What is HIPAA Law NY?

New York State HIPAA Law

While HIPAA law applies at a federal level, states are also permitted to develop privacy laws that are more stringent than the HIPAA Privacy Rule. Many states have developed such laws. The state of New York is one such state that has a series of more stringent laws than the HIPAA Privacy Rule. New York state HIPAA law (or HIPAA law NY as it will be referred to throughout) is explained in detail below.

HIPAA Law NY and the New York State Mental Hygiene Law

The New York Mental Hygiene Law regulates mental health providers’ use and disclosure of confidential mental health information. This regulation is more stringent than HIPAA in several aspects.

Under HIPAA, protected health information (PHI) may be disclosed in a judicial or administrative proceeding if the request is made under a court order or attorney-issued subpoena. A subpoena seeking medical records can be issued without a court order by the attorney for one party to another party. 

The New York mental hygiene law is more stringent than HIPAA as to when PHI may be disclosed in a judicial or administrative proceeding. Under HIPAA law NY, a court order is required to disclose mental health information. A subpoena will not suffice. This aspect of HIPAA law NY aims to protect patient privacy by requiring that a court review a request for medical records before ordering production of the records.

Under HIPAA, a provider may generally disclose PHI to law enforcement when required by law, under a court order or subpoena. This means that law enforcement need not necessarily seek a court order to obtain PHI. HIPAA law NY is more stringent. Under New York law, disclosure of mental health information requires a court order.

In addition, HIPAA permits law enforcement to subpoena any PHI that is needed to identify or locate a suspect, fugitive, material witness, or missing person. While HIPAA law NY only allows disclosure of “identifying data concerning hospitalization” – a very narrow category of PHI – in response to a law enforcement need to identify or locate these individuals. The same is true for law enforcement requests for information about crime victims. HIPAA permits law enforcement to subpoena any PHI needed to meet this request. However, under the more stringent New York mental hygiene law, the only PHI that may be disclosed for this purpose is limited to “identifying data concerning hospitalization.”

Let’s Simplify Compliance

Do you need help with NY HIPAA compliance? We can help!

Learn More!
HIPAA Seal of Compliance

HIPAA Law NY and the New York Right of Access Rule

Under the HIPAA right of access rule, providers must permit patients to inspect and obtain copies of their medical records. A provider has 30 days to grant the requested access or to provide the requested copies. HIPAA law NY on the right of access is considerably more stringent. Under New York law, a patient is generally entitled to review all information concerning or relating to their treatment. 

Once a patient requests an inspection of their medical records, a physician or healthcare facility has 10 days to provide the patient with an opportunity to inspect them. New York law requires that providers act on requests for copies of medical records within a reasonable time. The New York State Health Department considers 10 to 14 days to be a reasonable time in which a provider should respond to a request for copies.

HIPAA Law NY and Parental Access to a Child’s Medical Information

Under HIPAA, a provider may refuse to let a parent access their child’s medical information if the provider has a reasonable belief that the child has been or may be subjected to domestic violen