A new New York law imposes strict consent requirements on any business that collects or uses health-related information—including inferred data.
Most professional services owners in New York don't realize that collecting customer health information—even indirectly—now requires explicit written consent under a new state law. Senate Bill S09269 establishes requirements for how businesses handle health data, with significant compliance obligations and financial penalties for violations.
Under S09269, any business that processes an individual's health information must obtain either written, affirmative consent or demonstrate that the processing falls within a narrow list of strictly necessary purposes. The law defines health information broadly to include not only direct health records but also inferred health data—for example, location patterns near a medical facility or purchase history suggesting a health condition.
If you choose the consent route, you must:
Alternatively, you can process health data without consent only if you can document that it falls within a strictly defined necessary purpose—a narrow exception that applies to limited business functions.
This applies to professional services firms that collect health-related information, including:
Even if health information collection isn't your primary business, if you process it in any form, the law applies.
S09269 becomes effective six months after enactment. The New York Attorney General can begin rulemaking immediately to clarify implementation details. The law is found in § 1122 on pages 3–4 of the bill text.
Violations carry civil penalties up to $15,000 per violation. Because each instance of processing health data without proper consent could be counted separately, penalties can accumulate quickly.
Review your current data collection practices. Identify any information you collect that could be classified as health-related—including location data, purchase history, or behavioral signals. Determine whether you can justify processing under a necessary purpose or whether you need to implement a written consent process.
Document your compliance approach. If you pursue the consent route, draft plain-language consent forms specific to your business and plan for annual renewal. If you rely on necessary purposes, prepare documentation explaining why processing is strictly necessary for your business operations.
Monitor for Attorney General guidance once rulemaking begins. The AG's rules will clarify what qualifies as "necessary purpose" and what constitutes compliant consent language.
Professional services associations and business groups have begun publishing industry-specific guidance on S09269 compliance. A free, sector-focused resource guide is available through most trade associations serving New York professional services.