New York Health Information Privacy Act (NYHIPA): status and what it would mean for advertisers

What happens next. New York's legislature decides when to send a passed bill to the Governor. Once delivered, the Governor signs or vetoes it within the period the state constitution allows. A signed bill would take effect six months later under its section 3. The sponsor's memo on the same page says "One year", but the bill text controls and reads six months (S9269, section 3).

What the bill says. A regulated entity is any entity that controls the processing of regulated health information about a covered individual (S9269, section 1120(4)). The individual must be a New York resident or physically present in New York. A person seeking or receiving services in New York also counts if the entity is located there. There is no size threshold.

Exemptions. The bill would exempt protected health information under HIPAA, covered entities as entities, and business associates to the extent they handle the information as PHI (S9269, section 1126(2)-(4)). It also lists research, clinical trial, FDA-regulated and public health uses, and information processed under other laws "as or more protective". A hospital's marketing would stay under the HIPAA marketing rule.

Sales. It would be unlawful for a regulated entity to "sell an individual's regulated health information to a third party" (S9269, section 1122(1)(a)). "Sell" means to share regulated health information "for monetary or other valuable consideration" (section 1120(5)). The sentence on authorization attaches to "otherwise process", which reads as leaving no authorization route for a sale. Counsel should confirm that reading.

All other processing. Every other operation, from collection and sharing to analysis, monetization and storage, is "processing" (section 1120(3)). It would be unlawful unless the individual gave a valid authorization or the processing is "strictly necessary" for one of seven purposes (section 1122(1)(b)):

1. Providing, maintaining, developing, improving or repairing a specific product, feature or service the individual requested.
2. Internal business operations, which "exclude any activities related to marketing, advertising, research and development, or providing products or services to third parties".
3. Protecting against malicious, fraudulent or illegal activity.
4. Detecting, responding to or preventing security incidents.
5. Protecting an individual's vital interests.
6. Legal claims.
7. Legal obligations.

For an advertiser, the second item is the key line. Health-based targeting, retargeting and audience measurement would need an authorization.

Form of the request. The request must be separate from any other transaction, in plain language and "no less than twelve point font". It must say the processing is not strictly necessary and that declining will not block use of the service. It may not use designs that impair the decision, and it must let the person choose each category of processing separately. No new request may follow a refusal or revocation for nine months (S9269, section 1122(2)(a)).

Content. The authorization must name the data types, the processing, the purposes, and the names (where readily available) or categories of recipients. It must state any consideration the entity may receive and that refusing will not affect the service. It also needs an expiry date of up to one year, revocation and access mechanisms, and a signature or other affirmative act (section 1122(2)(b)).

After consent. Revocation must stop processing immediately. Account holders must see a list of their authorizations with one-step revocation. Service cannot be conditioned on authorization, and prices or quality cannot differ for those who decline (section 1122(2)(c)-(g)).

An example. A New York user browses a sleep-apnea page on a retailer's site. A bid request carrying the page's health context and the user's device ID would be processing of regulated health information. Unless the user signed an authorization for that category of processing, the retailer could not pass it on. A consent management platform would have to capture each category on its own screen.

What the bill says. Any processing by a service provider would need a written, binding agreement. The provider must process only as needed for its obligations to the regulated entity. It also must "not combine" the regulated entity's health information with personal information it receives from other parties or collects itself (S9269, section 1125(2)). Further service providers must sign the same terms.

Why it matters for ads. Many ad platforms enrich one advertiser's events with data from others to optimise delivery. The no-combining term would bar that for health information processed as a service provider. A platform that combines data would not fit the service provider role and could become a regulated entity in its own right, which section 1120(6) allows "depending upon the context".

Individuals could get a copy of their regulated health information within 30 days, extendable once by 30 days (S9269, section 1123(1)). Deletion requests would also run on 30 days. The entity must pass the request to every service provider and third party that processed the data in the prior year, and each must delete within 30 days (section 1123(2)). Data must be disposed of within 60 days after it is no longer needed, under a public retention schedule (section 1124).

What the bill says. The Attorney General could seek injunctions, restitution, disgorgement and civil penalties of up to $15,000 per violation. Actions must start within six years of the AG learning of the violation (S9269, section 1127). Contract terms and waivers inconsistent with the article would be void (section 1128).

What is absent. The text has no private right of action and no geofencing section. Location enters only as a category of regulated health information.

Washington already applies a similar model with private suits; see Washington's My Health My Data Act. Maryland's strictly necessary standard is the closest enacted rule; see Maryland's MODPA sensitive data rules. For tag-level patterns, see the pixel problem guide, and for the wider set of rules, the ad tech compliance hub.

1. New York State Senate, Senate Bill S9269 (2025-2026 session), status, actions and sponsor memo, read in a browser on 9 November 2026. https://www.nysenate.gov/legislation/bills/2025/S9269
2. New York State Senate, Open Legislation, S9269 bill text (PDF), proposed General Business Law Article 42-A, sections 1120 to 1129, checked 9 November 2026. https://legislation.nysenate.gov/pdf/bills/2025/S9269
3. Healthcare Brew, "New York's governor vetoes popular health data privacy bill" (12 January 2026). https://www.healthcare-brew.com/stories/2026/01/12/new-york-governor-vetoes-health-data-privacy-bill
4. Morrison Foerster, "NYHIPA Returns in 2026: Revised Health Information Privacy Bill Introduced in New York" (17 March 2026). https://www.mofo.com/resources/insights/260316-nyhipa-returns-in-2026-revised-bill
5. Washington State Legislature, RCW 19.373.010, Definitions (for comparison). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010
6. Maryland Code, Commercial Law 14-4707, Controller duties (for comparison). https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4707&enactments=false