Bill > A10357

This bill establishes the New York Health Information Privacy Act, which aims to protect individuals' health information by requiring that any "regulated health information" – broadly defined as information linkable to an identifiable person and related to their physical or mental health status – can only be processed with either the individual's explicit written consent or for a strictly necessary, legally defined purpose. The bill mandates that communications about health information must be in plain language and accessible, and it prohibits the sale of regulated health information. It also grants individuals rights to access and delete their health information, requires regulated entities to implement security safeguards, and establishes rules for service providers who handle this data. The Attorney General is empowered to enforce these provisions with civil penalties, and any contracts or waivers that contradict this act are deemed void. The act includes various exemptions, such as for information already protected by federal laws like HIPAA, and will take effect six months after becoming law.

Business and Industry

https://www.nysenate.gov/legislation/bills/2025/A10357