Bill > S00158

This bill amends the general business law to establish the New York Health Information Privacy Act, which provides for the protection of health information. The key provisions include: 1. Defining regulated health information and the entities that process it (regulated entities and service providers). 2. Prohibiting the sale of an individual's regulated health information to third parties, and requiring either written consent or a designated necessary purpose for the processing of an individual's regulated health information. 3. Establishing requirements for communications to individuals about their health information, including using plain language, accessibility for individuals with disabilities, and availability in the languages used by the regulated entity. 4. Granting individuals the rights to access and request deletion of their regulated health information. 5. Requiring regulated entities and service providers to implement reasonable security safeguards and have written agreements governing the processing of regulated health information. 6. Providing for enforcement by the state Attorney General, including the ability to seek injunctions, restitution, disgorgement of profits, and civil penalties.

Business and Industry, Health and Social Services, Housing and Urban Affairs

https://www.nysenate.gov/legislation/bills/2023/S158