New York healthcare providers follow two compliance frameworks: federal HIPAA and state laws. The state laws go further in several important areas. The NY SHIELD Act, Public Health Law §18, the Mental Hygiene Law, and the statewide SHIN-NY health information network each add duties that a HIPAA-only checklist can miss.
This guide breaks down each layer so you can build a program that satisfies both.
Key Takeaways
- New York providers answer to two layers of law: federal HIPAA sets the floor and state law stacks on top of it. Wherever state law is stricter, the stricter standard controls.
- The NY SHIELD Act applies to any business that owns or licenses computerized data with private information about New York residents. Location does not control, so out-of-state telehealth providers treating New York patients are covered.
- If a HIPAA-covered entity reports a breach to HHS, it must also notify the New York Attorney General. The deadline is 5 business days after the HHS notice. This applies to every breach reported to HHS, not only large ones.
- Public Health Law Section 18 governs patient access to records, the Mental Hygiene Law adds stricter protections for mental health records, and Public Health Law Article 27-F imposes strict confidentiality rules on HIV-related information.
- A HIPAA-only checklist misses these state duties. A New York compliance program has to document both sets of requirements.
Federal HIPAA in New York: The Baseline
HIPAA (Health Insurance Portability and Accountability Act) sets the federal floor for protected health information (PHI) across all 50 states. In New York, that floor covers the same three rules it does everywhere else:
- Privacy Rule (45 CFR Part 164, Subpart E): Controls how covered entities and business associates use and disclose PHI.
- Security Rule (45 CFR Part 164, Subpart C): Requires administrative, physical, and technical safeguards for electronic PHI (ePHI).
- Breach Notification Rule (45 CFR Part 164, Subpart D): Requires you to notify affected people without unreasonable delay, and no later than 60 days after you discover a breach. For breaches affecting 500 or more people, HHS gets notice on the same timeline. Smaller breaches go in a log. You send that log to HHS within 60 days after the end of each calendar year.
New York state law does not replace these requirements. It stacks on top of them. Wherever state law is stricter than HIPAA, the stricter standard controls.
New York State Privacy Laws That Apply to Healthcare
Four state laws create the most significant HIPAA overlap for New York providers. Each one is addressed below.
New York SHIELD Act (2019)
The Stop Hacks and Improve Electronic Data Security (SHIELD) Act became law on July 25, 2019. Its data security rules took effect March 21, 2020. It made two major changes relevant to healthcare:
- Expanded scope: Any business that owns or licenses computerized data containing private information of New York residents must comply, regardless of where the business is physically located. An out-of-state telehealth platform treating NY patients is subject to the SHIELD Act.
- Expanded definition of “private information”: The SHIELD Act added two types of information that trigger breach notice. One is biometric data. The other is account logins (a username or email address plus a password or security questions). A later amendment added medical information and health insurance information. So much of the PHI a practice holds now counts as private information under New York law.
For HIPAA-covered entities, the SHIELD Act adds one key duty. If you report a breach to HHS, you must also notify the New York Attorney General within 5 business days. The clock starts when you send the HHS notice, not when you find the breach. This applies to every breach you report to HHS. That includes small ones listed in the yearly log.
The SHIELD Act also requires covered businesses to maintain a “reasonable security program.” This program must include documented administrative, technical, and physical safeguards. HIPAA compliance generally satisfies this rule, but the documentation must exist. A policy binder in a drawer is not enough. You need proof that the safeguards are in use.
New York Public Health Law §18: Patient Record Rights
Public Health Law §18 governs patient access to medical records in New York. Key differences from HIPAA:
- Access timeline: Providers must let the patient look at their records within 10 days of a written request. Copies must go out within a reasonable time. (HIPAA allows 30 days, with one 30-day extension.)
- Permitted fees: Providers may charge a reasonable fee for copies. Paper copies cannot cost more than 75 cents per page. A patient cannot be denied access just because they cannot pay.
- Mental health carve-out: Records covered by Mental Hygiene Law sections 23.05 or 33.13 do not fall under §18. They follow their own access rules (see below).
The 10-day inspection window is the most operationally significant difference. Front desk staff and health information teams need a workflow that can meet both the federal and state deadlines without treating them as the same number.
New York Mental Hygiene Law: Mental Health Record Protections
New York’s Mental Hygiene Law applies to patient records kept by facilities that the state Office of Mental Health or the Office for People With Developmental Disabilities licenses or runs. Substance use disorder records have their own federal rule, 42 CFR Part 2. The protections are significantly more restrictive than HIPAA:
- Sharing records outside the program generally requires explicit written patient consent. The law lists a few exceptions. One allows limited sharing to coordinate care.
- HIPAA’s treatment, payment, and healthcare operations (TPO) exception does not automatically apply under state law. Do not assume a mental health provider can share records with a referring physician simply because both are treating the same patient.
- Emergencies that justify disclosure without consent are narrowly defined by statute and do not map cleanly onto HIPAA’s emergency exception.
Providers in behavioral health, psychiatry, addiction medicine, and integrated care settings must train staff on both frameworks and maintain separate authorization workflows for mental health records. Routine HIPAA disclosures that are legally permissible for medical records may be unlawful for mental health records under state law.
New York HIV/AIDS Confidentiality Law
New York Public Health Law Article 27-F imposes strict confidentiality requirements on HIV-related information, far stricter than HIPAA’s general PHI protections. Key rules:
- HIV-related information generally needs written authorization before it can be shared. The law lists some exceptions.
- The authorization cannot be a general medical release. It must specifically reference HIV-related information.
- One exception: a provider may share it with another health care provider who needs it to give the patient appropriate care or treatment.
- Violations can lead to fines (civil penalties).
New York City providers in particular encounter this law frequently given the patient populations served. Electronic health record systems should flag HIV-related records. That way staff check for an authorization or an exception before sharing them.
SHIN-NY: The Statewide Health Information Network for New York
SHIN-NY (Statewide Health Information Network for New York) is the state’s health information exchange infrastructure. Providers who participate in SHIN-NY (which includes most hospitals, many large practices, and a growing number of community health centers) take on additional obligations:
- Participation agreements: Providers must execute a SHIN-NY participation agreement that incorporates state data governance policies governing how ePHI moves through the network.
- Patient consent requirements: SHIN-NY uses a consent model that differs from HIPAA’s notice-based approach. Some data sharing through the network requires affirmative patient consent, not just an opportunity to opt out.
- Audit obligations: SHIN-NY participation agreements typically require that providers maintain access logs and submit to periodic audits of their data access practices.
Compliance officers at SHIN-NY-participating organizations manage three cybersecurity and privacy layers: federal HIPAA, the NY SHIELD Act, and SHIN-NY data rules. Each layer has different documentation rules, breach timelines, and enforcement paths.
New York SHIELD Act vs. HIPAA: Key Differences
The table below summarizes the most operationally significant differences between federal HIPAA and the NY SHIELD Act for healthcare organizations:
| Requirement | HIPAA | NY SHIELD Act |
|---|---|---|
| Who is covered | Covered entities and business associates in healthcare | Any business holding private information of NY residents |
| Breach notification to individuals | Without unreasonable delay, no later than 60 days after discovery | As fast as possible, and no later than 30 days after discovery (a HIPAA notice to the same people counts) |
| Breach notification to state AG | Not required separately | Within 5 business days of notifying HHS (any breach reported to HHS) |
| Security program requirement | Risk-based safeguards documented in policies | Documented “reasonable security program” (HIPAA compliance satisfies this) |
| Definition of protected data | PHI (health information linked to an individual) | Broader: includes biometric data, credentials, medical and health insurance information |
| Enforcement authority | HHS Office for Civil Rights (OCR) | New York Attorney General |
New York Breach Notification Requirements
New York healthcare providers face a multi-step breach notification process. Several steps run at the same time. Missing any step creates its own legal risk.
SHIELD Act: 5-Business-Day AG Notice After HHS Notification
If you report a breach to HHS, the NY SHIELD Act requires you to notify the NY Attorney General within 5 business days after the HHS notice. This applies to any breach you report to HHS, not only large ones. There is a second state notice too. When you notify New York residents of a breach, you must also tell the Attorney General, the Department of State, and the State Police. The Department of Financial Services also gets notice when it applies. That notice covers:
- When and how you sent notices to affected people, and what they said
- About how many people were affected
- A copy of the template (sample) notice you sent to affected people
This 5-business-day window is short. Your breach response plan must address the AG notice step. It cannot cover only HHS and individual notice.
Individual Notification Requirements
Individual notice under the SHIELD Act follows a standard similar to HIPAA. Notice must be provided “in the most expedient time possible and without unreasonable delay.” In plain terms, that means as fast as you can. Current New York law adds a hard limit: no later than 30 days after the breach is discovered.
If you notify people under HIPAA, New York does not require a second notice to those same people. You still owe the state notices described above. New York’s limit is shorter than HIPAA’s 60 days, so plan around 30 days. Under New York law, you can give notice by:
- Written notice to the affected person
- Electronic notice, if the person has expressly agreed to get notices that way. Keep a log of each notice.
- Telephone notice, if you keep a log of each call
- Substitute notice, which means email notice, a clear posting on your website, and notice to major statewide media. You can use it when notice would cost more than $250,000, more than 500,000 people are affected, or you lack enough contact information.
Timing: Aligning Federal and State Deadlines
A practical New York breach response timeline looks like this:
- Day 0: Breach discovered and confirmed
- Within 72 hours: Internal escalation and preliminary incident report completed
- Within 30 days: Send notices to affected people (New York’s limit; HIPAA allows up to 60 days)
- Within 60 days: File the HHS notice for breaches affecting 500 or more people. Smaller breaches go in the yearly log, due within 60 days after the end of the calendar year.
- Within 5 business days of HHS notification: NY AG notification filed
- Within 60 days: Notify the media if a breach affects more than 500 residents of a state (federal requirement)
- Ongoing: Keep records of all notifications
HIPAA Penalties in New York (2025)
Federal OCR Enforcement in New York
The HHS Office for Civil Rights enforces HIPAA in New York as it does in every state. Federal penalty tiers range from $145 to $2,190,294 per violation depending on culpability, with a cap of $2,190,294 per year for violations of the same requirement. OCR has brought enforcement actions in New York and elsewhere. Cases have involved:
- Unauthorized disclosures to media organizations filming on hospital premises
- Missing business associate agreements with major health IT vendors
- Failure to provide patients timely access to their medical records under the Patient Access standard
An update to the HIPAA Security Rule was proposed in a Notice of Proposed Rulemaking (NPRM) published in January 2025 and is not final. It would add new rules for multi-factor authentication, encryption of ePHI at rest and in transit, and annual technology asset inventories.
NY AG Privacy Enforcement Authority
The New York Attorney General enforces the SHIELD Act independently of OCR. The AG has broad authority to investigate data breaches and impose civil penalties:
- Up to $5,000 per violation for not keeping reasonable security safeguards (civil penalties under General Business Law §350-d)
- For knowingly or recklessly skipping a required breach notice: $5,000, or up to $20 per failed notification if that is more. The per-notice total is capped at $250,000.
- Court orders (injunctions) that make you stop the violation
The AG has shown a willingness to pursue healthcare organizations and technology companies. Review any breach affecting NY residents for SHIELD Act duties. Do this even if you do not expect an OCR investigation.
HIPAA Compliance for New York Healthcare Providers
While the compliance framework is the same across provider types, certain New York provider categories face additional considerations.
NYC Hospitals and Health Systems (NYC Health + Hospitals)
New York City’s public hospital system, NYC Health + Hospitals, is the largest municipal health system in the United States. As a covered entity, it operates under HIPAA, the SHIELD Act, and SHIN-NY at the same time. Large New York health systems often have dedicated Privacy Officers, Security Officers, breach response teams, and annual third-party risk assessments. Smaller independent hospitals may not. If you are a vendor or business associate serving NYC-area hospitals, expect BAA terms that reference SHIN-NY data rules along with standard HIPAA language.
New York Dental Practices
Dental practices in New York are covered entities under HIPAA. They are also subject to the SHIELD Act if they hold electronic patient data, which most modern practices do. Common gaps include missing or outdated BAAs with dental software vendors, weak encryption on practice systems, and missing or outdated risk assessments. New York dental practices that treat patients with HIV or mental health conditions also need separate authorization workflows for those records.
New York Mental Health and Substance Abuse Providers
Behavioral health providers in New York face a complex compliance setting. They may need to satisfy HIPAA Privacy and Security Rules, New York Mental Hygiene Law, 42 CFR Part 2, and SHIN-NY data rules. Staff training must cover each framework that applies. EHR systems must apply the most restrictive rule for each record type.
New York Telehealth Providers
Out-of-state telehealth providers that treat New York patients are subject to the NY SHIELD Act, even without a physical office in the state. They must maintain a reasonable security program. They must also notify the NY AG within 5 business days of HHS notice for covered breaches. If a platform stores session recordings, treatment notes, or prescription data for NY patients, counsel should review both HIPAA and NY state law duties.
New York HIPAA Compliance Checklist
- Do a HIPAA security risk assessment. Review it regularly (many practices do this each year). Write down what you find and what you fix.
- Maintain a written SHIELD Act “reasonable security program” with administrative, technical, and physical safeguards
- Execute signed BAAs with all vendors that handle PHI. Review and renew them each year
- Build a breach response plan with an explicit NY AG notification step (5 business days from HHS notification)
- Train staff on both HIPAA and the NY Mental Hygiene Law if treating behavioral health patients
- Maintain separate HIV-specific authorization forms per Public Health Law Article 27-F
- Set up a process so patients can look at their records within 10 days of a written request, as Public Health Law §18 requires
- If participating in SHIN-NY, sign the participation agreement and document consent workflows that differ from HIPAA’s notice-based approach
- Implement MFA and encryption for all ePHI systems (both proposed in the January 2025 Security Rule NPRM, which is not final)
- Maintain annual training records with completion evidence for all workforce members
Frequently Asked Questions
What is the New York SHIELD Act and how does it affect HIPAA-covered entities?
The SHIELD Act (Stop Hacks and Improve Electronic Data Security Act, 2019) expanded New York’s breach notice and data security rules. For HIPAA-covered entities, the key added duties are: (1) notify the NY Attorney General within 5 business days of notifying HHS about a breach, and (2) maintain a documented “reasonable security program” with administrative, technical, and physical safeguards. HIPAA compliance generally satisfies the security program rule. The 5-business-day AG notice timeline is separate. It runs from HHS notice, not breach discovery.
How quickly must New York healthcare providers notify the state AG of a breach?
New York’s SHIELD Act requires healthcare organizations to notify the NY Attorney General within 5 business days of notifying HHS about a breach. This applies to any breach reported to HHS, not only large ones. It is separate from the notices you send to affected patients. Your breach response plan must include the AG notice step clearly.
Are New York mental health records treated differently under state law?
Yes. New York’s Mental Hygiene Law gives extra protection to records at mental health and developmental disability programs that the state licenses or runs. This goes beyond standard HIPAA rules. These records usually cannot be shared outside the program without written patient consent. Narrow emergency exceptions may apply. HIPAA’s treatment, payment, and healthcare operations exception does not apply automatically. Providers treating these groups need separate authorization workflows.
Does the SHIELD Act apply to out-of-state healthcare providers treating New York patients?
Yes. The SHIELD Act applies to any business that owns or licenses computerized data with private information about New York residents. Location does not control. An out-of-state telehealth provider treating NY residents must comply with SHIELD Act rules. That includes maintaining a reasonable security program and notifying the NY AG within 5 business days of any HHS breach notice involving NY residents.
What is SHIN-NY and does it create additional compliance requirements?
SHIN-NY (Statewide Health Information Network for New York) is New York’s statewide health information exchange. Providers that participate in SHIN-NY must sign participation agreements and follow SHIN-NY data rules. Those rules govern how ePHI is shared through the network. Unlike HIPAA’s notice-based approach, some SHIN-NY sharing requires affirmative patient consent. This adds a compliance layer on top of HIPAA and SHIELD Act duties for participating providers.
New York is one of the most demanding states for healthcare privacy compliance. Federal HIPAA sets the floor. The NY SHIELD Act, Mental Hygiene Law, HIV confidentiality law, and SHIN-NY participation rules each add duties that need dedicated policy and training work. The 5-business-day AG notice window is easy to miss. Your breach response plan should address it directly.
One Guy Consulting helps covered entities and business associates build HIPAA programs that account for state-specific rules. Our policy library, risk assessment tools, and compliance platform are built for teams that need to get it right the first time. Book a consultation to discuss your New York compliance duties.
Key stat: New York's SHIELD Act requires any business handling private information of New York residents to implement reasonable data security safeguards, regardless of whether the business is a HIPAA-covered entity. Non-healthcare companies processing health data may face SHIELD Act requirements even when HIPAA does not apply to them.
Sources
- New York SHIELD Act: NY Senate (Gen. Bus. Law §899-AA)
- New York Public Health Law §18: Patient Record Access
- NY Mental Hygiene Law: Record Confidentiality Overview (NY DOH)
- New York HIV/AIDS Confidentiality Law: Article 27-F (NY DOH)
- SHIN-NY: Statewide Health Information Network for New York
- HHS HIPAA Security Rule Overview
- NY Attorney General: Data Breach Protection
Related: State privacy laws vs. HIPAA · California HIPAA requirements · Illinois HIPAA requirements · HIPAA Breach Notification Rule
Need compliance help? One Guy Consulting provides practical HIPAA guidance for covered entities and business associates in New York and nationwide. Book a consultation · HIPAA consulting services
Related Reading:
HIPAA compliance requirements in Florida ·
HIPAA compliance requirements in Texas
HIPAA compliance in other states
State law stacks on top of HIPAA differently in every state. These guides cover the statutes that move the baseline where you operate.