New York State Revises Proposed Cybersecurity Program And Incident Reporting Requirements For Hospitals

On May 15, 2024, the New York State Department of Health (“NYSDOH”) published revisions to the proposed hospital cybersecurity regulations that it first released in November 2023.¹ We previously summarized the initially released proposed regulations (the “Initial Proposed Regulations”) in a November 2023 client alert.² Although the revised version of the proposed regulations (the “Revised Proposed Regulations”) are still in “proposed” status and have yet to be finalized, the revisions provide insight into industry reaction to the Initial Proposed Regulations and NYSDOH's responses.

Most of the requirements of the Initial Proposed Regulations have been retained in the Revised Proposed Regulations, subject to a few modifications. Notable requirements of the Revised Proposed Regulations are summarized below: