OPINION OF THE COURT
Balio, J.On this appeal, we are asked to decide whether Supreme Court properly resolved several issues of first impression concerning a physician’s disclosure of her patient’s HIV status to the attorney representing the patient’s employer in a Pennsylvania workmen’s compensation proceeding.
I
On April 21, 1989, plaintiff, a flight attendant employed by a commercial airline based in Pittsburgh, Pennsylvania, presented himself at defendant’s office in Syracuse, New York, seeking medical treatment for ear and sinus problems. The verified complaint alleges that, in the course of that consultation, plaintiff informed defendant that he had tested HIV (human immunodeficiency virus) positive and specifically asked defendant to protect the confidentiality of that information because he was concerned that release of the information could jeopardize his employment. The complaint further alleges that defendant orally agreed to protect the confidentiality of that information.
Several months after that consultation with defendant, plaintiff filed a claim in Pennsylvania for compensation benefits pursuant to that State’s Workmen’s Compensation Law (Pa Stat Annot tit 77), asserting that the ear and sinus problem for which he had sought defendant’s treatment was a job-related injury. In the course of that compensation proceeding, a Referee for the Pennsylvania Bureau of Workmen’s Compensation signed a subpoena directing defendant to ap*468pear at a hearing to be held on April 2, 1990 at the law office of the attorneys for plaintiffs employer in Pittsburgh, Pennsylvania, and directing defendant to bring with her "[a]ll medical reports or records of any kind whatsoever relating to your treatment of’ plaintiff. The attorney representing plaintiffs employer mailed that subpoena and two medical reports to defendant’s office in Syracuse. Each medical report, completed and signed by a physician in February of 1987, includes a paragraph authorizing a treating physician to release medical information regarding the "above reference claim” for Pennsylvania workmen’s compensation to plaintiffs employer and to discuss the status of plaintiffs injury with the employer. The attorney’s transmittal letter advised defendant that she was not required to appear at the hearing if she submitted the requested documents directly to the attorney. Defendant forwarded her entire chart regarding plaintiff to the attorney. That chart included reference to the fact that plaintiff had tested HIV positive.
Plaintiff commenced this action to recover compensatory and punitive damages for defendant’s disclosure of his HIV status. The complaint asserts five causes of action (denominated "Claims”) seeking recovery on different theories: negligence, breach of confidentiality, breach of oral contract, breach of implied contract, and invasion of privacy.
After joinder of issue, plaintiff moved, and defendant cross-moved, for several items of relief, including summary judgment. Supreme Court granted certain requests and denied others (Doe v Roe, 155 Misc 2d 392 [partially published]). Five principal issues are presented by defendant’s appeal and plaintiffs cross appeal from that order: (1) whether the law of Pennsylvania, rather than New York, should have been applied to resolve the substantive issues raised by the parties; (2) whether a private cause of action exists as a remedy for a violation of Public Health Law article 27-F; (3) whether the authorizations signed by plaintiff in 1987 were sufficient to comply with that article and the related regulations of the Commissioner of Health (10 NYCRR part 63) and, if they did not comply, whether defendant’s conduct violated Public Health Law § 2782; (4) whether punitive damages are recoverable for defendant’s conduct; and (5) whether Supreme Court erred by dismissing the cause of action for breach of an oral promise to preserve confidentiality.
*469II
Defendant contends that, because the physician’s disclosure was made pursuant to a subpoena issued in the normal course of a Pennsylvania workmen’s compensation proceeding, issues concerning the propriety of that disclosure should be determined according to Pennsylvania law. We disagree.
The essence of plaintiff’s action is that defendant violated her common-law and statutory duties to preserve the confidentiality of his HIV status by disclosing that status to his employer’s attorney. Plaintiff does not challenge or question the denial of his compensation claim by the Pennsylvania Workmen’s Compensation Appeal Board. Thus, we are not called upon to decide which State’s substantive laws should be applied in resolving a claimant’s entitlement to compensation benefits (cf., Cooney v Osgood Mach., 81 NY2d 66). The issues sub judice involve the scope of the confidentiality accorded by New York statutory and common law to a patient’s HIV-related information and the enforceability of that statutory scheme by a person harmed by an improper disclosure.
Supreme Court properly determined that the substantive issues regarding the physician’s duty to maintain confidentiality should be resolved according to New York law. The disclosure was made by a New York physician from her office in New York. The disclosed information concerned treatment provided to a patient in New York. The oral promise to preserve confidentiality allegedly was made in New York.
In addition, strong public policy concerns weigh heavily in New York’s favor. In 1988, the New York Legislature enacted article 27-F (§§ 2780-2787) of the Public Health Law (L 1988, ch 584) to define, in comprehensive fashion, the confidentiality rights of those persons who were or might be infected by HIV or suffering from AIDS. The Legislature, in enacting article 27-F, declared that "[the] maximum confidentiality protection for information related to human immunodeficiency virus (HIV) infection and acquired immune deficiency syndrome (AIDS) is an essential public health measure. In order to retain the full trust and confidence of persons at risk, the state has an interest both in assuring that HIV related information is not improperly disclosed and in having clear and certain rules for the disclosure of such information” (L 1988, ch 584, § 1). The Legislature further declared that the strong confidentiality protections were designed to encourage voluntary testing so individuals could learn their status, make *470appropriate decisions regarding treatment and adjust behavior that places them and others at risk of infection (ibid.). New York clearly has a significant interest in the health of its citizens, and the scope and enforceability of this legislation is particularly a matter of this State’s interest and concern.
New York’s interests extend well beyond the context of a compensation proceeding. Plaintiff, who knew that he had tested positive for HIV, sought treatment while in New York. The strong confidentiality protections of the New York statute are intended specifically to encourage such treatment.
Ill
Supreme Court properly determined that plaintiff has the right to maintain a private cause of action against his physician for a disclosure of confidential HIV-related information in violation of Public Health Law article 27-F (see, Matter of V. v State of New York, 150 Misc 2d 156; Nolley v County of Erie, 776 F Supp 715, both concluding that a private cause of action may be maintained for a violation of the confidentiality provisions of Public Health Law § 2782).
Public Health Law § 2783, which authorizes the imposition of criminal and civil penalties for certain violations of article 27-F, contains no express provision authorizing a private cause of action as a remedy for a disclosure made in violation of article 27-F, and specifically section 2782. Defendant contends that the existence of a private cause of action to remedy a violation of article 27-F may not be implied, principally because the Legislature’s provision of remedies in the nature of a criminal sanction and a civil penalty and its failure to include additional remedies indicate an intent to limit the remedies to those expressed. We disagree.
The language of subdivision (3) of section 2783 reveals that the Legislature acknowledged a private cause of action to remedy violations of article 27-F. Subdivision (3) of section 2783 provides:
"There shall be no criminal sanction or civil liability on the part of, and no cause of action for damages shall arise against any physician or his or her employer, or health facility or health care provider with which the physician is associated, or public health officer, solely on account of * * *
"(c) the disclosure of confidential HIV related information to any person, agency, or officer authorized to receive such information, when carried out in good faith and without *471malice, and in compliance with the provisions of this article” (emphasis added).
That grant of immunity has meaning only if a cause of action for damages exists for a violation of article 27-F. Further, the Bill Jacket regarding enactment of article 27-F indicates that the Legislature intended to create a private cause of action to remedy violations of that article (see, letter to Governor Cuomo from Senator Ohrenstein, Aug. 31, 1988; letter to Evan Davis, then Counsel to Governor Cuomo, from Assemblyman Gottfried, Sept. 1, 1988).
We further conclude that a private cause of action may fairly be implied from that legislation. In ascertaining whether a private action may be implied, the essential factors are: "(1) whether the plaintiff is one of the class for whose particular benefit the statute was enacted; (2) whether recognition of a private right of action would promote the legislative purpose; and (3) whether creation of such a right would be consistent with the legislative scheme” (Sheehy v Big Flats Community Day, 73 NY2d 629, 633). Plaintiff, as a patient infected with HIV, is a " '[protected individual’ ” within the meaning of Public Health Law § 2780 (6), and thus is a member of the class for whose particular benefit the statute was enacted. Recognition of a private cause of action against those who disclose confidential HIV-related information would promote the legislative purpose of ensuring the confidentiality of that information and would not be inconsistent with the legislative scheme. A common-law cause of action exists for a physician’s breach of confidentiality (see, MacDonald v Clinger, 84 AD2d 482). Thus, a private cause of action for a disclosure in violation of Public Health Law § 2782 would be consistent with the common law (cf., Sheehy v Big Flats Community Day, supra, at 636); it would merely provide an additional enforcement mechanism at the hands of those persons affected by a violation of that law and those whom the Legislature has deemed in need of protection.
IV
Defendant’s disclosure of plaintiff’s HIV status violated the confidentiality provisions of Public Health Law article 27-F.
Public Health Law § 2782, to the extent relevant in this case, provides that:
"1. No person who obtains confidential HIV related informa*472tion in the course of providing any health or social service * * * may disclose or be compelled to disclose such information, except to the following * * *
"(b) any person to whom disclosure is authorized pursuant to a release of confidential HIV related information * * *
"(j) an insurance institution, for other than the purpose set forth in paragraph (i) of this subdivision, provided the insurance institution secures a dated and written authorization that indicates that health care providers, health facilities, insurance institutions, and other persons are authorized to disclose information about the protected individual, the nature of the information to be disclosed, the purposes for which the information is to be disclosed and which is signed by: (1) the protected individual”.
We agree with Supreme Court that the subject authorizations did not constitute a " '[r]elease of confidential HIV related information’ ” (Public Health Law §2780 [9]), and, thus, that disclosure was not authorized pursuant to paragraph (b) of section 2782 (1) of that law. Such a release must be "dated and shall specify to whom disclosure is authorized, the purpose for such disclosure and the time period during which the release is to be effective” (Public Health Law § 2780 [9]). The subject authorizations were not dated1 and did not reveal the time period during which the release would be effective. Further, the authorizations were not prepared on a form developed or approved by the Commissioner of Health (see, 10 NYCRR 63.10 [b]).
Although paragraph (j) of section 2782 (1) permits a protected person to authorize the disclosure of HIV-related information to an "insurance institution”, the subject disclosure was made to the attorney for plaintiff’s employer. Mindful that "exceptions to the general rule of confidentiality of HIV related information [must] be strictly construed” (L 1988, ch 584, § 1), there is no stretch of the imagination or reasonable interpretation of statutory language that could conceivably bring that attorney within the statutory definition of "insur*473anee institution”.2 Moreover, the authorizations signed by plaintiff permitted the release of information regarding plaintiff’s medical condition to representatives of plaintiff’s employer. With respect to compensation benefits, the employer was not self-insured; the employer was insured by North River Insurance Company. Although the language of the authorizations could be construed to include the employer’s insurer, there is no evidence that the attorney to whom disclosure was made had been retained by, or was acting on behalf of, the insurer.
It was unnecessary, therefore, for Supreme Court to consider whether the Pennsylvania workmen’s compensation "system” was an insurance institution. In any event, it is not conceivable that an entire "system” for determining an employee’s entitlement to statutory benefits could constitute an "entity” within the plain meaning and context of Public Health Law § 2780 (16).
Supreme Court also erred in concluding that the authorizations signed by plaintiff facially complied with the statutory exception permitting disclosure to an insurance institution (Public Health Law § 2782 [1] [j]). That exception requires an authorization to reveal the persons authorized to disclose the information, the nature of the information to be disclosed and the purposes for which the information is to be disclosed. The authorization must be dated and signed by the protected individual. Here, neither authorization states the nature of the information to be disclosed and neither authorization is dated. An authorization to release "medical records” does not suffice to state the nature of information which is to be released.
In sum, neither authorization signed by plaintiff was sufficient to permit disclosure under any of the listed exceptions to confidentiality contained in Public Health Law § 2782. We also conclude that a plain reading of the "medical report” form and that authorization segment should have indicated to defendant that the authorization was for the preparation of a *474report and the release of medical records by the physician who prepared each medical report. Neither authorization conveyed the impression that it was open-ended and permitted the release of medical records by any physician who might have treated plaintiff years after the medical report form was completed.
Further, the subpoena that defendant relies upon as authority for her disclosure did not authorize the disclosure of plaintiff’s HIV status. No disclosure of confidential HIV-related information may be made pursuant to a subpoena (10 NYCRR 63.5 [k]). That subpoena had no compulsory effect upon defendant outside Pennsylvania (see, Pa Rules Civil Pro 234.2 [b]; Wallace v United Elec. Co., 211 Pa 473, 60 A 1046; Pennsylvania Liq. Control Bd. v Abraham, 116 Pa Commw 270, 541 A2d 1161; Damron v Pennsylvania Bd. of Probation & Parole, 109 Pa Commw 554, 557, 531 A2d 592, 593; see also, Wiseman v American Motors Sales Corp., 103 AD2d 230, 234), and, assuming that it did have any effect, the subpoena directed defendant to bring the medical records with her to the hearing; the subpoena did not direct defendant to deliver the documents to the employer’s attorney.
Lastly, subdivision (5) of section 2782 provides that, whenever disclosure of confidential HIV-related information is made (except for certain circumstances not pertinent here), that disclosure must be accompanied or followed by a written statement prohibiting redisclosure in language substantially similar to that set forth in the subdivision (see also, 10 NYCRR 63.4 [b]). Defendant’s disclosure did not contain a statement prohibiting redisclosure. Thus, we agree that plaintiff was entitled to partial summary judgment on that cause of action asserting a violation of Public Health Law § 2782.
V
We hold that punitive damages may be allowed in a private action for a violation of Public Health Law article 27-F, and specifically, section 2782. We also conclude that Supreme Court erred by granting summary judgment dismissing plaintiff’s request for punitive damages at this stage of the litigation. Although article 27-F does not expressly authorize an award of punitive damages for an improper disclosure of confidential HIV-related information, an award of such damages is consistent with the legislative scheme and intent.
Punitive damages are recoverable in common-law actions *475for breach of confidentiality or breach of fiduciary duty provided that the defendant’s conduct is sufficiently blameworthy (see, Doe v Roe, 93 Misc 2d 201, 216-217), and the HIV/AIDS confidentiality laws of three States expressly authorize the recovery of punitive damages (see, Mo Rev Stat § 191.656 [6] [2] [b] [1991]; Okla Stat Annot, tit 63, § 1-502.2 [H] [1992]; Wis Stat § 146.025 [8] [a] [1991-1992]). Further, we are persuaded that the availability of punitive damages advances the New York Legislature’s strong public policy protecting the confidentiality of a patient’s HIV status and its condemnation of a breach of a physician’s duty to protect confidentiality.
Although article 27-F provides a criminal sanction and civil penalty for a violation of Public Health Law § 2782 (see, Public Health Law § 2783 [1], [2]), New York allows for the recovery of punitive damages for the violation of duties created by statute despite the availability of criminal and civil sanctions for those violations (see, e.g., Minjak Co. v Randolph, 140 AD2d 245, 249; Kipsborough Realty Corp. v Goldbetter, 81 Misc 2d 1054, 1059). Moreover, we do not perceive any indication in legislative history or the statutory framework that those sanctions were intended to be the exclusive remedies for an improper disclosure of confidential HIV-related information.
The trial court has the initial responsibility to determine whether punitive damages are recoverable in a particular case. If there is a reasonable basis for an award of punitive damages, however, whether such damages should be awarded and the amount of such award are issues for the jury (see generally, 36 NY Jur 2d, Damages, § 173). As a general proposition, punitive damages may be imposed only where it is shown that the defendant’s conduct was so reckless or grossly negligent that it amounted to a conscious disregard of another’s rights (see, Home Ins. Co. v American Home Prods. Corp., 75 NY2d 196, 201; Rinaldo v Mashayekhi, 185 AD2d 435, 436; Smith v Fitzsimmons, 180 AD2d 177, 181). Supreme Court determined that, as a matter of law, defendant’s conduct, though "perhaps ’thoughtless’ ”, did not "rise to the level of culpability required for the imposition of punitive damages”. That was error.
Defendant moved for summary judgment dismissing the request for punitive damages. As the movant, it was defendant’s burden to submit materials in evidentiary form sufficient to negate the existence of all triable issues of fact so conclusively that she was entitled to judgment as a matter of
*476law (see, Alvarez v Prospect Hosp., 68 NY2d 320, 324; Barrette v General Elec. Co., 144 AD2d 983). Defendant submitted no material in evidentiary form suggesting a good-faith basis for her improper disclosure of HIV-related information. Although defendant contends that she did no more than respond to a subpoena, that is not the case. The subpoena directed defendant to appear in Pennsylvania for a hearing and to bring plaintiff’s medical records with her. Defendant did not appear at the hearing. Instead, she disclosed confidential HIV-related information to the attorney representing plaintiff’s employer. Further, as previously discussed, disclosure of such information pursuant to a subpoena is prohibited, and the subpoena issued by the Referee in Pennsylvania had no compulsory effect upon defendant in New York. Compliance with that subpoena was voluntary, and it could have been ignored with impunity (see generally, Siegel, Practice Commentaries, McKinney’s Cons Laws of NY, Book 7B, CPLR C2303:6, at 266). Moreover, the inference could be drawn that defendant forwarded the confidential information to the employer’s attorney to avoid the inconvenience of appearing at the hearing in Pennsylvania. Likewise, there was no reasonable basis for reliance upon previous authorizations signed by plaintiff. As previously noted, those authorizations did not authorize defendant to disclose plaintiff’s HIV condition. Further, defendant should have understood that the authorizations, signed two years prior to her express promise to preserve the confidentiality of plaintiff’s HIV status, were no longer applicable. In any event, the authorizations were insufficient to allow disclosure pursuant to Public Health Law § 2782.
In sum, defendant failed to satisfy her initial burden of negating relevant factual issues regarding punitive damages. Plaintiff’s request for punitive damages should be reinstated.
VI
" 'There can be little doubt that under the law of the State of New York and in a proper case, the contract of private parties to retain in confidence matter which should be kept in confidence will be enforced by injunction and compensated in damages’ ” (MacDonald v Clinger, 84 AD2d 482, 486, supra, quoting Doe v Roe, 93 Misc 2d 201, 210-211, supra). Supreme Court determined that there was no enforceable contract to maintain confidentiality because plaintiff had a pre-existing duty to disclose his HIV status to his doctor, and *477thus, that there was no legal consideration to support the doctor’s promise of confidentiality. We disagree.
Defendant’s alleged oral promise to preserve the confidentiality of plaintiffs disclosure of his HIV status was not an independent promise arising outside of the physician-patient relationship. Plaintiff alleges that he voluntarily disclosed his HIV status because he thought it might be essential to a proper and safe treatment of his ear and sinus condition. That disclosure arose out of the physician-patient relationship and was an inherent part of that relationship. It was not extrinsic to, or separate from, the relationship. Thus, no independent or separate consideration was required to support the alleged promise of confidentiality. Plaintiffs submission to treatment and implicit agreement to pay for defendant’s services constituted the legal consideration for defendant’s alleged oral promise.
Defendant nevertheless contends that a separate cause of action sounding in contract should not be recognized in this instance because the alleged oral promise of confidentiality was coextensive with the implied covenant to preserve confidentiality inherent in the physician-patient relationship (see, MacDonald v Clinger, supra, at 486-488). In MacDonald, however, we dismissed a cause of action for breach of an implied contract, not breach of an express contract. The fact that plaintiff may have more comprehensive remedies in tort than in contract does not constitute a sufficient basis to disallow his cause of action for breach of an express promise to preserve confidentiality. We conclude, therefore, a cause of action may be asserted for breach of an express promise to preserve the confidentiality of a patient’s medical condition (see, Noel v Proud, 189 Kan 6, 367 P2d 61; cf., Werner v Kliewer, 238 Kan 289, 710 P2d 1250).
Supreme Court determined that, by commencing the workmen’s compensation proceeding in Pennsylvania, plaintiff waived his right to challenge defendant’s breach of her implied covenant to preserve confidentiality. Although plaintiff has not challenged that determination on appeal, we note that defendant failed to demonstrate factually that commencement of the compensation proceeding placed plaintiffs HIV status in issue. Thus, defendant was not entitled to summary judgment dismissing the oral contract cause of action.
Accordingly, the order should be modified to reinstate the cause of action for breach of an oral promise to preserve *478confidentiality and the request for punitive damages and, as modified, the order should be affirmed.
Denman, P. J., Green, Fallon and Davis, JJ., concur.
Order unanimously modified, on the law, and as modified, affirmed, with costs to plaintiff in accordance with the opinion by Balio, J.
. Supreme Court erroneously determined that the authorizations signed by plaintiff were dated. Neither authorization was dated. Each authorization appears as a one-paragraph segment separated by solid lines on a full-page document entitled "medical report”. Although the blocked segment appearing at the top of the sheet and authorizing a medical appointment was signed and dated by plaintiff’s employer and the blocked segment appearing at the bottom of the sheet and containing the physician’s diagnosis and treatment was signed and dated by the physician, the separate segment containing plaintiff’s authorization was not dated.
. Public Health Law § 2780 (16) defines an " '[insurance institution’ ” as: "any corporation, association, partnership, reciprocal exchange, interinsurer, fraternal benefits society, agent, broker or other entity including, but not limited to, any health maintenance organization, medical service plan, or hospital plan which: (a) is engaged in the business of insurance; (b) provides health services coverage plans; or (c) provides benefits under, administers, or provides services for, an employee welfare benefit plan as defined in 29 U.S.C. 1002(1).”