Law / United States / 
New York
Hospital Cybersecurity Requirements, notice of a cybersecurity incident to the Department of Health
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds every general hospital licensed under article 28 of the Public Health Law; declare handles_health_records if your organization is such a hospital.
- Notify the Department of Health as promptly as possible, but no later than 72 hours after determining that a cybersecurity incident has occurred, in the manner the Department prescribes; this notice does not replace other notices required by state or federal law.
- Maintain, for at least six years, the records, schedules, reports and data supporting the section, submit them for examination in the time and manner the Department requires, and document and keep available for inspection the remedial efforts for any area, system or process that needs material improvement.
These lines are LexLint's reading of the law's text, as of .
What this law does
The hospital or its designee shall notify the department as promptly as possible, but no later than 72 hours after determining a cybersecurity incident has occurred, in a manner prescribed by the department. Notification to the department does not replace any other notifications required under State or Federal laws or regulations.
A cybersecurity incident is a cybersecurity event that has a material adverse impact on the normal operations of the hospital, has a reasonable likelihood of materially harming any part of its normal operations, or results in the deployment of ransomware within a material part of its information systems. Each hospital shall maintain and submit for examination the documentation the department requires, and all such documentation must be maintained for a minimum of six years. Subdivision (n) of the section was effective immediately upon adoption.
When LexLint raises it
When your app profile says your app handles health records.