NY Governor Plans to Review Health Privacy Bill Within 10-Day Shot Clock
New York senators delivered a controversial New York health data privacy bill to Gov. Kathy Hochul (D) on Monday, nearly a year after it quickly passed the legislature back in January (see 2501280023). Transmission of S-929 gives Hochul 10 days to decide its fate, a spokesperson for the governor's office said Tuesday. “The Governor will review the legislation."
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
“The strictest health privacy law in the country is now one signature away from becoming real,” Jeremy Mittler, a health care data privacy expert and CEO at Blueprint Audiences, posted Tuesday on LinkedIn. “And the entire health advertising industry needs to pay attention.”
New York legislators additionally delivered to the governor S-4505 on social-media warnings labels (see 2512020008) and S-7599 on automated decision-making by government agencies.
The proposed New York Health Information Privacy Act (NY HIPA) goes beyond HIPAA protections to cover wearables and other consumer devices. Monday’s transmission of S-929 sets a shot clock of 10 days, not counting Sundays, for the governor to sign or veto the bill. If Hochul does nothing, the bill is automatically approved.
However, if the governor has concerns with S-929, one option besides a veto is to modify the bill through New York state’s chapter-amendment process. If that happens -- and some observers say it’s likely (see 2511260029) -- legislators and Hochul must agree on changes. Then the governor would let the bill become law with a commitment from the legislature to amend the measure, which usually happens in January.
The health privacy legislation has run into staunch industry opposition (see 2512030041), who say the New York bill would be more burdensome for compliance than any other state law, including Washington state’s similar 2023 My Health My Data Act. The industry groups, which included Tech:NYC, Partnership for New York City, TechNet, NetChoice, the State Privacy & Security Coalition, DoorDash and Warby Parker, recently asked Hochul for a veto because they said changes to the bill proposed so far wouldn’t address their concerns (see 2512020069).
But NY HIPA also has many supporters, including the New York Civil Liberties Union, Ben & Jerry’s, more than 200 health care providers and many public advocates. In addition, the bill’s Assembly sponsor has cited support from the New York attorney general’s office.
Wyrick Robbins privacy attorney Elizabeth Johnson warned about the bill in a LinkedIn post on Friday. “If you have a role in health privacy law, make sure to keep an eye on NY HIPA,” she said. "It's just as impracticable as [Washington state’s health privacy law], without the private right of action but with significant penalty opportunities.”