Handles health records, in New York

10 NYCRR 405.46(n) · Read the law's page

• This binds every general hospital licensed under article 28 of the Public Health Law; declare handles_health_records if your organization is such a hospital.
• Notify the Department of Health as promptly as possible, but no later than 72 hours after determining that a cybersecurity incident has occurred, in the manner the Department prescribes; this notice does not replace other notices required by state or federal law.
• Maintain, for at least six years, the records, schedules, reports and data supporting the section, submit them for examination in the time and manner the Department requires, and document and keep available for inspection the remedial efforts for any area, system or process that needs material improvement.

10 NYCRR 405.46(c) to (m) · Read the law's page

• This binds every general hospital licensed under article 28 of the Public Health Law; declare handles_health_records if your organization is such a hospital.
• Establish a cybersecurity program based on your risk assessment that identifies and assesses risks, protects your information systems and nonpublic information, detects and responds to cybersecurity events, recovers from them, and fulfills statutory and regulatory reporting obligations; limit user access privileges to nonpublic information and review them periodically (subdivision (c)).
• Maintain a cybersecurity policy, recommended by your Chief Information Security Officer and approved by your governing body, that addresses the fifteen topics subdivision (d) lists, and designate a qualified Chief Information Security Officer who reports in writing to the governing body at least annually (subdivisions (d) and (e)).
• Do penetration testing at least annually by a qualified internal or external party, scan for publicly known vulnerabilities, and remediate vulnerabilities in a timely way based on the risk they pose (subdivision (f)).
• Conduct an accurate and thorough risk assessment annually, and keep records of systems design, security and maintenance and of audit trail systems for at least six years (subdivisions (g) and (h)).
• Encrypt nonpublic information in transit over external networks and at rest, or use effective compensating controls your Chief Information Security Officer approves and reviews at least annually, and implement controls against email-based threats such as spoofing and phishing (subdivision (c)(6) and (7)).
• Establish a written incident response plan designed to promptly respond to and recover from a cybersecurity incident (subdivision (m)).
• Comply by October 2, 2025, one year after the section's October 2, 2024 effective date (subdivision (p)).