New York State Adopts New Cybersecurity Program And Incident Reporting Requirements For Hospitals

On October 2, 2024, the New York State Department of Health ("NYSDOH") adopted hospital cybersecurity regulations (the "Regulations") that it first released in November 2023.¹ We previously summarized the initially introduced and subsequently revised proposed regulations in November 2023 and June 2024 client alerts.²

Effective immediately, hospitals in New York State are required to report to NYSDOH as promptly as possible, but not later than 72 hours after determining that a cybersecurity incident has occurred. A cybersecurity incident is an event that (i) has a material adverse impact on the normal operations of the hospital; (ii) has a reasonable likelihood of materially harming any part of the normal operation(s) of the hospital; or (iii) results in the deployment of ransomware within a material part of the hospital's information systems. Hospitals must retain documentation related to such incidents for at least six years and provide it to NYSDOH upon request.