N.Y. Pub. Health Law § 2306
All reports or information secured by a board of health or health officer under the provisions of this article shall be confidential except in so far as is necessary to carry out the purposes of this article. Such report or information may be disclosed by court order in a criminal proceeding in which it is otherwise admissible or in a proceeding pursuant to article ten of the family court act in which it is otherwise admissible, to the prosecution and to the defense, or in a proceeding pursuant to article ten of the family court act in which it is otherwise admissible, to the petitioner, respondent and attorney for the child, provided that the subject of the report or information has waived the confidentiality provided for by this section except insofar as is necessary to carry out the purposes of this article. Information may be disclosed to third party reimbursers or their agents to the extent necessary to reimburse health care providers for health services; provided that, when necessary, an otherwise appropriate authorization for such disclosure has been secured by the provider. A person waives the confidentiality provided for by this section if such person voluntarily discloses or consents to disclosure of such report or information or a portion thereof. If such person lacks the capacity to consent to such a waiver, his or her parent, guardian or attorney may so consent. An order directing disclosure pursuant to this section shall specify that no report or information shall be disclosed pursuant to such order which identifies or relates to any person other than the subject of the report or information. Reports and information may be used in the aggregate in programs approved by the commissioner for the improvement of the quality of medical care provided to persons with sexually transmitted diseases; or with patient identifiers when used within the state or local health department by public health disease programs to assess co-morbidity or completeness of reporting and to direct program needs, in which case patient identifiers shall not be disclosed outside the state or local health department except as otherwise provided for in this section.
N.Y. Pub. Health Law § 2306