ALBANY, NY- The New York State Legislature has recently passed the New York Health Information Privacy Act (NYHIPA), aiming to enhance the protection of personal health information collected online. The legislation is now awaiting Governor Kathy Hochul’s decision to either sign it into law or veto it.
Key Provisions of NYHIPA:
- Scope of Regulated Health Information: The act defines “regulated health information” broadly, encompassing data related to an individual’s physical or mental health, payment details, and location data linked to health services. This includes information collected by apps, websites, and wearable devices.
- Consent Requirements: Entities are prohibited from collecting, using, or selling an individual’s health information without obtaining explicit written consent. This measure targets data brokers and trackers that often handle such data without user awareness.
- Enforcement and Penalties: The New York Attorney General is empowered to enforce the law, with penalties for violations reaching up to $15,000 per incident or 20% of the entity’s annual revenue derived from New York consumers, whichever is greater.
If enacted, NYHIPA will impose stringent compliance requirements on digital health companies operating in or serving residents of New York. These entities will need to reassess their data collection and processing practices to ensure they align with the new consent and usage regulations. The law’s broad definitions mean that even organizations not traditionally considered healthcare providers could be affected if they handle health-related data
NYHIPA shares similarities with Washington State’s My Health My Data Act but is noted for its broader scope and stricter provisions. Unlike some state laws, NYHIPA does not exempt certain types of data or entities, potentially leading to wider applicability and more significant impacts on businesses.
Governor Hochul has a set period to review the bill and decide on its enactment. If signed into law, NYHIPA will take effect one year from the date of signing, providing entities time to adjust their practices accordingly. Organizations are advised to begin preparations to comply with the anticipated regulations.
