New York Article 28 Diagnostic Center Incident Reports: Privacy Laws Checklist

Which Article 28 diagnostic centers must report incidents?

New York’s mandatory reporting rules cover Article 28 diagnostic and treatment centers (D&TCs), not only hospitals. Public Health Law § 2805-l defines “hospital,” for purposes of its adverse-event reporting requirement, to include a diagnostic and treatment center. The Department of Health identifies NYPORTS as the reporting system for Article 28 hospitals and D&TCs. Public Health Law § 2805-l; New York State Department of Health’s NYPORTS overview.

Part 751 sets minimum operating rules for D&TCs, including the adverse event reporting requirements in 10 NYCRR § 751.10. A private medical office that is not an Article 28 center is not covered by this particular D&TC rule just because it provides diagnostic or treatment services; other reporting laws may still apply. 10 NYCRR § 751.10.

What events must be submitted through New York’s incident reporting system?

NYPORTS is the New York State Department of Health incident reporting system for covered adverse events. Under 10 NYCRR § 751.10, the center must report an event within 24 hours or one business day of when it occurred or when the center has reasonable cause to believe it occurred. The initial notification must include the event’s date, nature, classification and location, as well as the medical record numbers of directly affected patients. NYSDOH NYPORTS overview; 10 NYCRR § 751.10(a)–(b).

Reportable events include:

• A patient’s death, or an injury or bodily-function impairment that requires additional or more complicated treatment or significantly changes the patient’s status, when it is not part of the natural course of illness, disease or proper treatment.
• Equipment malfunction or user error during treatment or diagnosis that results in a patient’s death or serious injury; a patient elopement resulting in death or serious injury; or abduction of a patient.
• Sexual abuse or assault, or physical assault, of a patient or staff member within the center or on its grounds.
• Release of a patient unable to make decisions to someone who is not authorized to receive the patient.
• A patient’s or staff member’s death or serious injury associated with a burn during a patient-care process; suicide, attempted suicide or self-harm resulting in serious injury; or poisoning within the center.
• A fire or internal disaster that disrupts patient care or harms patients or staff; an external disaster or emergency affecting center operations; termination of a service vital to safe operations or health and safety; or a staff strike.

For events numbered 1–10 in the regulation, the center must also conduct a thorough and credible investigation. The investigation is due within 30 days; if the center expects a delay, it must notify the Department electronically, explain the reason and provide an expected completion date that does not exceed 60 days. The center submits the investigation report electronically in the Department’s prescribed format. These investigation deadlines are separate from the initial event-reporting deadline. 10 NYCRR § 751.10(a)–(c).

Who is responsible for electronically filing incident reports?

The center is responsible for meeting its reporting obligations. It must designate staff to file through the NYPORTS application in the secure Health Commerce System (HCS). NYSDOH states that designated hospital and clinic staff need valid HCS accounts and must apply for NYPORTS access through that system. NYSDOH NYPORTS access information.

In practice, the center should assign clear responsibility for identifying reportable events, meeting deadlines, submitting the initial report and investigation, and protecting account access. An individual employee’s filing role does not replace the center’s duty to maintain an effective process for its Article 28 locations and services.

How must facilities protect the confidentiality of incident reports?

Public Health Law § 2805-m requires reports made under § 2805-l and incident reporting information required of D&TCs to be kept confidential. The law generally prohibits release except to the Department of Health or under the statute’s specified cross-reference. NYSDOH describes NYPORTS as operating through the secure HCS; centers should limit report access to authorized personnel and handle report contents under applicable confidentiality and security policies. Public Health Law § 2805-m; NYSDOH NYPORTS overview.

Confidentiality does not mean that the Department cannot receive or analyze reports. The Department may communicate conclusions to facilities and release analyses or findings in a format that does not identify a specific patient or provide a reasonable basis to identify one. It may also provide adverse-event data to researchers for patient-safety projects approved by the Commissioner, subject to security and confidentiality conditions. Public Health Law § 2805-l(5).

When may incident reports be disclosed to the state or other parties?

The center must submit required reports and investigation materials to NYSDOH. Public Health Law § 2805-m also cross-references a limited disclosure provision in § 2805-k(4), which concerns information provided in response to a hospital’s request about a physician, dentist or podiatrist in connection with privileges or employment. The cross-reference is not a general permission to share incident reports with the public. Public Health Law § 2805-m; Public Health Law § 2805-k(4).

Other statutory disclosure exceptions may apply, depending on the record and the legal authority involved. Separately, the Department may release patient-nonidentifying analyses and findings, or share data with approved researchers under protective conditions. These are distinct from public access to an identifiable NYPORTS report. Public Health Law § 2805-l(5).

HIPAA does not prevent a covered provider from making a disclosure that another law requires. It also permits certain disclosures to public health authorities authorized to receive information for public-health purposes. Those permissions do not make an otherwise confidential New York incident report publicly available. HHS summary of the HIPAA Privacy Rule; HHS guidance on public-health disclosures.

How do patient-record privacy rights differ from incident-report confidentiality?

A patient’s access rights generally concern patient information in the clinical record, while the separate incident report is governed by Article 28’s confidentiality rules. Under New York Public Health Law § 18, a patient may make a written request to inspect patient information concerning their examination or treatment and, subject to applicable limits, request a copy. Public Health Law § 18.

HIPAA generally gives patients access to their protected health information in designated record sets, such as medical and billing records and other records used to make decisions about them. But NYSDOH explains that Article 28 incident-report information protected by § 2805-m is not part of an individual’s HIPAA designated record set because it is not used to make decisions about that individual. A request for the patient’s medical records therefore does not automatically entitle the patient to the center’s NYPORTS report or internal investigation. HHS guidance on the HIPAA right of access; NYSDOH HIPAA preemption chart for Public Health Law § 2805-m.

Keep the records distinct: a patient may seek access to their own medical-record information under applicable access rules, while the center must protect the separate incident-reporting materials as required by New York law.

What limits apply to public-records requests and civil discovery?

Public Health Law § 2805-m specifically exempts covered incident reports from disclosure under New York’s Freedom of Information Law (FOIL) and from disclosure under Article 31 of the Civil Practice Law and Rules (CPLR), subject to the statute’s stated exceptions. FOIL also recognizes records specifically exempted by state or federal statute. A request to NYSDOH for a protected incident report is therefore different from a request for public summaries or nonidentifying analyses. Public Health Law § 2805-m(2); Public Officers Law § 87(2)(a).

The protection is not a blanket shield for every document or fact connected to an event. Whether a particular record qualifies depends on how it was created and the applicable law; ordinary clinical records or independently created evidence are not automatically protected merely because they concern the same event. Courts may also consider the statutory exception for statements made at a committee meeting by a person who is a party to the action. Public Health Law § 2805-m(2); New York court decision discussing the scope of incident-report protections.

For a practical privacy checklist, identify whether the facility is an Article 28 D&TC, report qualifying events to NYPORTS on time, restrict access to authorized users, and keep patient medical records distinct from confidential incident-reporting materials. A public-records or discovery request should be assessed against the specific record sought and any applicable statutory exception.

FAQs.

Are Article 28 diagnostic and treatment centers required to report adverse events in New York?

Yes. Article 28 D&TCs must report the adverse events covered by Public Health Law § 2805-l and 10 NYCRR § 751.10 through NYPORTS. The regulation sets reporting deadlines and specifies which events require an investigation. NYSDOH NYPORTS overview; 10 NYCRR § 751.10.

Who may access a diagnostic center incident report?

Access is restricted by Public Health Law § 2805-m. The Department of Health receives required reports, and the law identifies limited statutory disclosure circumstances. The public and patients do not receive a general right to inspect the confidential NYPORTS report; a patient’s separate medical-record access rights may still apply to clinical records. Public Health Law § 2805-m; Public Health Law § 18.

Can incident reports be obtained through a New York public-records request?

Generally, no. Covered incident reports are exempt from FOIL disclosure under Public Health Law § 2805-m. NYSDOH may release certain patient-nonidentifying analyses and findings, but those are not the same as access to an identifiable incident report. Public Health Law § 2805-m; Public Health Law § 2805-l(5).

Can a patient refuse disclosure of medical-record information?

A patient may withhold authorization for disclosures that require it and may ask a covered provider to restrict certain uses or disclosures. In most cases, HIPAA does not require the provider to agree to a requested restriction, with a specific exception for certain disclosures to a health plan when the patient pays for the service in full and the disclosure is not otherwise required by law. A patient cannot veto a disclosure that New York law requires, such as a required adverse-event report to NYSDOH. HHS guidance on requested restrictions; HHS summary of disclosures required by law.