument signed by\nthe person who is the subject of medical information (or by a parent or\nguardian if such subject is a minor) specifically naming such facility\nand authorizing such other person to obtain such medical information\nfrom such facility.\n (d) No such facility shall maintain information about HIV related test\nresults pertaining to any individual unless such test results are\nincluded within a general code, which code is not designated solely for\nHIV related test results, and concerning which code no member of such\nfacility may request from such facility details sufficient to determine\nwhether the code was used to maintain information about HIV related test\nresults.\n For purposes of this subsection, an "HIV related test" means any\nlaboratory test or series of tests for any virus, antibody, antigen or\netiologic agent whatsoever thought to cause or to indicate the presence\nof AIDS.\n