Provides for the protection of health information; establishes requirements for communications to individuals about their health information; requires either written consent or a designated necessary purpose for the processing of an individual's health information.
STATE OF NEW YORK
________________________________________________________________________
9269
IN SENATE
February 20, 2026
___________
Introduced by Sen. KRUEGER -- read twice and ordered printed, and when
printed to be committed to the Committee on Internet and Technology
AN ACT to amend the general business law, in relation to providing for
the protection of health information
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The general business law is amended by adding a new article
2 42-A to read as follows:
3 ARTICLE 42-A
4 NEW YORK HEALTH INFORMATION PRIVACY ACT
5 Section 1120. Definitions.
6 1121. Requirements for communications to individuals.
7 1122. Lawfulness of processing regulated health information.
8 1123. Individual rights.
9 1124. Security.
10 1125. Service providers.
11 1126. Exemptions.
12 1127. Enforcement.
13 1128. Contracts and waivers void and unenforceable.
14 1129. Construction.
15 § 1120. Definitions. As used in this article, the following terms
16 shall have the following meanings:
17 1. "Deidentified information" means information that cannot reasonably
18 be used to infer information about, or otherwise be linked to an identi-
19 fied or identifiable individual, household, or device, provided that the
20 regulated entity or service provider that processes the information:
21 (a) Implements reasonable technical safeguards to ensure that the
22 information cannot be associated with an individual, household, or
23 device;
24 (b) Publicly commits to process the information only as deidentified
25 information and not attempt to reidentify the information, except that
26 the regulated entity or service provider may attempt to reidentify the
27 information solely for the purpose of determining whether its deiden-
28 tification processes satisfy the requirements of this section;
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD01741-06-6
S. 9269 2
1 (c) Contractually obligates any recipient of the deidentified informa-
2 tion to comply with all requirements of this section; and
3 (d) Any deidentified information not otherwise exempt under this arti-
4 cle, once subsequently reidentified shall not be considered deidenti-
5 fied.
6 2. "Regulated health information" means any information that:
7 (a) is reasonably linkable, directly or indirectly, to one or more
8 identified or identifiable individuals, including by for example and
9 without limitation, any data associated with a persistent unique identi-
10 fier, such as a cookie ID, an IP address, a device identifier or any
11 other form of persistent unique identifier; and
12 (b) is collected or processed in connection with an identified or
13 identifiable individual's past, present, or future physical or mental
14 health status. Such status includes but is not limited to:
15 (i) individual health conditions, treatments, diseases, or diagnoses;
16 (ii) social, psychological, behavioral, and medical interventions;
17 (iii) surgeries or medical procedures;
18 (iv) use or purchase of medication;
19 (v) bodily functions, vital signs, symptoms, or measurements of the
20 information;
21 (vi) diagnoses or diagnostic testing, treatment, or medication;
22 (vii) gender-affirming care information;
23 (viii) reproductive or sexual health information;
24 (ix) biometric data;
25 (x) genetic data;
26 (xi) precise location information that could reasonably indicate an
27 individual's attempt to acquire or receive health services or supplies;
28 (xii) data that identifies an individual seeking health care services;
29 and
30 (xiii) any information that a regulated entity or their processor,
31 processes to associate or identify an individual with a physical or
32 mental health status, that is derived or extrapolated from nonhealth
33 information (such as proxy, derivative, inferred, or emergent data by
34 any means, including algorithms or machine learning).
35 Regulated health information shall not include deidentified informa-
36 tion.
37 3. "Process" or "processing" means an operation or set of operations
38 performed on regulated health information, including but not limited to
39 the collection, use, access, sharing, sale, monetization, analysis,
40 retention, creation, generation, derivation, recording, organization,
41 structuring, storage, disclosure, transmission, licensing, or modifica-
42 tion of regulated health information.
43 4. "Regulated entity" means any entity that controls the processing of
44 regulated health information of an individual (a) who is a New York
45 resident or (b) is physically present in New York while that individual
46 is in New York or (c) is seeking or receiving services in New York if
47 the entity is located in New York.
48 5. "Sell" means to share regulated health information for monetary or
49 other valuable consideration. Selling does not include the sharing of
50 regulated health information for monetary or other valuable consider-
51 ation to a third party as an asset that is part of a merger, acquisi-
52 tion, bankruptcy, or other transaction in which the third party assumes
53 control of all or part of the regulated entity's assets.
54 6. "Service provider" means any person or entity that processes regu-
55 lated health information on behalf of a regulated entity. A service
S. 9269 3
1 provider may also be a regulated entity depending upon the context in
2 which regulated health information is processed.
3 7. "Third party" means a person or entity other than the individual,
4 regulated entity, or service provider involved in a transaction or
5 occurrence that involves regulated health information. A third party may
6 also be a regulated entity or service provider depending upon the
7 context in which regulated health information is processed.
8 8. "Individual" means a natural person acting in an individual or
9 household context.
10 9. "Verifiable" means to use reasonable means to determine that a
11 request to exercise any of the rights afforded in this act is being made
12 by, or on behalf of, the individual who is entitled to exercise such
13 rights with respect to the regulated health information at issue;
14 provided that any additional personal information a regulated entity
15 requests for the purpose of verification must be strictly necessary for
16 the purpose of confirming the identity of such individual and shall not
17 be processed or used for any purpose other than verifying the identity
18 of the individual and shall be deleted immediately upon verification or
19 failure to verify the individual. Such verification shall not extend the
20 maximum allowable time within which the regulated entity may satisfy a
21 request by an individual.
22 § 1121. Requirements for communications to individuals. All notices,
23 disclosures, forms, and other communications to individuals provided
24 pursuant to this article shall comply with the following:
25 1. All communications shall use plain, straightforward language,
26 avoiding technical or legal jargon, and must be provided through an
27 interface the individual regularly uses in connection with the regulated
28 entity's product or service.
29 2. All communications shall be reasonably accessible to individuals
30 with disabilities, including by:
31 (a) utilizing digital accessibility tools;
32 (b) for notices, complying with generally recognized industry stand-
33 ards, including, but not limited to, current standards set by standards
34 setting bodies such as the World Web Consortium, or other similar stand-
35 ards setting bodies as determined by the attorney general; and
36 (c) for other communications, providing information about how an indi-
37 vidual with a disability may access the communication in an alternative
38 format.
39 3. All communications shall be available in the languages in which the
40 regulated entity provides information via its website and services. Any
41 direct communication to an individual shall be provided in the language
42 in which the individual ordinarily interacts with the regulated entity
43 or its service provider.
44 4. A regulated entity shall make any notice for processing pursuant to
45 a permissible purpose, pursuant to subparagraph (ii) of paragraph (b) of
46 subdivision one of section eleven hundred twenty-two of this article, or
47 form for processing pursuant to authorization, pursuant to subparagraph
48 (i) of paragraph (b) of subdivision one of section eleven hundred twen-
49 ty-two of this article, publicly available on its website. If an author-
50 ization form is customized for each individual, the regulated entity may
51 instead publicly post a sample authorization form on its website.
52 § 1122. Lawfulness of processing regulated health information. 1. It
53 shall be unlawful for a regulated entity to:
54 (a) sell an individual's regulated health information to a third
55 party; or
S. 9269 4
1 (b) otherwise process an individual's regulated health information
2 unless:
3 (i) The individual has provided valid authorization for such process-
4 ing as set forth in paragraph (b) of subdivision two of this section; or
5 (ii) Processing of an individual's regulated health information is
6 strictly necessary for the purpose of:
7 (A) providing, maintaining, developing, improving, or repairing a
8 specific product, feature, or service requested by such individual, or
9 functionality thereof;
10 (B) conducting the regulated entity's internal business operations,
11 which exclude any activities related to marketing, advertising, research
12 and development, or providing products or services to third parties;
13 (C) protecting against malicious, fraudulent, or illegal activity;
14 (D) detecting, responding to, or preventing security incidents or
15 threats;
16 (E) protecting the vital interests of an individual;
17 (F) investigating, establishing, exercising, preparing for, or defend-
18 ing legal claims; or
19 (G) complying with the regulated entity's legal obligations pursuant
20 to federal, state or local law or regulation.
21 2. Unless processing of an individual's regulated health information
22 is strictly necessary pursuant to subparagraph (ii) of paragraph (b) of
23 subdivision one of this section, a regulated entity that processes regu-
24 lated health information pursuant to valid authorization as required by
25 subparagraph (i) of paragraph (b) of subdivision one of this section
26 shall comply with the following:
27 (a) A request for authorization to process an individual's regulated
28 health information shall:
29 (i) be made separately from any other transaction or part of a trans-
30 action;
31 (ii) be written in plain language and in no less than twelve point
32 font;
33 (iii) clearly and conspicuously state that the processing for which
34 the consent is requested is not strictly necessary, and that the user
35 may decline without preventing continued use of the website, online
36 service, online application, mobile device, connected device, or any
37 other service the user is requesting or signing up for;
38 (iv) be made in the absence of any mechanism that has the purpose or
39 substantial effect of obscuring, subverting, or impairing an individ-
40 ual's decision-making regarding authorization for processing;
41 (v) if requesting authorization for multiple categories of processing
42 activities, allow the individual to provide or withhold authorization
43 separately for each category of processing activity; and
44 (vi) not include any request for authorization for a processing activ-
45 ity for which an individual has withheld or revoked authorization within
46 the past nine months.
47 (b) A valid authorization shall include:
48 (i) the types of regulated health information to be processed;
49 (ii) the nature of the processing activity;
50 (iii) the specific purposes for such processing;
51 (iv) the names where readily available, or categories of service
52 providers and third parties to which the regulated entity may disclose
53 the individual's regulated health information and the purposes for such
54 disclosure, including the circumstances under which the regulated entity
55 may disclose regulated health information to law enforcement;
S. 9269 5
1 (v) any monetary or other valuable consideration the regulated entity
2 may receive in connection with processing the individual's regulated
3 health information, where applicable;
4 (vi) that failing to provide authorization will not affect the indi-
5 vidual's experience of using the regulated entity's products or
6 services;
7 (vii) the expiration date of the authorization, which may be up to one
8 year from the date authorization was provided;
9 (viii) the mechanism by which the individual may revoke authorization
10 prior to expiration;
11 (ix) the mechanism by which the individual may request access to and
12 deletion of their regulated health information;
13 (x) any other information material to an individual's decision-making
14 regarding authorization for processing; and
15 (xi) the signature or other form of unambiguous affirmative consent,
16 which may be electronic, of the individual who is the subject of the
17 regulated health information, or a parent or guardian authorized by law
18 to take actions of legal consequence on behalf of the individual who is
19 the subject of the regulated health information, and the date.
20 (c) (i) A regulated entity that receives authorization for processing
21 shall provide an effective, efficient, and easy-to-use mechanism by
22 which an individual may revoke authorization at any time through an
23 interface the individual regularly uses in connection with the regulated
24 entity's product or service.
25 (ii) Upon an individual's verifiable revocation of authorization, the
26 regulated entity shall immediately cease all processing activities for
27 which authorization was revoked, except to the extent necessary to
28 comply with the regulated entity's legal obligations.
29 (iii) For individuals who have an online account with the regulated
30 entity, the regulated entity must provide, in a conspicuous and easily
31 accessible place within the account settings, a list of all processing
32 activities for which the individual has provided authorization and, for
33 each processing activity, allow the individual to revoke authorization
34 in the same place with one motion or action.
35 (d) Upon obtaining valid authorization from an individual, the regu-
36 lated entity shall provide that individual a copy of the authorization.
37 The authorization shall be provided in a manner that is capable of being
38 retained by the individual.
39 (e) The regulated entity shall limit its processing to what was clear-
40 ly disclosed to an individual pursuant to paragraph (b) of this subdivi-
41 sion when the regulated entity received authorization from the individ-
42 ual.
43 (f) If the regulated entity seeks to materially alter its processing
44 activities for regulated health information collected pursuant to
45 authorization, the regulated entity shall obtain a new authorization for
46 the new or altered processing activity.
47 (g) Providing a product or service requested by an individual must not
48 be made contingent on providing authorization. The regulated entity must
49 not discriminate against an individual for withholding authorization,
50 such as by charging different prices or rates for products or services,
51 including through the use of discounts or other benefits, imposing
52 penalties, or providing a different level or quality of services or
53 goods to the individual.
54 3. A regulated entity that processes regulated health information
55 pursuant to a permissible purpose pursuant to subparagraph (ii) of para-
S. 9269 6
1 graph (b) of subdivision one of this section shall comply with the
2 following:
3 (a) A regulated entity shall provide clear and conspicuous notice that
4 describes:
5 (i) the types of regulated health information to be processed;
6 (ii) the nature of the processing activity;
7 (iii) the specific purposes for such processing;
8 (iv) the names where readily available, or categories of service
9 providers and third parties to which the regulated entity may disclose
10 the individual's regulated health information and the purposes for such
11 disclosure, including the circumstances under which the regulated entity
12 may disclose regulated health information to law enforcement; and
13 (v) the mechanism by which the individual may request access to and
14 deletion of their regulated health information.
15 (b) If the regulated entity materially alters its processing activ-
16 ities for regulated health information collected pursuant to a permissi-
17 ble purpose, the regulated entity must provide a clear and conspicuous
18 notice in plain language, separate from a privacy policy, terms of
19 service, or similar document, that describes any material changes to the
20 processing activities and provide the individual with an opportunity to
21 request deletion of their regulated health information.
22 § 1123. Individual rights. 1. (a) A regulated entity shall make avail-
23 able an effective, efficient, and easy-to-use mechanism through an
24 interface the individual regularly uses in connection with the regulated
25 entity's product or service by which an individual may make verifiable
26 requests under this section.
27 (b) The regulated entity shall, without undue delay and no later than
28 within thirty days of receiving a verifiable access request, make avail-
29 able a copy of all regulated health information about the individual
30 that the regulated entity maintains or that service providers maintain
31 on behalf of the regulated entity. A regulated entity may extend the
32 period within which to make available such copy one time by thirty addi-
33 tional days when reasonably necessary, as long as the regulated entity
34 provides notice of such extension to the individual during the original
35 thirty day period.
36 2. (a) A regulated entity shall make available an effective, effi-
37 cient, and easy-to-use mechanism through an interface the individual
38 regularly uses in connection with the regulated entity's product or
39 service by which an individual may request the deletion of their regu-
40 lated health information.
41 (b) An individual's request to delete or cancel their online account
42 shall be treated as a request to delete the individual's regulated
43 health information.
44 (c) The regulated entity shall, without undue delay and no later than
45 within thirty days of receiving a verifiable deletion request:
46 (i) Delete all regulated health information associated with the indi-
47 vidual in the regulated entity's possession or control, except to the
48 extent necessary to comply with the regulated entity's legal obli-
49 gations; and
50 (ii) Unless it proves impossible or involves disproportionate effort
51 that is documented in writing by the regulated entity, communicate such
52 request to each service provider or third party that processed the indi-
53 vidual's regulated health information in connection with a transaction
54 involving the regulated entity occurring within one year preceding the
55 individual's request.
S. 9269 7
1 (d) Any service provider or third party that receives notice of an
2 individual's deletion request shall within thirty days delete all regu-
3 lated health information associated with the individual in its
4 possession or control, except to the extent necessary to comply with its
5 legal obligations.
6 3. Any right set forth in this section may be exercised at any time by
7 the individual who is the subject of the regulated health information or
8 an agent authorized by such individual.
9 § 1124. Security. 1. A regulated entity shall develop, implement, and
10 maintain reasonable administrative, technical, and physical safeguards
11 to protect the security, confidentiality, and integrity of regulated
12 health information.
13 2. A regulated entity must securely dispose of an individual's regu-
14 lated health information pursuant to a publicly available retention
15 schedule within a reasonable time, and in no event later than sixty
16 days, after it is no longer necessary to maintain for the permissible
17 purpose or purposes identified in the notice or for which the individual
18 provided valid authorization.
19 § 1125. Service providers. 1. Any processing of regulated health
20 information by a service provider on behalf of a regulated entity shall
21 be governed by a written, binding agreement. Such agreement shall clear-
22 ly set forth instructions for processing regulated health information,
23 the nature and purpose of processing, the duration of processing, and
24 the rights and obligations of both parties.
25 2. An agreement pursuant to subdivision one of this section shall
26 require that the service provider:
27 (a) ensure that each person processing regulated health information is
28 subject to a duty of confidentiality with respect to such information;
29 (b) protect regulated health information in a manner consistent with
30 the requirements of this article;
31 (c) process regulated health information only when and to the extent
32 necessary to comply with its obligations to the regulated entity;
33 (d) not combine the regulated health information which the service
34 provider receives from or on behalf of the regulated entity with any
35 other personal information which the service provider receives from or
36 on behalf of another party or collects from its own relationship with
37 individuals;
38 (e) comply with any exercises of an individual's rights under section
39 eleven hundred twenty-three of this article upon the request of the
40 regulated entity and notify any service providers or third parties to
41 which it disclosed regulated health information of the request;
42 (f) delete or return all regulated health information to the regulated
43 entity at the end of the provision of services, unless retention of the
44 regulated health information is required by law;
45 (g) upon the reasonable request of the regulated entity, make avail-
46 able to the regulated entity all data in its possession necessary to
47 demonstrate the service provider's compliance with the obligations in
48 this section;
49 (h) allow, and cooperate with, reasonable assessments by the regulated
50 entity or the regulated entity's designated assessor for purposes of
51 evaluating compliance with the obligations of this article. Alterna-
52 tively, the service provider may arrange for a qualified and independent
53 assessor to conduct an assessment of the service provider's policies and
54 technical and organizational measures in support of the obligations
55 under this article using an appropriate and accepted control standard or
56 framework and assessment procedure for such assessments. The service
S. 9269 8
1 provider shall provide a report of such assessment to the regulated
2 entity upon request;
3 (i) notify the regulated entity a reasonable time in advance before
4 disclosing or transferring regulated health information to any further
5 service providers, which may be in the form of a regularly updated list
6 of further service providers that may access regulated health informa-
7 tion; and
8 (j) engage any further service provider pursuant to a written, binding
9 agreement that includes the contractual requirements provided in this
10 section, containing at minimum the same obligations that the service
11 provider has entered into with regard to regulated health information.
12 § 1126. Exemptions. Nothing in this article shall apply to the follow-
13 ing, and the attorney general may promulgate rules and regulations spec-
14 ifying additional exceptions for regulated health information that is
15 subject to and processed in compliance with any federal law that is as
16 protective or more protective of individual privacy than this chapter:
17 1. local, state, or federal governments and their agencies, authori-
18 ties or public corporations as defined in section sixty-six of the
19 general construction law or information processed by or on behalf of
20 such governmental entities provided that the information is only proc-
21 essed for governmental purposes;
22 2. information that meets the definition of protected health informa-
23 tion for purposes of the Health Insurance Portability and Accountability
24 Act of 1996 (Public Law 104-191) and implementing regulations as well as
25 the Health Information Technology for Economic and Clinical Health Act
26 (Public Law 111-5) and implementing regulations;
27 3. any covered entity governed by the privacy, security, and breach
28 notification rules issued by the United States Department of Health and
29 Human Services, Parts 160 and 164 of Title 45 of the Code of Federal
30 Regulations (CFR), established pursuant to the Health Insurance Porta-
31 bility and Accountability Act of 1996 (Public Law 104-191);
32 4. any business associate governed by the privacy, security, and
33 breach notification rules issued by the United States Department of
34 Health and Human Services, Parts 160 and 164 of Title 45 of the Code of
35 Federal Regulations (CFR), established pursuant to the Health Insurance
36 Portability and Accountability Act of 1996 (Public Law 104-191) to the
37 extent the business associate maintains the information in the same
38 manner as described in subdivision two of this section for protected
39 health information or deidentifies such information in accordance with
40 requirements for deidentification set forth in section eleven hundred
41 twenty of this article;
42 5. a program or qualified service organization or records subject to
43 42 USC Section 290dd-2 and 42 CFR Part 2;
44 6. information collected as part of a clinical trial subject to the
45 Federal Policy for the Protection of Human Subjects, also known as the
46 Common Rule, pursuant to good clinical practice guidelines issued by the
47 International Council for Harmonisation or pursuant to human subject
48 protection requirements of the United States Food and Drug Adminis-
49 tration;
50 7. information and documents lawfully subject to the federal Health
51 Care Quality Improvement Act of 1986 (42 USC Sections 11101 - 11152),
52 and implementing federal regulations;
53 8. patient safety work product subject to 42 CFR Part 3, established
54 pursuant to 42 USC Sections 299b-21 through 299b-26;
55 9. deidentified protected health information, as defined in the Health
56 Insurance Portability and Accountability Act of 1996 (Public Law
S. 9269 9
1 104-191), that is deidentified in accordance with the requirements for
2 deidentification set forth in 45 CFR Section 164.514;
3 10. identifiable private information for purposes of the federal poli-
4 cy for the protection of human subjects, 45 C.F.R. Part 46; identifiable
5 private information that is otherwise information collected as part of
6 human subjects research pursuant to the good clinical practice guide-
7 lines issued by the international council for harmonisation; the
8 protection of human subjects under 21 C.F.R. Parts 50 and 56; data used
9 or shared in research, as defined in 45 CFR 164.501, and subject to 45
10 CFR 164.512(i); or data used or shared in research conducted in accord-
11 ance with one or more of the requirements set forth in this section;
12 11. data used or disclosed only for one or more of the following:
13 (a) product registration and tracking consistent with applicable
14 United States Food and Drug Administration regulations and guidance;
15 (b) public health activities and purposes as described in and subject
16 to 45 CFR Section 164.512;
17 (c) part of a limited data set, as defined, and is used, disclosed,
18 and maintained in the manner required by 45 CFR Section 164.514; or
19 (d) activities related to quality, safety, or effectiveness regulated
20 by the United States Food and Drug Administration;
21 12. information subject to the Trusted Exchange Framework and Common
22 Agreement (TEFCA) created by the U.S. Department of Health & Human
23 Services Assistant Secretary for Technology Policy (ASTP), or through
24 other networks that exchange information about individuals, including
25 but not limited to health information or social services information,
26 and are approved in accordance with the statewide common participation
27 agreement and policies and procedures adopted pursuant to 10 NYCRR Part
28 300;
29 13. information specifically for a quality assurance committee, peer
30 review committee, or quality improvement committee for purposes of
31 section twenty-eight hundred five-j, twenty-eight hundred five-k, or
32 twenty-eight hundred five-l of the public health law;
33 14. health information collected, used, or disclosed subject to
34 section eighteen of the public health law;
35 15. directory information subject to the Family Educational Rights and
36 Privacy Act, 20 U.S.C. §§ 1232g et seq., as amended from time to time;
37 16. personal information subject to the Fair Credit Reporting Act (15
38 U.S.C. 1681 et seq.) and implementing regulations when used for the
39 purpose of furnishing a consumer credit report under the Fair Credit
40 Reporting Act (15 U.S.C. 1681 et seq.) and implementing regulations;
41 17. data used for research and development only if deidentified in
42 accordance with the requirements for deidentification set forth in
43 section eleven hundred twenty of this article, and reviewed and approved
44 by an Institutional Review Board;
45 18. any other information, which may be deemed to be regulated health
46 information under this section, but which is subject to, and which is
47 processed in compliance with, any other privacy laws or regulations that
48 are as or more protective of individual privacy than this chapter;
49 19. information that:
50 (a) is collected by a business about an individual in the course of
51 the individual acting as a job applicant to, an employee of, owner of,
52 director of, officer of, medical staff member of, or independent
53 contractor of, that business to the extent that the individual's
54 personal information is collected and used by the business solely within
55 the context of the individual's role or former role as a job applicant
S. 9269 10
1 to, an employee of, owner of, director of, officer of, medical staff
2 member of, or an independent contractor of, that business;
3 (b) is collected by a business that is emergency contact information
4 of the individual acting as a job applicant to, an employee of, owner
5 of, director of, officer of, medical staff member of, or independent
6 contractor of, that business to the extent that the information is
7 collected and used solely within the context of having an emergency
8 contact on file; or
9 (c) is necessary for the business to retain to administer benefits for
10 another individual relating to the individual acting as a job applicant
11 to, an employee of, owner of, director of, officer of, medical staff
12 member of, or independent contractor of, that business to the extent
13 that the information is collected and used solely within the context of
14 administering those benefits;
15 20. information collected, created or maintained pursuant to sections
16 33.13 and 33.16 of the mental hygiene law; or
17 21. entities licensed, registered or certified by the office of chil-
18 dren and family services, which are required to process information by
19 the regulations of such office.
20 § 1127. Enforcement. 1. Whenever it appears to the attorney general,
21 either upon complaint or otherwise, that any person or persons, within
22 or outside the state, has engaged in or is about to engage in any of the
23 acts or practices stated to be unlawful under this article, the attorney
24 general may bring an action or special proceeding in the name and on
25 behalf of the people of the state of New York to enjoin any violation of
26 this article, to obtain restitution of any moneys or property obtained
27 directly or indirectly by any such violation, to obtain disgorgement of
28 any profits obtained directly or indirectly by any such violation, to
29 obtain civil penalties of not more than fifteen thousand dollars per
30 violation and to obtain any such other and further relief as the court
31 may deem proper, including preliminary relief. In determining the
32 penalty, the court shall consider the severity of the violation and the
33 regulated entity's good faith effort to comply with the requirements of
34 this article.
35 2. The remedies provided by this section shall be in addition to any
36 other lawful remedy available.
37 3. Any action or special proceeding brought by the attorney general
38 pursuant to this section must be commenced within six years of the date
39 on which the attorney general became aware of the violation.
40 4. In connection with any proposed action or special proceeding under
41 this section, the attorney general is authorized to take proof and make
42 a determination of the relevant facts, and to issue subpoenas in accord-
43 ance with the civil practice law and rules. The attorney general may
44 also require such other data and information as they may deem relevant
45 and may require written responses to questions under oath. Such power of
46 subpoena and examination shall not abate or terminate by reason of any
47 action or special proceeding brought by the attorney general under this
48 article.
49 5. This section shall apply to all acts declared to be unlawful in
50 this article, whether or not subject to any other law of this state, and
51 shall not supersede, amend or repeal any other law of this state under
52 which the attorney general is authorized to take any action or conduct
53 any inquiry.
54 6. The attorney general may promulgate such rules and regulations as
55 are necessary to effectuate and enforce the provisions of this section.
S. 9269 11
1 § 1128. Contracts and waivers void and unenforceable. 1. Any contrac-
2 tual provision inconsistent with this article shall be void and unen-
3 forceable.
4 2. Any waiver by any individual of the provisions of this article
5 shall be void and unenforceable.
6 § 1129. Construction. Nothing in this article shall be construed to
7 restrict, invalidate or limit the authority, power, or procedures estab-
8 lished under any law providing for the reporting of disease or injury,
9 child abuse, birth, or death, public health surveillance, or disclosures
10 to the New York State Department of Health for public health activities,
11 or health oversight activities, including, but not limited to, any
12 disclosures permitted by 45 CFR 164.512(b) and (d).
13 § 2. Severability. If any clause, sentence, paragraph, subdivision,
14 section or part of this act shall be adjudged by any court of competent
15 jurisdiction to be invalid, such judgment shall not affect, impair, or
16 invalidate the remainder thereof, but shall be confined in its operation
17 to the clause, sentence, paragraph, subdivision, section or part thereof
18 directly involved in the controversy in which such judgment shall have
19 been rendered. It is hereby declared to be the intent of the legislature
20 that this act would have been enacted even if such invalid provisions
21 had not been included herein.
22 § 3. This act shall take effect 6 months after it shall have become a
23 law. Effective immediately, the addition, amendment and/or repeal of any
24 rule or regulation necessary for the implementation of this act on its
25 effective date are authorized to be made and completed on or before such
26 effective date.
