New York hospital cybersecurity implementation schedule
New York hospitals had one year from adoption of 10 NYCRR 405.46 to comply with most cybersecurity-program requirements, while cybersecurity-incident reporting became effective at adoption.
New York · Effective · Implementation Oct 2, 2025
What it is
- What changed
- The adopted regulation's compliance schedule gave general hospitals one year from the October 2, 2024 effective date to comply with most new requirements, while subdivision 405.46(n) requires hospitals to notify the Department as promptly as possible and no later than 72 hours after determining that a cybersecurity incident occurred.
- Why it matters
- The implementation date matters for evaluating current hospital cyber-readiness claims and for building caregiver scenarios around downtime, access delays, and hospital communications after an incident.
- Who it touches
- Family caregivers, Care providers and plans, People using AI and digital health tools, People receiving care, Businesses and agencies that must complyhospital patients, family caregivers, hospital operators, clinical IT teams, digital health vendors
- What it does
- Requires something of providers, companies or agencies
Sources
- NYSDOH adopted 10 NYCRR 405.46 hospital cybersecurity regulation
- NYSDOH DHDTC DAL 24-10 Cybersecurity Requirements
Last reviewed Jul 4, 2026. This is information, not legal advice; check the source for the current text.