Law / United States / 
New York
Hospital Cybersecurity Requirements, cybersecurity program, policy, testing and incident response plan
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every general hospital licensed under article 28 of the Public Health Law; declare handles_health_records if your organization is such a hospital.
- Establish a cybersecurity program based on your risk assessment that identifies and assesses risks, protects your information systems and nonpublic information, detects and responds to cybersecurity events, recovers from them, and fulfills statutory and regulatory reporting obligations; limit user access privileges to nonpublic information and review them periodically (subdivision (c)).
- Maintain a cybersecurity policy, recommended by your Chief Information Security Officer and approved by your governing body, that addresses the fifteen topics subdivision (d) lists, and designate a qualified Chief Information Security Officer who reports in writing to the governing body at least annually (subdivisions (d) and (e)).
- Do penetration testing at least annually by a qualified internal or external party, scan for publicly known vulnerabilities, and remediate vulnerabilities in a timely way based on the risk they pose (subdivision (f)).
- Conduct an accurate and thorough risk assessment annually, and keep records of systems design, security and maintenance and of audit trail systems for at least six years (subdivisions (g) and (h)).
- Encrypt nonpublic information in transit over external networks and at rest, or use effective compensating controls your Chief Information Security Officer approves and reviews at least annually, and implement controls against email-based threats such as spoofing and phishing (subdivision (c)(6) and (7)).
- Establish a written incident response plan designed to promptly respond to and recover from a cybersecurity incident (subdivision (m)).
- Comply by , one year after the section's effective date (subdivision (p)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 405.46 applies to all general hospitals licensed pursuant to article 28 of the Public Health Law. Each hospital shall establish within its policies and procedures a cybersecurity program based on the hospital’s risk assessment. Each hospital shall designate an individual from senior- or executive-level staff, qualified in training, experience, and expertise, to serve as the hospital’s Chief Information Security Officer.
Each hospital shall conduct an accurate and thorough annual risk assessment. The program shall include penetration testing of the hospital’s information systems by a qualified internal or external party at least annually based upon the hospital’s risk assessment. Each hospital’s cybersecurity program shall implement security measures and controls, including encryption, to protect nonpublic information both in transit over external networks and at rest.
Each hospital shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity incident materially affecting the confidentiality, integrity or availability of its information systems or the continuing functionality of any aspect of its business or operations. Hospitals have one year from the effective date of section 405.46 to comply with its requirements, except that subdivision (n) was effective immediately upon adoption. The effective date of section 405.46 is .
When LexLint raises it
When your app profile says your app handles health records.