New York tightened its breach law in 2024 and 2025. Practices now have a hard 30-day deadline to notify New Yorkers, medical and health insurance information is covered, and every breach reported to HHS also triggers notice to the New York attorney general.
AT A GLANCE
| Laws | General Business Law § 899-aa (breach notification, amended December 2024 and 2025); SHIELD Act security requirements, § 899-bb; hospital cybersecurity rule, 10 NYCRR 405.46 |
|---|---|
| Data covered | Includes medical information and health insurance information since March 21, 2025 |
| Notice to individuals | In the most expedient time possible, and no later than 30 days after discovery |
| State agencies | If any New York resident is notified, also notify the attorney general, the Department of State and the State Police |
| HIPAA entities | A HIPAA notice to patients satisfies individual notice. A covered entity that reports a breach to HHS must also notify the attorney general within five business days |
| Security rule | The SHIELD Act requires reasonable safeguards. Entities that comply with HIPAA are deemed compliant with it |
| Penalties | For knowing or reckless violations, the greater of $5,000 or up to $20 per failed notification, capped at $250,000. No private right of action |
02
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
No later than 30 days after discovering a breach, in the most expedient time possible.
The attorney general, the Department of State and the State Police. HIPAA entities that report to HHS must notify the attorney general within five business days.
10 NYCRR 405.46 applies to general hospitals, not independent medical or dental offices, though hospital partners may require similar controls by contract.
Sources: N.Y. GBL 899-aa (FindLaw) · Ogletree: New York amendments · NY DOH: hospital cybersecurity. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Start with the free HIPAA risk assessment, or talk to an analyst.
