A new New York law imposes strict consent requirements on any business that collects or uses health-related information—including data most owners don't realize counts as health data.
Most professional services owners in New York don't realize they may already be collecting what the law considers health information. And under S09269, a bill now moving through the legislature, that collection will soon require explicit written consent—or expose the business to civil penalties.
Here's what's buried in the bill, and why it matters to your practice.
The law casts a wider net than many assume. Health information includes not just medical records or diagnoses, but also:
For professional services—whether accounting, legal, consulting, or real estate—this can mean client data collected through intake forms, payment records, or even appointment scheduling systems.
Under § 1122 of S09269 (pages 3–4), any business processing health information must do one of two things:
Option 1: Obtain written consent. This must be affirmative (not pre-checked boxes), plain-language, and specific to the processing activity. Critically, consent must be renewed annually. There is no blanket, one-time consent.
Option 2: Demonstrate necessary purpose. The business must show the processing falls within a narrow list of strictly necessary purposes—typically limited to delivering the service the customer explicitly requested, legal compliance, or safety.
Most professional services will find Option 2 easier for core business functions (e.g., processing a client's address for billing). But any secondary use—analytics, marketing, sharing with vendors—will require fresh written consent each year.
The law becomes effective six months after enactment. The New York Attorney General is authorized to issue rulemaking immediately, so guidance on compliance standards may arrive before the deadline.
Failure to comply carries civil penalties up to $15,000 per violation. Given that a single customer file might involve multiple processing activities, exposure can accumulate quickly.
Professional services should audit their data practices now:
The law is designed to give individuals control over sensitive information. For businesses, the practical effect is a new compliance layer that requires documentation and discipline, especially around consent management and vendor oversight.
Trade associations and business counsel in New York are beginning to publish detailed, practice-specific guidance on S09269 compliance. Check your industry group's resources as the effective date approaches.
Source: New York S09269, § 1122, pages 3–4.