New York Healthcare Compliance.
New York's overlay is two related but separate obligations. Gen. Bus. Law § 899-aa requires breach notice to affected residents and to a triple-track regulator path (Attorney General, Department of State, State Police). The SHIELD Act (§ 899-bb) layers on a standing reasonable-security duty that applies whether or not an incident has occurred and that extends to any entity holding private information of NY residents, regardless of where the entity sits. Practices in New York meet HIPAA plus the SHIELD security program and the § 899-aa notice clock.
At a glance
30days
New York Gen. Bus. Law § 899-aa requires notice to affected NY residents in the most expedient time possible and without unreasonable delay (typically interpreted as 30 days from determination), plus simultaneous notice to the Attorney General, Department of State, and State Police. The SHIELD Act at § 899-bb is a separate, standing reasonable-security obligation. Note: 23 NYCRR 500 (NYDFS Cybersecurity Regulation) covers DFS-licensed entities — generally not clinical providers, but health insurers, third-party administrators, and certain self-funded plans may fall under it.
New York Attorney General + Department of State + State Police
- New York Information Security Breach and Notification ActN.Y. Gen. Bus. Law § 899-aa
Breach notice to affected NY residents and to the AG, Department of State, and State Police. Trigger covers unauthorized acquisition AND, post-SHIELD, unauthorized access of computerized private information.
- Stop Hacks and Improve Electronic Data Security (SHIELD) ActN.Y. Gen. Bus. Law § 899-bb
Standing reasonable-security obligation for any person or business that owns or licenses computerized data including private information of NY residents — administrative, technical, and physical safeguards. Applies whether or not an incident has occurred.
- NYDFS Cybersecurity Regulation23 NYCRR 500
Applies to entities licensed by the NY Department of Financial Services. Most clinical providers are not covered; some health insurers, third-party administrators, and self-funded plans are.
- HIPAA Privacy, Security, and Breach Notification Rules45 CFR Parts 160 & 164
The federal baseline that all U.S. covered entities and business associates meet. HHS Office for Civil Rights (OCR) enforces.
How New York goes further than HIPAA.
The breach window in New York is 30 days — shorter than HIPAA’s federal 60-day individual-notice deadline. Practices serving New York residents need a breach playbook tuned to the state clock, not the federal one. Notice flows through New York Attorney General + Department of State + State Police in addition to HHS/OCR federally.
Related compliance guides
Turn this overlay into a defensible SRA.
New York's overlay layers on top of HIPAA's federal floor. The free SRA readiness check walks a small practice through discovery, threat model, controls, and gap analysis, then assembles the review-ready binder — policies, training logs, BAAs, and a breach playbook tuned to the 30-day clock and the New York Attorney General + Department of State + State Police notification path.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- ComplianceNew York SHIELD Act for Medical Practices: The Reasonable Safeguards StandardNY SHIELD Act (Gen. Bus. Law § 899-bb) vs HIPAA for medical practices: reasonable safeguards, expanded breach scope under § 899-aa, 30-day notice outer bound, $250k AG penalty exposure.
- ComplianceHIPAA Breach Notification: The 60-Day Window Step-by-StepFrom discovery you have 60 calendar days to notify individuals, HHS, and possibly media. Here is the procedure that actually protects the practice.
- ComplianceSecurity Risk Analysis Template (2026): What Auditors Actually WantA 2026 HIPAA Security Risk Analysis template auditors actually read: NIST SP 800-30 scoring, ePHI asset inventory, every required 164.308 field, threat list.
- RegulationCalifornia Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code 56-56.37)California state law providing broader patient confidentiality protections than HIPAA for medical information held by providers, contractors, and certain employers.
- RegulationColorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.)Colorado comprehensive consumer privacy law with consumer rights, controller/processor obligations, universal opt-out mechanism requirement, and an AG enforcement framework with HIPAA carve-outs.
- RegulationConnecticut Data Privacy Act (CTDPA, Public Act 22-15)Connecticut comprehensive consumer data privacy law with consumer rights, controller/processor obligations, and an AG enforcement framework — with substantial healthcare carve-outs.
- RegulationFlorida Information Protection Act (FIPA, Fla. Stat. § 501.171)Florida data breach notification and information security law requiring covered entities to maintain reasonable security and to notify affected individuals and the AG of breaches within 30 days.
- RegulationIllinois Biometric Information Privacy Act (BIPA, 740 ILCS 14)Illinois state law regulating the collection, retention, use, and destruction of biometric identifiers, with a private right of action and statutory damages per violation.
Last reviewed May 23, 2026.
This page is a research aid for compliance teams. It does not certify compliance with any state or federal law, provide legal advice, replace counsel, or guarantee an audit outcome. State statutes are amended frequently — verify citations and links against the cited primary sources before acting. The practice remains responsible for adopting and maintaining its compliance program.