Law / United States / 
New Jersey
Privacy Protection Act, health care facilities: limits on collecting and disclosing a patient's immigration status, citizenship status and similar information
Privacy Protection Act, health care facilities, N.J. Stat. § 26:2H-5.37 (P.L.2026, c.4, section 6)
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- This section does not bind a health care facility until the first day of the 13th month next following enactment of P.L.2026, c.4, which was approved on (P.L.2026, c.4, section 9).
- If you are a health care facility, do not request or collect information relating to a patient's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number, except when it is necessary to ensure the safe and appropriate delivery of health care services, including assessment, treatment, transfer, referral, billing or discharge, as State or federal law requires, or to assess eligibility for, or to provide or administer, a public service, benefit or program (N.J.S.A. 26:2H-5.37(a)).
- Do not disclose that information when it is kept to assess eligibility for or to administer a health care service, benefit or program, except as federal or State law requires for eligibility, as a valid judicial order, judicial warrant or federal law requires, or with the patient's knowing written consent (N.J.S.A. 26:2H-5.37(b) and (c)).
- Obtain written consent that states the exact record or information to be shared, the purpose of sharing it, that consent is voluntary and declining it brings no discrimination or retaliation, that consent may be revoked without affecting information already shared, and the person or agency that will receive it; using the Department of Health's standardized form, or an interpreter-assisted process consistent with State and federal law, is deemed compliance with the consent requirements (N.J.S.A. 26:2H-5.37(c)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Department of Health, which enforces the section consistent with its authority under Title 26 of the Revised Statutes and as a condition of licensure; a patient, or the patient's personal representative or guardian, may file a complaint with the Department of Health (N.J.S.A. 26:2H-5.37(f)(1)).
What record it asks for
Logging duty
Section 6 limits what a health care facility may request, collect and disclose about a patient's immigration status, citizenship status, place of birth, social security number and taxpayer identification number, and sets the contents of a written consent. A consent form is a communication with the patient and no log, record, retention period or audit is named.
- Kind
- None
- As of
What this law does
A health care facility may not request or collect information relating to a patient's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number, except when the information is necessary to ensure the safe and appropriate delivery of health care services, as required by applicable State or federal law, or to assess eligibility for, or to provide or administer, a public service, benefit, or program.
The term health care facility has the meaning given in subsection a. of section 2 of P.L.1971, c.136. Section 2 of P.L.1971, c.136, as amended by P.L.2017, c.294, defines a health care facility as a facility or institution, whether public or private, that is engaged principally in providing services for health maintenance organizations, diagnosis, or treatment of human disease, pain, injury, deformity, or physical condition.
Nothing in the act prohibits a health care facility from maintaining a patient's complete medical record subject to the Health Insurance Portability and Accountability Act of 1996.
Information relating to a patient's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number that is kept to assess eligibility for or to administer a health care service, benefit or program is not a government record under the Open Public Records Act and may not be disclosed except as the section lists. The section does not prohibit disclosure when the patient has knowingly provided written consent.
Written consent must include the exact record or information to be shared, the purpose of sharing it, a statement that consent is voluntary and declining it will not result in discrimination or retaliation, a statement that consent may be revoked without affecting information already shared, and the person or agency to receive it.
A health care facility that uses a standardized form or provides consent through an interpreter-assisted process consistent with applicable State and federal law is deemed in compliance with the consent requirements of the section.
A health care facility that knowingly obtains, discloses or uses such information for a purpose the section does not permit is subject to penalties and enforcement by the Department of Health consistent with its authority under Title 26 of the Revised Statutes and as a condition of licensure. Section 6 of P.L.2026, c.4 takes effect on the first day of the 13th month next following enactment. P.L.2026, c.4 was approved on . Counting from that approval, the 13th month following is April 2027, so section 6 takes effect on .
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .