One record. Two sets of rules. In New York, state privacy laws can add limits HIPAA does not.
New York layers some of the strongest health privacy protections in the country on top of federal HIPAA. The SHIELD Act, Mental Hygiene Law Article 33, and Public Health Law 27-F all impose additional requirements on healthcare organizations operating in New York. EZBunny's course covers what state law adds to your compliance obligations.
Start your free trialIf you operate in New York, the SHIELD Act, Mental Hygiene Law Article 33 and Public Health Law Article 27-F can add state requirements to federal HIPAA, where they apply.
Course Details
30 minutes
State
New York Law
Online, self-paced
October 2026
What your team will learn
- The SHIELD Act: broader privacy protections than HIPAA
- What counts as 'private information' under New York law
- Mental health records: New York goes further than HIPAA (Article 33)
- HIV confidentiality under Public Health Law 27-F
- Patients' requests for their own records under Public Health Law 18
- The layered protection model (federal + state requirements)
- SHIELD Act data-security safeguards (administrative, technical, physical)
- Breach notification timelines under New York law
- Current NY law enforcement and penalties
Who needs this training?
If you operate in New York, several state laws can apply in addition to federal HIPAA. The SHIELD Act lists employee training as one example safeguard in a data security program. A practice that is subject to and complies with the HIPAA regulations (45 CFR parts 160 and 164) and HITECH is treated as meeting its reasonable-safeguards requirement (General Business Law 899-bb(1)(a) and (2)(b)(i)). Separately, HIPAA itself requires workforce training (45 CFR 164.530(b) and 164.308(a)(5)), so a practice that HIPAA applies to still has a training duty.
| Practice Type | Status | Authority |
|---|---|---|
| Physician Practices & Medical Groups | Recommended (if NY) | SHIELD Act |
| Dental Offices | Recommended (if NY) | SHIELD Act |
| Urgent Care Centers | Recommended (if NY) | SHIELD Act |
| Home Health Agencies | Recommended (if NY) | SHIELD Act |
| Behavioral Health & SUD Treatment | Recommended (if NY) | MHL Art. 33 / PHL 27-F |
| Chiropractic Offices | Recommended (if NY) | SHIELD Act |
| Physical Therapy & Rehab Clinics | Recommended (if NY) | SHIELD Act |
| Ambulatory Surgery Centers (ASCs) | Recommended (if NY) | SHIELD Act |
| Pharmacies | Recommended (if NY) | SHIELD Act |
| Mental Health Private Practices | Recommended (if NY) | MHL Art. 33 / PHL 27-F |
| Community Health Centers (FQHCs) | Recommended (if NY) | Multiple NY laws |
| Telehealth Providers | Recommended (if NY) | SHIELD Act |
Who should take this training?
If you operate in New York, this course is built for these roles:
- All staff who handle NY resident data: SHIELD Act data-security awareness (GBL 899-bb), which applies to any organization holding NY residents' private information
- Staff handling HIV-related information: Public Health Law Article 27-F confidentiality
- Mental health providers: Additional training on Article 33 protections for mental health records
- All employees: Sexual harassment prevention training, annually, per NY Labor Law 201-g. That's a separate course, not part of this one
Common New York health privacy law training questions
How is the SHIELD Act different from HIPAA?
The SHIELD Act applies to any organization holding private information of New York residents - not just HIPAA-covered entities. It broadens the definition of private information, requires specific data security safeguards, and imposes breach notification requirements with shorter timelines than federal law.
What are New York's mental health record protections?
Mental Hygiene Law section 33.13 makes clinical records at facilities licensed or operated by OMH or OPWDD confidential. They are not public records and may be released only in the cases the law lists, such as a court order or the consent of the patient to someone with a demonstrable need.
What is PHL 27-F and how does it affect HIV records?
Public Health Law Article 27-F governs the confidentiality of HIV-related information in New York. A person who obtains confidential HIV related information while providing a health or social service may disclose it only to the people the law lists, and a general medical release counts as a release of HIV information only if it specifically says so.
Does this course satisfy New York's infection control CE requirement (PHL 239)?
No. PHL Section 239 requires DOH-approved infection control coursework every four years for licensed New York professionals, completed through an approved provider. This awareness course does not cover or satisfy that CE requirement; use a New York DOH-approved course to meet it.
If you operate in New York, make sure your team knows what state law requires
30 minutes per person. Certificate on completion. Start your 14-day free trial now.
Get started freeRegulatory Disclaimer
Training requirements vary by organization type, size, state, payer mix, and accreditation. This guide reflects common federal and state requirements as of April 2026 and is not legal advice. Consult your compliance officer or legal counsel for requirements specific to your organization. EZBunny provides state privacy-law training for California, Texas, and New York. Our state-specific safety and harassment courses are awareness training and may not, on their own, satisfy your state's specific mandate. Other states may have requirements not covered here. Last reviewed: April 2026.