Jonathan’s Law (Chapter 24 of the Laws of 2007)

Date Issued: November 3, 2014


  • All OASAS-Certified Providers
  • Local Governmental Units (LGUs)


"Jonathan's Law" (Chapter 24 of the Laws of 2007), was recently amended by Chapter 395 of the Laws of 2013 to accommodate Justice Center investigatory mandates (Chapter 501 of the laws of 2012). The statute prescribes a process for making notifications and sharing information related to “reportable incidents” involving patients in mental hygiene facilities, including those operated or certified by OASAS. Since Jonathan's Law applies to all facilities operated or certified by OASAS the following summary of the law is intended to assist programs in developing compliance plans and strategies.

Article 33 of the Mental Hygiene law permits access by “qualified persons” to certain records retained by programs which include patient identifying information (clinical records, incident reports, investigations of abuse and mistreatment). A “qualified person” includes an individual receiving services, his/her legal guardian, parent, spouse or adult child with authority to consent for care and treatment (MHL Section 33.16). The statute also addresses permissible re-disclosure by qualified persons (MHL Section 33.25).

While the provisions of this state law are applicable to OASAS, OASAS providers must also comply with federal regulations (42 CFR Part 2) prohibiting OASAS providers from releasing any records or information without the specific consent of the patient. Therefore, before complying with a request to provide a record covered by this law, providers must ensure the existence of a written consent form signed by the patient (and/or a patient referenced in the record) which specifically authorizes the release of such record.

However, programs should consider the underlying principle of transparency incorporated in this new law and the reality that better outcomes are achieved when trust is established. With this important principle in mind, below is a summary of the major provisions of Jonathan's Law.


  1. Incident notification:

Subject to the provisions of 42 CFR Part 2, directors of facilities certified or operated by OASAS are required to provide telephone notification to a "qualified person" of an incident (“an accident or injury that affects the health or safety of a patient”) involving a patient within 24 hours of the initial report.

  1. Provision of reports:

Upon request of a “qualified person” and subject to the provisions of 42 CFR Part 2, directors of facilities certified or operated by OASAS are further required (after the 24 hour notification of the incident has been made), to provide a copy of the written incident report (redacting the names and other information that would identify patients and employees, unless those persons authorize disclosure), and offer to hold a meeting with the qualified person to further discuss the incident. The director must also provide a written report within 10 days on actions taken to address the incident (e.g., steps taken to protect the affected individuals, staff, etc).

  1. Suggested Implementation Procedures:

OASAS Counsel recommends that facilities standardize in policy at least the following:

  • how qualified persons will be made aware of this requirement;
  • how the contact information for qualified persons will be obtained and recorded;
  • which appropriate staff will be designated to make such telephone contacts;
  • what information should be conveyed during such notification;
  • how attempts to contact, and successful contacts, will be documented;
  • what steps will be taken in the event that telephone contact cannot be made within the requisite 24 hour period;
  • how, if requested, meetings will be facilitated and 10-day reports provided; and
  • how patient confidentiality will be protected.


This section requires facilities to release records to qualified persons, upon request, relating to “reportable incidents” including those reported pursuant to Article 11 of the social services law (Justice Center Vulnerable Persons Central Registry). If a request for these documents is made by a qualified person, these documents must be released within 21 days of the conclusion of the investigation.

Subject to the provisions of 42 CFR Part 2, records released to qualified persons under MHL Section 33.25 must not be further disseminated by the person receiving them except as indicated in a required cover letter accompanying records and reports released which shall state: ”Pursuant to section 33.25 of the mental hygiene law, the attached records and reports shall not be further disseminated, except that you may share the report with: (i) a health care provider; (ii) a behavioral health care provider; (iii) law enforcement, if you believe a crime has been committed; or (iv) your attorney”. Further re-disclosure of any records received by those persons listed above is prohibited except as provided in 42. CFR Part 2. Furthermore, if any reports subject to release under this section of law identify a particular individual as having made a report to the State Child Abuse Registry (SCR), contacted the Child Abuse Hotline, or otherwise cooperated in a child abuse investigation, those names (as well as any reference that reports were made to the SCR or the hotline), should be redacted from the material prior to release.

Because federal law (42 CFR Part 2) is more restrictive than state law, for the majority of requests from “qualified persons” made pursuant to this law, providers should follow the mandates of federal law requiring written consents, prohibitions against re-disclosure, and time limitations of consent.


Questions may be directed to: [email protected]