Pending bills to recheck
- NY S9269. As of Oct 22, 2026: S9269/A10357 passed both houses in June 2026 and shows no signature. It is not law.
What a provider can and can't say in New York
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Only if a Title VIII licensee (e.g., nurse); unlicensed estheticians (GBL Art. 27 appearance enhancement) not covered by 6530/29.1 (inference) | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception |
- Consumer privacy and health data law: New York has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: S9269 passed both houses June 2026; not delivered to or signed by Governor (NOT law). Bills are not law. [NY-010]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general; HIPAA covered entities notify attorney general within 5 business days of HHS notice. [NY-008]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules and the patient privilege. [NY-001, NY-005]
- Patient confidentiality duties: Board rules treat disclosure without the patient's consent as misconduct (6530(23); 29.1(b)(8)). [NY-001, NY-003]
- Lawsuits by individuals: Patients may be able to sue in some situations (Civ. Rights 51; Doe tort). [NY-006, NY-007]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (Civ. Rights 50-51). [NY-006]
- Med spa rules: Med spas: only agency guidance was found (NYSED OP energy-device guidance; DOS med spa chart); the binding rules are the general professional practice acts. [NY-013]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2). Not finding enforcement does not mean none exists. [NY-004, NY-011]
- Research notes and gaps: A revised New York health information privacy bill (S9269/A10357) passed both houses in June 2026 but shows no signature; it is not law as of October 22, 2026. [NY-010]
Sources:
- [NY-001] N.Y. Educ. Law 6530(23) (https://legislation.nysenate.gov/pdf/laws/EDN6530)
- [NY-003] 8 NYCRR 29.1(b)(8); N.Y. Educ. Law 6509(9) (https://www.op.nysed.gov/title8/rules-board-regents/part-29/1)
- [NY-004] NYSED Office of the Professions enforcement action, Cal. No. 34787 (https://www.op.nysed.gov/enforcement/enforcement-actions)
- [NY-005] N.Y. CPLR 4504(a) (https://legislation.nysenate.gov/pdf/laws/CVP4504)
- [NY-006] N.Y. Civ. Rights Law 50, 51 (https://legislation.nysenate.gov/pdf/laws/CVR51)
- [NY-007] 268 A.D.2d 183, 709 N.Y.S.2d 215 (3d Dep't 2000) pinpoint not verified (https://www.courtlistener.com/opinion/6178290/doe-v-community-health-plankaiser-corp/)
- [NY-008] N.Y. Gen. Bus. Law 899-aa (1)(b), (2), (8), (9) (https://legislation.nysenate.gov/pdf/laws/GBS899-AA)
- [NY-010] S929 (2025); S9269/A10357 (2026) (https://legislation.nysenate.gov/pdf/bills/2025/S929)
- [NY-011] NY AG press release 2023-12-27 (https://ag.ny.gov/press-release/2023/attorney-general-james-secures-300000-newyork-presbyterian-hospital-failing)
- [NY-013] NYSED OP, 'Use of Energy Devices Including Lasers as the Practice of Medicine' (2025-02); DOS Med Spa Procedure Licensure Chart (https://www.op.nysed.gov/sites/op/files/2025-02/Use%20of%20Energy%20Devices%20Including%20Lasers%20as%20the%20Practice%20of%20Medicine.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| New York (NY) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Educ. Law 6530(23) (physicians); 8 NYCRR 29.1(b)(8) via 6509(9) (dentists, nurses, other Title VIII); CPLR 4504 privilege | Yes - applies to licensed providers regardless of HIPAA status | None enacted. NY HIPA (S929) vetoed 2025-12-19; revised S9269/A10357 passed both houses June 2026, not signed (NOT law) | GBL 899-aa: medical + health insurance info covered; 30 days; AG/DOS/State Police; HIPAA CEs: AG within 5 business days of HHS notice; SHIELD 899-bb safeguards | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception | Civ. Rights Law 50/51 written consent for advertising/trade; HIPAA 164.508 if covered; 6530(27) advertising standards | Civ. Rights Law 50-51 (injunction, damages, exemplary damages if knowing) | Civ. Rights Law 51; confidentiality tort (Doe v. Community Health Plan-Kaiser); no private action under 899-aa/899-bb | NYS DOH OPMC/Board for Professional Medical Conduct (physicians), NYSED Office of the Professions/Board of Regents (dentists, nurses), AG | 899-aa: greater of $5,000 or $20 per failed notice up to $250,000; GBL 350-d penalties; license discipline | E2 (NY AG pixel and data-security settlements with hospital and physician practices; NYSED nurse consent order); E4 for cosmetic practices | High | 2026-10-22 |
| New York (NY) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Educ. Law 6530(23) (physicians); 8 NYCRR 29.1(b)(8) via 6509(9) (dentists, nurses, other Title VIII); CPLR 4504 privilege | Yes - applies to licensed providers regardless of HIPAA status | None enacted. NY HIPA (S929) vetoed 2025-12-19; revised S9269/A10357 passed both houses June 2026, not signed (NOT law) | GBL 899-aa: medical + health insurance info covered; 30 days; AG/DOS/State Police; HIPAA CEs: AG within 5 business days of HHS notice; SHIELD 899-bb safeguards | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception | Civ. Rights Law 50/51 written consent for advertising/trade; HIPAA 164.508 if covered; 6530(27) advertising standards | Civ. Rights Law 50-51 (injunction, damages, exemplary damages if knowing) | Civ. Rights Law 51; confidentiality tort (Doe v. Community Health Plan-Kaiser); no private action under 899-aa/899-bb | NYS DOH OPMC/Board for Professional Medical Conduct (physicians), NYSED Office of the Professions/Board of Regents (dentists, nurses), AG | 899-aa: greater of $5,000 or $20 per failed notice up to $250,000; GBL 350-d penalties; license discipline | E2 (NY AG pixel and data-security settlements with hospital and physician practices; NYSED nurse consent order); E4 for cosmetic practices | High | 2026-10-22 |
| New York (NY) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Educ. Law 6530(23) (physicians); 8 NYCRR 29.1(b)(8) via 6509(9) (dentists, nurses, other Title VIII); CPLR 4504 privilege | Yes - applies to licensed providers regardless of HIPAA status | None enacted. NY HIPA (S929) vetoed 2025-12-19; revised S9269/A10357 passed both houses June 2026, not signed (NOT law) | GBL 899-aa: medical + health insurance info covered; 30 days; AG/DOS/State Police; HIPAA CEs: AG within 5 business days of HHS notice; SHIELD 899-bb safeguards | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception | Civ. Rights Law 50/51 written consent for advertising/trade; HIPAA 164.508 if covered; 6530(27) advertising standards | Civ. Rights Law 50-51 (injunction, damages, exemplary damages if knowing) | Civ. Rights Law 51; confidentiality tort (Doe v. Community Health Plan-Kaiser); no private action under 899-aa/899-bb | NYS DOH OPMC/Board for Professional Medical Conduct (physicians), NYSED Office of the Professions/Board of Regents (dentists, nurses), AG | 899-aa: greater of $5,000 or $20 per failed notice up to $250,000; GBL 350-d penalties; license discipline | E2 (NY AG pixel and data-security settlements with hospital and physician practices; NYSED nurse consent order); E4 for cosmetic practices | High | 2026-10-22 |
| New York (NY) | Medical med spa | Depends; cash-only med spas often not covered | Educ. Law 6530(23) (physicians); 8 NYCRR 29.1(b)(8) via 6509(9) (dentists, nurses, other Title VIII); CPLR 4504 privilege | Yes - applies to licensed providers regardless of HIPAA status | None enacted. NY HIPA (S929) vetoed 2025-12-19; revised S9269/A10357 passed both houses June 2026, not signed (NOT law) | GBL 899-aa: medical + health insurance info covered; 30 days; AG/DOS/State Police; HIPAA CEs: AG within 5 business days of HHS notice; SHIELD 899-bb safeguards | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception | Civ. Rights Law 50/51 written consent for advertising/trade; HIPAA 164.508 if covered; 6530(27) advertising standards | Civ. Rights Law 50-51 (injunction, damages, exemplary damages if knowing) | Civ. Rights Law 51; confidentiality tort (Doe v. Community Health Plan-Kaiser); no private action under 899-aa/899-bb | NYS DOH OPMC/Board for Professional Medical Conduct (physicians), NYSED Office of the Professions/Board of Regents (dentists, nurses), AG | 899-aa: greater of $5,000 or $20 per failed notice up to $250,000; GBL 350-d penalties; license discipline | E2 (NY AG pixel and data-security settlements with hospital and physician practices; NYSED nurse consent order); E4 for cosmetic practices | High | 2026-10-22 |
| New York (NY) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Educ. Law 6530(23) (physicians); 8 NYCRR 29.1(b)(8) via 6509(9) (dentists, nurses, other Title VIII); CPLR 4504 privilege | Only if a Title VIII licensee (e.g., nurse); unlicensed estheticians (GBL Art. 27 appearance enhancement) not covered by 6530/29.1 (inference) | None enacted. NY HIPA (S929) vetoed 2025-12-19; revised S9269/A10357 passed both houses June 2026, not signed (NOT law) | GBL 899-aa: medical + health insurance info covered; 30 days; AG/DOS/State Police; HIPAA CEs: AG within 5 business days of HHS notice; SHIELD 899-bb safeguards | 6530(23)/29.1(b)(8) bar revealing patient information without prior consent; no review exception | Civ. Rights Law 50/51 written consent for advertising/trade; HIPAA 164.508 if covered; 6530(27) advertising standards | Civ. Rights Law 50-51 (injunction, damages, exemplary damages if knowing) | Civ. Rights Law 51; confidentiality tort (Doe v. Community Health Plan-Kaiser); no private action under 899-aa/899-bb | NYS DOH OPMC/Board for Professional Medical Conduct (physicians), NYSED Office of the Professions/Board of Regents (dentists, nurses), AG | 899-aa: greater of $5,000 or $20 per failed notice up to $250,000; GBL 350-d penalties; license discipline | E2 (NY AG pixel and data-security settlements with hospital and physician practices; NYSED nurse consent order); E4 for cosmetic practices | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
NewYork-Presbyterian Hospital (tracking pixels)
New York Attorney General · NY (state AG) · 2023-12-27
- Provider type
- Hospital
- Relevant facts
- Website tracking pixels sent search terms, URLs and identifiers to third parties 2016-2022
- Legal issues
- HIPAA (state AG authority), NY consumer law
- Holding, findings, allegations or settlement terms
- Settlement; OAG investigation found disclosures; NYP agreed to policies, deletion requests, audits
- Consequences recorded
- $300,000; corrective program
- Procedural status
- Closed (settlement)
- Precedential?
- No
- Why it is in this research
- Website pixels on cosmetic practice sites (booking, procedure pages)
Albany ENT & Allergy Services, P.C.
New York Attorney General · NY (state AG) · 2024-10-29
- Provider type
- Specialty physician practice
- Relevant facts
- Two 2023 ransomware attacks; records of 213,935 New Yorkers; incomplete initial disclosure to state
- Legal issues
- GBL 899-aa/899-bb; HIPAA
- Holding, findings, allegations or settlement terms
- Settlement
- Consequences recorded
- $500,000 penalties + $2.25M security investment
- Procedural status
- Closed (settlement)
- Precedential?
- No
- Why it is in this research
- Breach handling and notice accuracy for physician practices
OrthopedicsNY, LLP
New York Attorney General · NY (state AG) · 2025-12-26
- Provider type
- Orthopedic practice
- Relevant facts
- 2023 breach via compromised remote-access credentials; ~656,000 individuals
- Legal issues
- GBL 899-bb; HIPAA
- Holding, findings, allegations or settlement terms
- Settlement; OAG found failure to use MFA, encrypt, assess risk
- Consequences recorded
- $500,000 penalties and costs; credit monitoring; security program
- Procedural status
- Closed (settlement)
- Precedential?
- No
- Why it is in this research
- Security safeguards for practices storing patient photos
NYSED consent order: Michelle Ann Linderman, RN
NYS Board of Regents / NYSED Office of the Professions · NY (state licensing) · 2025-10-07
- Provider type
- Registered nurse
- Relevant facts
- Admitted accessing and revealing PHI of numerous patients without authority or consent (2024)
- Legal issues
- 8 NYCRR 29.1(b)(8); Educ. Law 6509
- Holding, findings, allegations or settlement terms
- Consent order (admission)
- Consequences recorded
- 3-month actual suspension, 21 months stayed, 2 years probation, $500 fine
- Procedural status
- Final (consent order)
- Precedential?
- No
- Why it is in this research
- Licensee discipline for revealing patient information (review/social-media analog)
Doe v. Community Health Plan-Kaiser Corp.
N.Y. Appellate Division, Third Department · NY · 2000-05-11
- Provider type
- Health plan/provider
- Relevant facts
- Employee disclosure of patient's confidential medical information
- Legal issues
- Breach of confidentiality tort; CPLR 4504
- Holding, findings, allegations or settlement terms
- Judicial decision recognizing breach-of-confidentiality claim (holding details not fully reviewed)
- Consequences recorded
- n/a
- Procedural status
- Final (historic)
- Precedential?
- Yes (intermediate appellate; binding on NY trial courts absent contrary authority)
- Why it is in this research
- Private liability for disclosures (e.g., review replies) outside HIPAA
Related pages
Topics
Sources
NY-010. S929 (2025); S9269/A10357 (2026)
New York Health Information Privacy Act (S929) was vetoed on 2025-12-19 (Veto No. 135). A revised bill (S9269/A10357) passed the Senate (2026-06-03) and Assembly (2026-06-04) but the official page shows no signature; it is NOT law as of 2026-10-22.
Legislative history · Explicit · Medium-High · Re-checked on the official Assembly status page 2026-10-22 (V-026): returned to Senate 2026-06-04; no delivery to or action by the Governor shown. Not law; re-check before publication.
NY-008. N.Y. Gen. Bus. Law 899-aa
Breach law (GBL 899-aa) covers medical information and health insurance information; notice in the most expedient time possible and within 30 days after discovery (law-enforcement delay allowed); AG, Department of State and State Police notice; HIPAA covered entities that notify HHS must notify the AG within 5 business days.
Statute · Explicit · High · Penalty: greater of $5,000 or $20 per failed notification up to $250,000 for knowing/reckless violations (899-aa(6)).
NY-001. N.Y. Educ. Law 6530(23)
Professional misconduct for physicians (and PAs/specialist assistants): revealing personally identifiable facts, data, or information obtained in a professional capacity without the patient's prior consent, except as authorized or required by law.
Statute · Explicit · High · Applies to licensees regardless of HIPAA status.
NY-005. N.Y. CPLR 4504(a)
Physician, dentist, nurse, podiatrist and chiropractor privilege: unless the patient waives, the licensee may not disclose information acquired in attending a patient that was necessary to act in that capacity.
Statute (evidentiary privilege) · Explicit · High · Evidentiary privilege; courts have also relied on it for a confidentiality tort (see NY-007).
NY-003. 8 NYCRR 29.1(b)(8); N.Y. Educ. Law 6509(9)
For Title VIII professions other than those under Educ. Law 6530 (e.g., dentists, nurses), unprofessional conduct includes revealing personally identifiable facts, data or information obtained in a professional capacity without prior consent of the patient or client, except as authorized or required by law (via Educ. Law 6509(9)).
Regulation · Explicit · High · Part 29 text read from NYSED search extract of the official page (op.nysed.gov); 6509(9) from official NY Senate PDF.
https://www.op.nysed.gov/title8/rules-board-regents/part-29/1
NY-006. N.Y. Civ. Rights Law 50, 51
Use of a living person's name, portrait, picture, likeness or voice for advertising or trade without prior written consent is a misdemeanor (50) and supports an action for injunction and damages, with exemplary damages for knowing use (51).
Statute · Explicit · High · Written consent required; key for patient before/after photos and testimonials.
NY-007. 268 A.D.2d 183, 709 N.Y.S.2d 215 (3d Dep't 2000)
Appellate Division recognized a tort claim for breach of the confidentiality of medical information against a health plan/provider (Doe v. Community Health Plan-Kaiser Corp.).
Judicial decision · Explicit (case located; holding from CourtListener record and snippet) · Medium · Opinion text not fully reviewed (U-31).
https://www.courtlistener.com/opinion/6178290/doe-v-community-health-plankaiser-corp/
NY-013. NYSED OP, 'Use of Energy Devices Including Lasers as the Practice of Medicine' (2025-02); DOS Med Spa Procedure Licensure Chart
Med spa: no med-spa-specific statute located. NYSED Office of the Professions guidance treats the use of energy devices including lasers as the practice of medicine (performed by or under the order of a physician, PA or NP); Department of State guidance says injections are outside cosmetology and esthetics licenses and that a med spa offering medical procedures must be a properly licensed professional entity.
Agency guidance (interpreting binding Education Law) · Explicit (guidance) · Medium · Med spa pass, final phase part 2 (2026-10-22). Guidance only; DOS chart at https://dos.ny.gov/med-spa-procedure-licensure-chart (V-064).
NY-004. NYSED Office of the Professions enforcement action, Cal. No. 34787
NYSED/Board of Regents has imposed discipline for revealing patient information: e.g., a registered nurse consent order (Regents action 2025-10-07) for accessing and revealing PHI without authority (3-month actual suspension, 21 months stayed, 2 years probation, $500 fine).
Enforcement (licensing consent order) · Explicit (summary on official enforcement list) · Medium · Nurse, not aesthetic practice; consent order, not adjudicated finding. Shows the rule is enforced.
NY-011. NY AG press release 2023-12-27
NY AG settled with NewYork-Presbyterian Hospital ($300,000) over website tracking pixels that shared health-related information with third parties; settlement terms, no adjudicated finding.
Enforcement (state AG settlement, HIPAA via state AG authority) · Explicit · High · Hospital, not aesthetic practice; relevant to website pixels on cosmetic practice sites.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103