Assembly passes health‑data privacy bill after extended debate over scope and enforcement

The New York State Assembly on Tuesday approved a broad health‑data privacy bill that defines "regulated health information" to include some data from apps and wearable devices and bars certain uses without separate consent, though sponsors and opponents sharply disagreed on how far the law will reach.

Sponsor Miss Rosenthal said the measure is intended to give New Yorkers more control over sensitive health information collected outside traditional health records. "With this vote, New Yorkers will finally be in control of their most private and sensitive health data," Rosenthal said, arguing that many consumer apps today sell or share sensitive information.

Opponents questioned the bill’s definitions and enforcement mechanisms, saying vagueness could raise costs for businesses and reduce access to services. "The way this bill uses broad strokes, vague language, and leaves open to interpretation a regulatory answer to a question that needs a legislative one is the reason I do not think any of us should support this," said Mister Blumenkrantz during floor debate.

Key points and scope

The bill applies to "regulated health information" and to entities that "control the processing" of that information for New York residents or for people physically located in New York. Lawmakers pressed the sponsor to clarify what "reasonably linkable" means in practice; Rosenthal described it as the ability to infer health characteristics from non‑health data (for example, purchases or location patterns).

A 24‑hour consent rule requires platforms to wait at least 24 hours before seeking authorization to process or share non‑essential health information for secondary purposes such as targeted advertising; the sponsor said information "strictly necessary" to provide a service remains usable at the time of a consumer's request. Rosenthal also said the attorney general (AG) will draft rules to implement ambiguous items in the bill and guide affected stakeholders.

Penalties and enforcement

The measure authorizes civil penalties of up to $15,000 per violation or up to 20% of revenue attributed to New York customers in the prior fiscal year; Rosenthal said the AG’s office will determine how revenue is calculated and will consult stakeholders in rulemaking. The bill does not create a private right of action, she added — enforcement, as written, is left to the AG.

Concerns raised by members

Lawmakers from both parties warned the bill’s breadth could reach far beyond traditional health care providers. Members cited examples such as Fitbit, Peloton, grocery loyalty programs and parking‑app location data as potentially covered if an inference about a person’s health could be made. Several members said those broad inferences could impose significant compliance costs on businesses and hospitals and risk removal of services for some New Yorkers.

Rosenthal replied that other states have adopted comparable protections and that the AG’s rulemaking will provide needed implementation detail. She argued the bill is intended to stop third‑party companies from monetizing sensitive data without consent and to protect people seeking reproductive or other care.

What happens next

The Assembly recorded the vote after the debate; the clerk announced the final tally and the bill was passed. Rosenthal said the AG will proceed with rulemaking and stakeholders will be able to participate in that process. The bill’s effective date and the timeline for AG rules were discussed on the floor as implementation items for the coming months.

Reporting note: Quotes and attributions are taken from the Assembly transcript; substantive legislative language (definitions, penalties, the 24‑hour consent requirement and AG rulemaking authority) was discussed on the floor and reflected in lawmakers’ exchanges.