{"id":76588,"date":"2025-02-08T22:01:29","date_gmt":"2025-02-08T22:01:29","guid":{"rendered":"https:\/\/peraltafinancing.com\/business\/legal\/new-york-state-department-of-health-adopts-hospital-cybersecurity-regulations\/"},"modified":"2025-02-08T22:01:29","modified_gmt":"2025-02-08T22:01:29","slug":"new-york-state-department-of-health-adopts-hospital-cybersecurity-regulations","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=76588","title":{"rendered":"New York State Department of Health Adopts Hospital Cybersecurity Regulations"},"content":{"rendered":"


\n<\/p>\n

\n
\n
\n\t\t\t\t\"Close<\/span><\/p>\n<\/figure><\/div>\n

Keypoint:<\/em><\/strong> With the increased frequency and severity of cyberattacks against healthcare systems, state and federal agencies strive to improve cybersecurity controls with varied success.<\/em><\/strong><\/p>\n

In November 2023, New York Governor Kathy Hochul announced proposed regulations that would be the first state regulations for hospitals in New York. The governor described the proposed regulation as a \u201cnation-leading blueprint\u201d that would complement the federal Health Insurance Portability and Accountability Act (HIPAA) Security Rule enforced by the U.S. Department of Health and Human Services (HHS).<\/p>\n

<\/p>\n

Eleven months later, the New York State Department of Health (NYDOH) has published the final cybersecurity regulation, codified at 10 NYCRR 405.46<\/a>. Although the NYDOH regulation is another example of state-specific cybersecurity requirements, there is some evidence of regulatory harmonization across industry sectors.<\/p>\n

Many of the definitions and requirements in the new NYDOH regulation are closely aligned with the New York Department of Financial Services (NYDFS) cybersecurity regulation\u00a023 NYCRR Part 500<\/a> that has been in effect for several years. For instance, the NYDOH definition of a cybersecurity incident mirrors the NYDFS definition of a cybersecurity incident.<\/p>\n

The one NYDOH requirement that went into effect immediately is the Cybersecurity Incident Reporting requirement. Once again mirroring the NYDFS requirement for covered financial entities, covered hospitals must now notify NYDOH of a cybersecurity incident within 72 hours.<\/p>\n

The rest of the NYDOH requirements go into effect on October 2, 2025, including a requirement for all hospitals licensed in New York to:<\/p>\n