New York Set to Pass Landmark Health Privacy Law 2025
New York lawmakers are moving forward with a health privacy bill that could become one of the strongest in the country. The New York Health Information Privacy Act (NYHIPA) is expected to pass this legislative session and would give state residents new rights over their personal health data, going well beyond what current federal laws cover.
The bill aims to fill the gaps left by HIPAA, the federal health privacy law. HIPAA applies only to doctors, hospitals, and insurers. It does not regulate the growing number of apps and services that collect sensitive health information, including period trackers, fitness wearables, and wellness platforms. NYHIPA is designed to address that oversight.
What the Bill Would Do
NYHIPA defines “consumer health data” in broad terms. It includes physical and mental health details, biometric information, reproductive health data, and even data that could reasonably suggest a health condition.
If passed, the law would require businesses to get clear and affirmative consent before collecting or sharing this kind of data. Companies would need to provide transparent explanations of how they use health data and give users the ability to access, delete, or limit that information.
Selling health data without permission would be prohibited. Using it for targeted advertising would also be off-limits. Businesses would have to revisit their data policies and update how they handle personal information.
A Broader Push for Digital Health Rights
New York’s proposal builds on momentum from other states such as Washington but goes a step further in several areas. It introduces strong restrictions on commercial use of health data, which could influence future legislation elsewhere in the United States.
The push for stronger protections reflects growing public concern. More and more health-related information is now collected outside traditional medical settings, often through consumer devices and digital platforms. Lawmakers are responding to those changes with policies that reflect the way people actually manage their health today.
What’s Next
The bill has passed key committees and has strong support from privacy advocates. Final approval is expected during the current legislative session. If signed into law, it would significantly reshape how health data is regulated in New York and could prompt similar efforts in other states.
For companies offering digital health or wellness services in New York, the law would bring new compliance requirements. Privacy policies, consent processes, and data-sharing practices would all need to be reviewed.
More broadly, the bill marks a shift in how health privacy is understood. It recognizes that sensitive health information is no longer confined to hospitals and clinics and that digital tools must follow rules that reflect their growing role in people’s lives.
