In June 2026, the New York State Legislature passed Senate Bill S9269, successfully reviving the long-debated New York Health Information Privacy Act (“NYHIPA”). Now awaiting the Governor’s signature, this legislation represents a fundamental shift in how consumer health data is regulated across the state.
For digital health startups, management services organizations (“MSOs”), and traditional medical practices operating consumer-facing digital tools, NYHIPA introduces stringent compliance hurdles that extend far beyond standard federal regulations. Entities that handle health data must understand these new boundaries to mitigate regulatory risk and avoid severe civil penalties.
Expanding the Scope: Moving Beyond HIPAA
The most critical aspect of NYHIPA is its expansive definition of “Regulated Health Information” (“RHI”). While federal law protects traditional medical records under HIPAA, NYHIPA targets the massive digital footprint left by modern healthcare consumers.
RHI includes any data reasonably linkable to an individual that relates to their past, present, or future physical or mental health. This captures a wide array of non-traditional health data points:
Information collected by fitness wearables, wellness apps, and health-related websites.
Reproductive and sexual health data.
Biometric and genetic data.
Location data indicating an attempt to obtain health services.
Health inferences derived from non-medical internet searches.
While NYHIPA exempts protected health information already governed by HIPAA, the law still applies to HIPAA-covered entities if they process consumer health data outside those strict federal guardrails.
Key Operational Impacts
If enacted, the law will take effect one year after signing, giving businesses a narrow window to overhaul their data collection and management practices. Healthcare entities and MSOs must prepare for three major operational shifts:
A Near-Total Ban on Data Sales: Selling RHI to third parties is strictly prohibited under the new law. The legislation defines a sale broadly to cover any exchange of data for monetary or other valuable consideration, restricting traditional data brokers and platforms that share user data with third-party advertising partners.
Strict Valid Authorization Requirements: Unless processing RHI is strictly necessary to provide a requested service, comply with legal obligations, or detect fraud, entities must obtain clear, affirmative valid authorization from the consumer. Businesses cannot condition access to products or services on granting this authorization.
Enhanced Consumer Rights: NYHIPA grants New Yorkers the right to access and delete their regulated health information within a 30-day window. Additionally, covered businesses must provide an easy, one-click mechanism for users to revoke their data authorizations at any time.
Enforcement and Next Steps
The stakes for non-compliance under NYHIPA are high. The New York Attorney General is granted primary enforcement authority under the bill, with the power to seek civil penalties of up to $15,000 per violation.
Healthcare entities, MSOs, and digital health platforms operating in New York or processing the data of New York residents should begin auditing their data flows immediately. Identifying where your data collection falls safely under HIPAA versus where it triggers NYHIPA is the essential first step in building a resilient compliance framework.
At MDRXLaw, we assist digital health platforms, healthcare practice groups, and MSOs with data privacy compliance, regulatory auditing, and health data governance strategies. If you require legal guidance on NYHIPA or state health privacy laws, contact our team by phone at 212.668.0200 or via email at info@mdrxlaw.com.
