New York hospital cybersecurity regulation
New York adopted 10 NYCRR 405.46 to require licensed general hospitals to maintain cybersecurity programs covering hospital information systems, PHI, PII, access controls, risk assessments, incident response, and reporting.
New York · Effective · Effective Oct 2, 2024
What it is
- What changed
- The adopted rule added 10 NYCRR 405.46 for New York general hospitals. The official regulation text applies to all general hospitals, defines cybersecurity events and incidents, includes PHI and biometric data in nonpublic-information concepts, and requires cybersecurity programs, policies, risk assessments, access controls, incident response, and Department reporting.
- Why it matters
- Hospital outages, ransomware, and record-system disruptions can directly shift coordination and safety burden onto family caregivers. This row is the New York regulatory anchor for hospital cyber resilience and patient-data protection.
- Who it touches
- Family caregivers, Care providers and plans, People using AI and digital health tools, People receiving care, Businesses and agencies that must complyhospital patients, family caregivers, hospital operators, clinical IT teams, digital health vendors
- What it does
- Requires something of providers, companies or agencies
Sources
- NYSDOH hospital cybersecurity requirements page
- NYSDOH adopted 10 NYCRR 405.46 hospital cybersecurity regulation
Last reviewed Jul 4, 2026. This is information, not legal advice; check the source for the current text.