No person charged with the custody and care of the health records of employees treated at an on-site employer sponsored occupational health service facility shall release or disclose any employee-patient record to an employer, except upon the express authorization of the employee-patient, or as otherwise authorized by law.
New York Legal Code