New York medical confidentiality law combines federal HIPAA rules with stricter state protections under Public Health Law Article 18, Article 27-F, the Mental Hygiene Law, and the SHIELD Act. Together these give you the right to control who sees your health information, to inspect and copy your own records on a shorter timeline than federal law requires, and to pursue penalties that reach thousands of dollars per incident under state law and millions under federal enforcement. The rules cover paper charts, electronic records, and conversations about your care.
Who Can See Your Records
Public Health Law Article 18 sets the baseline for how providers in New York collect, store, and share patient information. HIPAA is the federal floor; New York goes further in several places.
Electronic sharing through the Statewide Health Information Network (SHIN-NY) does not happen automatically. Before a qualified entity moves your records through the network, it generally needs your written authorization on a state-approved consent form. Providers participating in SHIN-NY may give you the option to keep your information out of the network entirely.1Legal Information Institute. N.Y. Comp. Codes R. and Regs. Tit. 10 Section 300.5 – Sharing of Patient Information
Even inside one hospital or clinic, access is limited to staff directly involved in your treatment. An employee who looks at a chart without a clinical reason violates state and federal law, whether or not they share what they see. Every licensed healthcare provider is bound by these rules: physicians, nurses, psychologists, social workers, dentists, pharmacists, and others. Hospitals, clinics, laboratories, and pharmacies are covered too, along with billing and administrative staff who handle patient information.
Records That Get Extra Protection
Three categories of health information carry heightened consent and disclosure rules on top of standard confidentiality.
HIV-Related Information
Article 27-F treats HIV-related information as a separate confidentiality category. Anyone who obtains your HIV status through providing health or social services cannot disclose it without your explicit written consent, and courts generally cannot compel disclosure either. The consent form must identify who is authorized to receive the information, what will be shared, and the purpose.2New York State Senate. New York Public Health Law 2782 – Confidentiality and Disclosure Violations carry a civil penalty of up to $5,000 per occurrence, and willful violations are a misdemeanor.3New York State Senate. New York Public Health Law 2783 – Penalties and Immunities
Mental Health Records
Mental Hygiene Law Section 33.13 restricts disclosure of mental health records to situations where the patient consents, a court orders release, or the recipient is specifically authorized under the statute. Providers inside the mental health system can share what is needed for your care if there is a connection to the Office of Mental Health through licensure or a services agreement, and only what is needed.4FindLaw. New York Mental Hygiene Law MHY 33.13
Substance Use Disorder Treatment Records
Federal law under 42 CFR Part 2 adds another layer for substance use disorder (SUD) treatment records. A 2024 final rule aligned many Part 2 requirements with HIPAA. You can now sign one consent form covering all future disclosures for treatment, payment, and healthcare operations. Even so, your SUD records cannot be used against you in civil, criminal, or administrative proceedings without a separate consent or a court order.5HHS.gov. Fact Sheet 42 CFR Part 2 Final Rule
SUD counseling notes get still more protection. Providers must obtain a separate consent specifically for those notes, that consent cannot be bundled with consent for other records, and a treatment program cannot condition your care on whether you agree to release them.6eCFR. Part 2 Confidentiality of Substance Use Disorder Patient Records
Getting Your Own Records
You have the right to see and copy your medical records under both New York and federal law. New York’s timeline is stricter than HIPAA’s. Public Health Law Section 18 requires providers to give you an opportunity to inspect your records within 10 days of receiving your written request. HIPAA allows up to 30 days, with a possible 30-day extension, but the shorter New York deadline controls for providers in the state.
Providers may charge for paper copies, capped at $0.75 per page. There is no charge for reviewing records in person. If a provider ignores your request or refuses without a valid reason, you can file a complaint with the New York State Department of Health.
Mental Health Record Access
Mental health records follow a separate access process under Mental Hygiene Law Section 33.16. You have the same 10-day inspection right, but a treating practitioner can deny access if release could reasonably be expected to cause “substantial and identifiable harm” to you or others that outweighs your right to see the records. The practitioner weighs factors like whether ongoing treatment would be affected and whether the records contain sensitive information disclosed by family members.7New York State Senate. New York Mental Hygiene Law MHY 33.16
If access is denied, the facility may offer a prepared summary instead. Most disputes arise here. If you believe the denial is unjustified, you can challenge it through a review process.
How Long Providers Keep Records
Physicians must retain medical records for at least six years after the last date of treatment. For minors, records must be kept for six years or until one year after the patient turns 18, whichever is longer. Hospitals must retain records for at least six years from discharge, or until three years after a minor reaches age 18, whichever is longer. Records of deceased patients must be kept by hospitals for at least six years after death.8Legal Information Institute. N.Y. Comp. Codes R. and Regs. Tit. 10 Section 405.10 – Medical Records Once the retention period ends, providers are not obligated to keep your records.
Minors and Parental Access
New York allows minors to consent to some medical care on their own, and when they do, parents generally cannot access the related records. Under Public Health Law Section 2504, anyone 18 or older can consent to their own treatment. A minor who is married, is a parent, or is a homeless youth receiving services through an approved program can also consent. Pregnant minors can consent to prenatal care without parental involvement.9New York State Senate. New York Public Health Law 2504
Under HIPAA, a parent is not treated as the child’s personal representative for records access in three situations:
- When state law lets the minor consent and does not require parental consent, the parent cannot access records for that care.
- When a court or court-appointed person directs the treatment, the parent loses personal representative status for that care.
- When a parent agrees that the child and provider may have a confidential relationship, the scope of that agreement controls.
A provider can also refuse to treat a parent as the child’s personal representative if the provider reasonably believes the child has been or may be subjected to abuse or neglect, or that granting access could endanger the child. Under PHL Section 18, a provider may deny a parent or guardian access to a minor’s records when disclosure would have a detrimental effect on the provider-patient relationship, the child’s treatment, or the child’s relationship with the parent.
Records After Death
HIPAA protections do not end when a patient dies. Federal law extends confidentiality for 50 years after the date of death. During that period, only a personal representative of the deceased, typically an executor or administrator, can exercise the patient’s privacy rights, including authorizing disclosures and accessing records.11HHS.gov. Health Information of Deceased Individuals
One exception matters for families. A provider may share relevant health information of the deceased with family members or others who were involved in the patient’s care or payment before death, unless the patient previously expressed a preference against that disclosure. This lets families obtain information they may need for their own health decisions, such as genetic risk factors, without a formal estate proceeding. Broader disclosure still requires authorization from the personal representative.
Employer Access
Your employer is generally not entitled to your detailed medical records. Under the Americans with Disabilities Act, any medical information an employer collects must be stored separately from your personnel file and kept confidential. Supervisors and coworkers should not have access except in limited circumstances involving accommodations or safety.
Workers’ compensation claims create a narrow exception. When you file a claim, your provider can share information with the workers’ compensation insurer or your employer, but only what is necessary to process the claim. HIPAA’s “minimum necessary” standard applies, so the provider must limit disclosure to relevant information rather than releasing your full medical history.12HHS.gov. Disclosures for Workers’ Compensation Purposes
When Providers Can Disclose Without Consent
Confidentiality is not absolute. Several categories of mandatory or permitted disclosure override individual privacy.
Communicable Disease Reporting
Physicians must immediately report cases of communicable diseases, including tuberculosis, measles, and sexually transmitted infections, to the local health officer. If no physician is involved, the duty falls to the institution, household member, or other responsible person where the case occurs.13New York State Senate. New York Public Health Law 2101 – Communicable Diseases, Physicians and Institutions, Duty to Report
Reporting Dangerous Patients
Mental health professionals who determine that a patient is likely to engage in conduct that would seriously harm themselves or others must report that determination to the local director of community services as soon as practicable. If the director agrees, the report goes to the Division of Criminal Justice Services, but the information is limited to names and non-clinical identifying details. DCJS uses it only to decide whether a firearms license should be suspended, revoked, or denied.14New York State Senate. New York Mental Hygiene Law MHY 9.46
Mandated Reporting of Abuse
New York’s mandated reporter list is extensive. Physicians, nurses, psychologists, social workers, emergency medical technicians, hospital personnel involved in patient care, and dozens of other categories must report suspected child abuse or neglect to the appropriate authorities.15New York State Senate. New York Social Services Law 413 – Persons and Officials Required to Report Cases of Suspected Child Abuse or Maltreatment Similar obligations apply to suspected elder abuse or abuse of vulnerable adults, requiring notification to Adult Protective Services. In each case, providers share only the information necessary for the investigation.
Data Breaches and the SHIELD Act
The Stop Hacks and Improve Electronic Data Security (SHIELD) Act, codified in General Business Law Section 899-aa, applies directly to medical data. Its definition of “private information” includes medical information (your medical history, conditions, and treatment details from a healthcare professional) and health insurance information (policy numbers, subscriber IDs, and claims history).16New York State Senate. New York General Business Law Section 899-AA – Notification
Any business or person that owns or licenses computerized data containing your private information must notify you within 30 days of discovering a breach. Entities maintaining data they do not own must notify the data owner immediately. Organizations required to report a breach to the federal HHS Secretary under HIPAA must also send that notification to the New York Attorney General, the Department of State, and the State Police.
The SHIELD Act also requires businesses handling New Yorkers’ private information to implement “reasonable safeguards.” Failure to maintain those safeguards can produce a fine of up to $5,000 per violation brought by the Attorney General. Failure to notify affected individuals can cost up to $20 per instance of failed notification, capped at $250,000.
Penalties for Violations
Consequences for confidentiality violations involve overlapping state and federal enforcement, and the numbers are larger than many people realize.
Federal Civil Penalties Under HIPAA
HIPAA civil penalties are organized in four tiers based on culpability. Recent inflation-adjusted figures range from $145 per violation at the lowest tier, where the entity did not know about the violation, up to $73,011 per violation for willful neglect that goes uncorrected. Annual caps per violation category can exceed $2 million. These penalties apply to healthcare providers, health plans, and their business associates.
Federal Criminal Penalties
Criminal HIPAA violations fall in three tiers:
- General violations: up to $50,000 in fines and one year of imprisonment.
- False pretenses: up to $100,000 in fines and five years of imprisonment.
- Commercial advantage or malicious harm: up to $250,000 in fines and 10 years of imprisonment.
New York State Penalties and Professional Discipline
State consequences add to federal enforcement. Unauthorized HIV-related disclosure carries up to $5,000 in civil penalties per occurrence and misdemeanor charges for willful violations.3New York State Senate. New York Public Health Law 2783 – Penalties and Immunities
Unauthorized disclosure also qualifies as professional misconduct under Education Law Section 6530. The Office of Professional Medical Conduct (OPMC) investigates physicians; the Office of the Professions handles nurses, psychologists, and other licensed practitioners. Sanctions range from formal censure to license suspension or permanent revocation.18New York State Department of Health. New York State Education Law 6530 – Definitions of Professional Misconduct
Patients can also bring private lawsuits. New York courts have awarded compensation for emotional distress and reputational harm in unauthorized disclosure cases, typically under negligence or breach of fiduciary duty theories. Healthcare institutions with systemic privacy failures also face regulatory scrutiny, corrective action plans, and potential loss of accreditation.
Where to File a Complaint
Where you file depends on who violated your confidentiality and which law applies.
- State privacy violations: New York State Department of Health.
- Licensed professional misconduct: OPMC for physicians; Office of the Professions for nurses, psychologists, social workers, and others.
- HIPAA violations: U.S. Department of Health and Human Services Office for Civil Rights (OCR). The deadline is 180 days from when you knew of the violation, though OCR may extend for good cause.
- Data breaches under the SHIELD Act: New York Attorney General’s office.
- Insurance-related breaches: New York State Department of Financial Services.
Providers have their own reporting duties. Breaches affecting 500 or more individuals must be reported to affected patients and the HHS Secretary within 60 days of discovery, and smaller breaches must be reported to HHS within 60 days after the end of the calendar year in which they were discovered. If a provider fails to self-report, your complaint may be what triggers an investigation.20HHS.gov. Submitting Notice of a Breach to the Secretary