New York Governor Vetoes Restrictive Health Privacy Law

On December 19, 2025, New York Governor Kathy Hochul vetoed the New York Health Information Privacy Act (“NYHIPA”).  While NYHIPA bore similarities to Washington’s My Health My Data Act (“MHMD”) and Nevada’s Health Privacy Law (“SB 370”), it had several provisions that would have raised novel compliance and legal questions.

• Regulated Entities. NYHIPA’s scope would have applied more broadly than other similar laws, including to entities processing regulated health information of an individual who is physically present in New York during the period the individual is located in the state.  It is not clear how such a provision would have applied where companies do not collect precise geolocation in the regular course or do not link such geolocation data with account-level data.

• Regulated Health Information. NYHIPA would have governed “regulated health information” (“RHI”), defined as “any information that is reasonably linkable to an individual, or a device, and is collected or processed in connection with the physical or mental health of an individual.”  In comparison, MHMD and SB 370 are focused on personal information linked or reasonably linkable to a consumer and that identifies the consumer’s health status.  Especially since NYHIPA’s definition lacked any examples of RHI, it was unclear whether and how the scope of the definition was intended to differ than other state laws.

• “Valid Authorization” Requirements. NYHIPA required regulated entities to obtain “valid authorization” prior to processing RHI, unless the processing is “strictly necessary” for one of seven enumerated purposes.  Where required, NYHIPA included a novel standard for valid authorization, including that authorization must be executed “at least twenty-four hours after an individual creates an account or first uses the requested product or service.”

• Retention Schedule. NYHIPA would have required regulated entities to maintain a publicly available retention schedule and dispose of an individual’s RHI pursuant to such schedule within a reasonable time, and “in no event later than sixty days, after it is no longer necessary to maintain for the permissible purpose or purposes identified.”
• Exemptions. NYHIPA raised questions about the interplay with federal sectoral privacy laws.  While it included exemptions for protected health information (“PHI”) collected by covered entities or business associates subject to the Health Insurance Portability and Accountability Act, as amended, and its implementing regulations (“HIPAA”), it did not include other standard exemptions.  For example, it lacked exemptions found in MHMD and SB 370 for financial data regulated by the Gramm-Leach Bliley Act (“GLBA”) and Fair Credit Reporting Act (“FCRA”), employee data, data used for public health purposes as described in HIPAA (e.g., adverse event reporting), and data that has been de-identified in accordance with HIPAA.