Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Health Data Privacy topic
No spam. Unsubscribe anytime.
Assembly passes broad health data privacy bill after extended floor debate
Summary
After more than two hours of questioning and objections from industry and some lawmakers, the Assembly approved a bill that creates a new regulatory framework for “regulated health information,” gives the attorney general rulemaking authority, and imposes civil penalties for violations.
The New York State Assembly on Wednesday approved legislation (bill 2141, rules report 60) that would create comprehensive privacy protections for what the bill calls “regulated health information,” advancing a package of consumer protections supporters say will limit commercial exploitation of personal health-related data.
Sponsor Assemblymember Jessica Rosenthal said the bill "provides comprehensive health data privacy provisions for individuals regarding their regulated health data and provides for the rights of consumers and responsibilities of processors regarding regulated health data." She answered repeated, detailed questions from colleagues about the bill’s definitions and how it would apply to fitness trackers, telehealth apps, pharmacies and retailers.
Rosenthal and other backers told the chamber the measure fills gaps in current law for data currently not covered by HIPAA, citing fitness-device data, period-tracking apps and some telehealth services as examples. Opponents, including members who represent business-heavy districts, warned the bill’s broad definitions and delegation of implementation details to the attorney general could raise compliance costs, prompt litigation and cause businesses to limit services for New Yorkers.
Several lawmakers pushed the sponsor to explain core definitions. Assemblymember Blumenkrantz asked what the bill means by data that is “reasonably linkable” to an individual; Rosenthal answered that the provision is intended to capture situations where non‑health data can be used to infer health status (for example, purchases or location patterns). She said the attorney general would issue guidance to clarify edge cases.
Lawmakers also questioned the bill’s 24‑hour waiting rule for obtaining consent to process or share regulated health information for purposes beyond providing a requested service. Rosenthal said data strictly necessary to deliver a requested service may be processed immediately, but platforms must wait 24 hours before requesting permission to use that data for other purposes such as targeted advertising.
Several industry concerns aired on the floor: consumer‑facing retailers, banks and health‑care providers said the bill’s inference standard could sweep in ordinary purchase and location data (groceries, parking, in‑store purchases), creating new compliance burdens. Members raised Illinois’ experience after a prior state privacy law and said vague language can spawn lawsuits and unintended market effects.
The bill includes civil penalties (the floor exchange cited $15,000 per violation or, alternatively, up to 20% of revenue derived from New York customers) and grants the attorney general authority to promulgate implementing rules. Rosenthal and supporters said rules would be developed with stakeholder input; critics argued delegating such scope to the AG rather than the Legislature reduces clarity.
After roll‑call debate and floor explanations, the Assembly approved the bill by a recorded vote of Ayes 95, Nos 41.
Supporters said the measure puts individuals back in control of sensitive data now routinely exchanged with third parties. Opponents said the bill needs narrower definitions and more legislative clarity to avoid unintended consequences for consumers and businesses.
The bill text in the legislative packet describes the measure as an act to amend the general business law; the transcript shows significant floor questioning on definitions, the 24‑hour consent timing, the attorney general’s rulemaking role and the scope of covered entities.
