HEALTH CARE Partner Insights
Local Care. Nationally Ranked.
wmchealth.org
Cybersecurity Remains Health Care Industry’s Biggest Legal Risk
D
In October of last year, the New York
(NYHIPA) passed both houses of the New
their data, and establishes strong data pro-
and growing legal liability risk in
State Department of Health finalized
York State Legislature. The bill is awaiting
tection requirements for regulated entities
the New York healthcare industry,
new cybersecurity regulations for
action by Governor Kathy Hochul, and there
and their service providers. The New York
with frequent, large-scale incidents occur-
hospitals. The regulations expand the
is a strong expectation that the bill will be
State Attorney General would be responsible
ring due to cyberattacks and ransomware.
definition of protected data to “nonpub-
enacted in some form. If enacted, the law
for enforcement, with potential penalties up
According to the U.S. Department of Health
lic information” that includes sensitive
would apply to entities that control the
to $15,000 per violation or 20% of a compa-
and Human Services Office of Civil Rights
personally identifiable information
processing of “regulated health information”
ny’s New York consumer revenue.
(OCR), the OCR has received notice of 41
(which is not necessarily PHI); require
(RHI) for New York residents or individuals
breaches of protected health informa-
hospitals to notify DOH within 72 hours
physically present in New York.
tion occurring in New York in the past 24
of determining that a cybersecurity inci-
NYHIPA would expand health data pri-
Technology and Cybersecurity Law Group
months affecting 500 or more individuals,
dent has occurred; and mandate robust
vacy protections beyond federal HIPAA by
stay abreast of the rapidly evolving data
triggering specific, timely notification
security measures, including annual
strictly regulating the collection and sale of
security laws and have extensive experience
requirements under the HIPAA Breach
risk assessments.
RHI and impose strict consent requirements
representing clients in connection with a
ata breaches represent a serious
•
Attorneys in Bleakley Platt & Schmidt’s Health Law Practice Group and Information
Notification Rule. Recent high-profile data
In addition, on January 22, 2025, the
for processing or selling RHI. The act grants
wide variety of data privacy and security
breaches involving New York healthcare
New York Health Information Privacy Act
individuals the right to access and delete
matters and data breach responses.
organizations include: •
The cyberattack against Change Healthcare (UnitedHealth Group) disclosed in February 2024 affecting approximately 4 million New Yorkers and 192.7 million people nationwide.
•
The New York Attorney General’s settlement in late 2024 for $2.25 million with Albany ENT & Allergy Services, P.C. for cyberattacks that compromised over 200,000 patient records.
•
The Richmond University Medical Center’s ransomware attack in early 2025 that affected over 670,000 individuals. In response to data breaches and cyber
threats such as those mentioned above, New York State has recently implemented some of the most stringent data security laws in the nation. These include: •
The Stop Hacks and Improve Electronic Data Security Act (N.Y. SHIELD Act) was adopted in 2019 requiring businesses to implement reasonable safeguards to protect the private information of New York residents and to notify affected individuals in case of a data breach. The law was strengthened further in December 2024 and February 2025 to include, among other things, amendments to the 30-day notification timeline for breaches and an expanded definition of private information that includes medical and health insurance information.
INDEPENDENT LIVING We offer all the comforts of a retirement community on a rental basis – with no entrance fees or long-term commitments – in your choice of townhomes, apartments, and studios.
Live Your Best Life
ASSISTED LIVING Our residents have everything at hand and every opportunity to live their own life, on their terms. These apartments come complete with the supports and services a resident may require. MEMORY CARE At Wartburg’s Berkemeier Living Center we are dedicated to providing exceptional care and support for individuals with memory issues, ensuring a life of comfort, dignity, and joy. ADULT DAY CARE Whether your family chooses the social model or finds that the additional healthcare support of our medical model better meets your needs, you will have peace of mind knowing your loved one is in a nurturing, caring environment they are sure to enjoy.
One Wartburg Place | Mount Vernon, NY One Wartburg Place | Mount Vernon, NY wartburg.org 914-699-0800 FOR INFORMATION: 914-699-0800 wartburg.org
REHABILITATION Our care focuses on maximizing the independence of every patient. Our dedicated staff has many years of experience and the put that experience to work for every patient every day. We create an intensive therapy regimen for each individual that is based on their needs and goals – focused on a speedy recovery.