Health record rights in New York: what state law adds
In New York, as of October 3, 2026, we found no law on health data held outside HIPAA; you get a free copy of your record in some cases; your records join the health information exchange only if you agree; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive or consumer health data law in force. S9269 (NY Health Information Privacy Act) passed both houses June 3 and 4, 2026. The official bill page shows no delivery to the Governor and no signature. S929 was vetoed in 2025.
How we searched (October 3, 2026): the official code search for consumer health data, health information privacy act, regulated health information, comprehensive consumer privacy. Agency pages checked: ag.ny.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for government benefit claims counts, beyond HIPAA and Part 171. Copies are due "within a reasonable time". Ten days applies to inspection, and to copies only where a practitioner lacks inspection space (18(2)(g)). Deadline element not counted.
Free copy: Copies requested to support an application, claim or appeal for any government benefit or program (PHL 18(2)(e))
Free copy: No charge for copying an original mammogram when the original has been furnished (PHL 18(2)(e))
Fee rule: "The provider may impose a reasonable charge for all inspections and copies, not exceeding the costs incurred by such provider"
Fee rule: "However, the reasonable charge for paper copies shall not exceed seventy-five cents per page." (per-page cap, not counted)
Fee rule: "A qualified person shall not be denied access to patient information solely because of inability to pay."
Goes beyond the federal floor: yes.
Access to patient information: charges and free copy for government benefits. N.Y. Public Health Law 18(2)(e), as amended by L.2017, ch.322
In force · effective · read October 3, 2026 · source(legislation.nysenate.gov)
No charge may be imposed under this section for providing, releasing, or delivering patient information or copies of patient information where requested for the purpose of supporting an application, claim or appeal for any government benefit or program
Who it binds, in our words: "Health care provider" or "provider" means a "health care facility" or a "health care practitioner" as defined by this subdivision.
Access to patient information: copy furnished within a reasonable time. N.Y. Public Health Law 18(2)(d), as amended by L.2024, ch.347
In force · effective · read October 3, 2026 · source(legislation.nysenate.gov)
upon the written request of any qualified person, a health care provider shall furnish to such person, within a reasonable time, a copy of any patient information requested
Who it binds, in our words: "Health care provider" or "provider" means a "health care facility" or a "health care practitioner" as defined by this subdivision.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-in. Your records go through the exchange only after you agree.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Access through SHIN-NY needs written authorization on a statewide consent form, with exceptions for emergencies and uses required by law. Routine data already needs consent. Minor consent information has added rules.
Set by a regulation.
Designated exchange: Statewide Health Information Network for New York (SHIN-NY), accessed through qualified entities.
SHIN-NY: sharing of patient information. 10 NYCRR 300.5(a)
In force · effective · read October 3, 2026 · source(regs.health.ny.gov)
a qualified entity shall only allow access to patient information by SHIN‑NY participants with a written authorization from:
Who it binds, in our words: Qualified entities and SHIN-NY participants
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Limits subpoenas, including for records, tied to reproductive or gender-affirming care in out-of-state proceedings. Exceptions need patient-brought tort or contract claims, express consent, and an affirmation. Ch.694 signed 2025-12-19, effective immediately.
Out-of-state proceedings regarding legally protected health activities. N.Y. CPLR 3119(g), as amended by L.2025, ch.694
In force · effective · read October 3, 2026 · source(legislation.nysenate.gov)
no court, county clerk, or attorney licensed to practice in this state shall issue a subpoena under this section in connection with an out-of-state proceeding relating to any legally protected health activity, unless:
Who it binds, in our words: Courts, county clerks and New York attorneys issuing subpoenas for out-of-state proceedings
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Effective date not traced. The official page has no history note; its latest database revision is 2022-04-22. Subdivision (c) sets the same rule for office-operated facilities.
Clinical records; confidentiality. N.Y. Mental Hygiene Law 33.13(e)
In force · current version date not confirmed · read October 3, 2026 · source(legislation.nysenate.gov)
Clinical information tending to identify patients or clients and clinical records maintained at a facility not operated by the offices, shall not be a public record and shall not be released to any person or agency outside such facility
Who it binds, in our words: Facilities licensed or operated by the mental hygiene offices
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Date is the last traced amendment of subdivision 1 (L.2016, ch.461, adding paragraph (r), effective 120 days after 2016-11-28). Subdivision 1 last amended by L.2020 ch.312 (eff. immediately, signed 2020-12-02) and L.2021 ch.36 (signed 2021-02-16, effective with ch.312).
HIV and AIDS related information: confidentiality and disclosure. N.Y. Public Health Law 2782(1)
In force · effective · read October 3, 2026 · source(legislation.nysenate.gov)
No person who obtains confidential HIV related information in the course of providing any health or social service or pursuant to a release of confidential HIV related information may disclose or be compelled to disclose such information, except to the following:
Who it binds, in our words: Any person who obtains confidential HIV related information in providing a health or social service or under a release
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Bill A5123 (2025) cites subdivision 3 as added by chapter 497 of 1996 and not since amended. The 1996 session law is not on the official host, so the exact effective date is not recorded.
Confidentiality of genetic test records. N.Y. Civil Rights Law 79-l(3)(a), as added by L.1996, ch.497
In force · current version date not confirmed · read October 3, 2026 · source(legislation.nysenate.gov)
All records, findings and results of any genetic test performed on any person shall be deemed confidential and shall not be disclosed without the written informed consent of the person to whom such genetic test relates.
Who it binds, in our words: Any person holding records or results of a genetic test
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No express private right of action found. GBL 899-aa(6) gives enforcement to the attorney general. CRL 79-l sets fines only. PHL 18 and 2782 name no personal action. S9269 is not law.
Damages a court may award: None for individuals. GBL 899-aa(6): AG may recover actual costs or losses and civil penalties. CRL 79-l(5): civil fine up to $1,000; willful violation a misdemeanor, fine up to $5,000. PHL 2801-d(2): at least 25% of the daily per-patient rate per day of injury; punitive damages if willful or reckless.
PHL 2801-d(1)
In force · effective · read October 3, 2026 · source(legislation.nysenate.gov)
Any residential health care facility that deprives any patient of said facility of any right or benefit, as hereinafter defined, shall be liable to said patient for injuries suffered as a result of said deprivation, except as hereinafter provided.
PHL 2803-c(3)(f)
In force · current version date not confirmed · read October 3, 2026 · source(legislation.nysenate.gov)
Every patient shall have the right to have privacy in treatment and in caring for personal needs, confidentiality in the treatment of personal and medical records, and security in storing personal possessions.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
AG, Department of State and State Police get notice; DFS too for its covered entities. HIPAA notice to persons suffices, but AG notice is still due. HIPAA covered entities must tell the AG within five business days of notifying HHS.
Deadline to tell people: Most expedient time possible and without unreasonable delay, within 30 days after discovery.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Notification; person without valid authorization has acquired private information. N.Y. General Business Law 899-aa(1)(b)(i)(6)-(7), added by L.2024, ch.613, as amended by A.920 (2025)
In force · effective · read October 3, 2026 · source(legislation.nysenate.gov)
(6) medical information, meaning any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or (7) health insurance information, meaning an individual's health insurance policy number or subscriber identification number
Who it binds, in our words: Any person or business which owns or licenses computerized data which includes private information
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Insurance Law 4903 has no AI terms. S10241/A11048, S7896/A8556 and A1456 remain in committee. DFS Circular Letter 2024-7 is guidance on underwriting and pricing, not a rule on care or coverage decisions.
How we searched (October 3, 2026): the official code search for artificial intelligence, algorithm, utilization review, clinical peer reviewer, generative artificial intelligence patient communication. Agency pages checked: dfs.ny.gov, legislation.nysenate.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
5.9%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
88.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$81,386 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.6%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
29.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
30.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
