New York Assembly Bill A02613

New York 2025-2026 Regular Session

• Introduced: 1/21/25
• Refer: 1/21/25
• Refer: 1/7/26
• Report Pass: 4/28/26

Caption

Provides additional protections for sensitive health information; requires all health information networks, electronic health record systems, and health care providers to provide patients with a right to restrict the disclosures of such patient's health information; defines terms; provides for exceptions.

Impact

The bill amends the public health law by establishing new regulations obligating healthcare entities to allow patients greater control over their personal health information. Within 180 days after the bill's effective date, the relevant department is required to implement rules and systems that facilitate these rights, addressing the significant need for stronger safeguards in the face of increasing digital data management practices. As such, this legislation will create a framework enabling patients to limit the flow of their sensitive health information, which is crucial for maintaining their privacy.

Summary

A02613 is a legislative bill aimed at enhancing the privacy protections related to sensitive health information for patients in New York. The bill requires all health information networks, electronic health records systems, and healthcare providers to give patients a right to restrict disclosures of their health information. It delineates clear definitions for terms related to health information and compliance, aiming to protect sensitive information particularly where it relates to reproductive health and mental health.

Contention

While the bill's intention to protect sensitive data is broadly supported, there are concerns regarding its practical implementation. Some stakeholders argue that the requirements could place a substantial technical burden on healthcare providers, especially smaller entities that may lack the resources to comply with sophisticated data protection measures. Additionally, questions about the adequacy of the exceptions provided for necessary disclosures in instances such as emergencies or compliance with quality standards may lead to contentious discussions around the trade-off between privacy and healthcare operational necessities.