One record. Two sets of rules. In New York, the state rules are often stricter.
New York layers some of the strongest health privacy protections in the country on top of federal HIPAA. The SHIELD Act, Mental Hygiene Law Article 33, and Public Health Law 27-F all impose additional requirements on healthcare organizations operating in New York. EZBunny's course covers what state law adds to your compliance obligations.
Start your free trialIf you operate in New York, SHIELD Act and Public Health Law requirements apply on top of federal HIPAA obligations.
Course Details
25 minutes
State
New York Law
Online, self-paced
What your team will learn
- The SHIELD Act: broader privacy protections than HIPAA
- What counts as 'private information' under New York law
- Mental health records: New York goes further than HIPAA (Article 33)
- HIV confidentiality under Public Health Law 27-F
- The layered protection model (federal + state requirements)
- SHIELD Act data-security safeguards (administrative, technical, physical)
- Breach notification timelines under New York law
- Current NY law enforcement and penalties
Who needs this training?
If you operate in New York, multiple state laws apply on top of federal HIPAA. R = Required by regulation. S = Strongly recommended.
| Practice Type | Status | Authority |
|---|---|---|
| Physician Practices & Medical Groups | Required (if NY) | SHIELD Act |
| Dental Offices | Required (if NY) | SHIELD Act |
| Urgent Care Centers | Required (if NY) | SHIELD Act |
| Home Health Agencies | Required (if NY) | SHIELD Act |
| Behavioral Health & SUD Treatment | Required (if NY) | MHL Art. 33 / PHL 27-F |
| Chiropractic Offices | Required (if NY) | SHIELD Act |
| Physical Therapy & Rehab Clinics | Required (if NY) | SHIELD Act |
| Ambulatory Surgery Centers (ASCs) | Required (if NY) | SHIELD Act |
| Pharmacies | Required (if NY) | SHIELD Act |
| Mental Health Private Practices | Required (if NY) | MHL Art. 33 / PHL 27-F |
| Community Health Centers (FQHCs) | Required (if NY) | Multiple NY laws |
| Telehealth Providers | Required (if NY) | SHIELD Act |
Which roles must complete this training?
If you operate in New York, all staff need awareness of state-specific requirements:
- All staff who handle NY resident data: SHIELD Act data-security awareness (GBL 899-bb), which applies to any organization holding NY residents' private information
- Staff handling HIV-related information: Public Health Law Article 27-F confidentiality
- Mental health providers: Additional training on Article 33 protections for mental health records
- All employees: Sexual harassment prevention training, annually, per NY Labor Law 201-g
Common New York State compliance training questions
How is the SHIELD Act different from HIPAA?
The SHIELD Act applies to any organization holding private information of New York residents - not just HIPAA-covered entities. It broadens the definition of private information, requires specific data security safeguards, and imposes breach notification requirements with shorter timelines than federal law.
What are New York's mental health record protections?
Mental Hygiene Law Article 33 provides stricter protections for mental health records than HIPAA. Disclosure generally requires patient consent, and the redisclosure protections are stronger. Clinical notes from mental health treatment have additional layers of protection beyond standard medical records.
What is PHL 27-F and how does it affect HIV records?
Public Health Law Article 27-F governs the confidentiality of HIV-related information in New York. It is stricter than HIPAA: HIV test results and related information require specific written authorization for disclosure, with limited exceptions. The penalties for unauthorized disclosure are significant.
Does this course satisfy New York's infection control CE requirement (PHL 239)?
No. PHL Section 239 requires DOH-approved infection control coursework every four years for licensed New York professionals, completed through an approved provider. This awareness course does not cover or satisfy that CE requirement; use a New York DOH-approved course to meet it.
If you operate in New York, make sure your team knows what state law requires
25 minutes per person. Certificate on completion. Start your 14-day free trial now.
Get started freeRegulatory Disclaimer
Training requirements vary by organization type, size, state, payer mix, and accreditation. This guide reflects common federal and state requirements as of April 2026 and is not legal advice. Consult your compliance officer or legal counsel for requirements specific to your organization. EZBunny provides state privacy-law training for California, Texas, and New York. Our state-specific safety and harassment courses are awareness training and may not, on their own, satisfy your state's specific mandate. Other states may have requirements not covered here. Last reviewed: April 2026.