A new state privacy law passed by legislators is awaiting the signature of New York State’s governor and promises to make the processing and sharing of a broad range of health information by a wide array of organizations much more complicated and restrictive, said regulatory attorney Angie Matney, who explains why.
The New York Health Information Privacy Act, or HIPA, was passed by the state’s legislature in January. Governor Kathy Hochul has not yet signed the bill into law, and it could still undergo changes before that potentially happens, Matney said.
But the law, as it is written now, could pose serious operational and other challenges for organizations that must comply, she said in an interview with Information Security Media Group.
“If you process any information that is even tangentially related to health status or to a health condition and you are located in New York, or you have a contractor that’s processing your data in New York, or have some kind of nexus with the state of New York, then you may be subject to this law,” she said.
“There’s no size, thresholds or anything like that. So, I think a lot of companies may not initially know that they are subject to it,” she said.
Regulated information that falls under the law is broadly defined, she said. “It’s any information that’s reasonably linkable to an individual or a device that’s collected or processed in connection with the physical or mental health of an individual,” she said.
“The bucket of information could include things like your purchase history or even notifications that you might make if you’re dining at your favorite restaurant, and you let them know that you have an allergy to a particular ingredient – things like that,” she said.
“Additionally, there are fewer exemptions than we typically see in these types of laws, and a big one is that this law does not expressly exempt employment-related information,” she said. “So information that could be on a job application or information that you might need a disability accommodation, or things like that, are not exempt from coverage under this law.”
In this audio interview with Information Security Media Group (see audio link below the image), Matney also discussed:
- How the proposed law potentially affects organizations located in New York state, residents of New York state, as well as non-residents who are physically present in the state;
- Why the proposed law doesn’t just cover the sale of regulated health information in the exchange of money but also in exchange for other valuable considerations;
- How the proposed New York state law compares and contrasts with other state health information privacy laws, such as Washington state’s My Health My Data law, as well as federal regulations such as HIPAA and the Federal Trade Commission’s Health Breach Notification Rule;
- Potential penalties for violations under the proposed New York state law.
Hochul’s office did not immediately respond to ISMG’s request for comment on whether the governor plans to sign the bill into law, or when.
Matney, a counsel at law firm Reed Smith and a certified information privacy professional with the International Association of Privacy Professionals, advises clients across a wide range of industries, including healthcare and pharmaceutical. Matney has extensive experience advising clients on compliance with federal and state health privacy laws, including HIPAA, FTC guidance, the Washington My Health My Data Act, and state general and biometric privacy laws.