States have been increasingly creating more stringent consumer data protections as it becomes easier to access sensitive patient health data digitally (ChatGPT’s new health tool, anyone?). That is, except New York. Because on Dec. 19, Gov. Kathy Hochul vetoed the New York Health Information Privacy Act (NYHIPA), which had passed through the state’s Legislature in January 2025. The law would have given patients more control over their health data that isn’t protected under the federal Health Insurance Portability and Accountability Act (HIPAA), which largely covers privacy in a pre-digital healthcare landscape, and it would have impacted any organizations or individuals processing a New York resident’s health information. In her veto memo, Hochul wrote that “while well intentioned, the bill’s definitions and scope are broad, creating potentially significant uncertainty about the information subject to regulation and compliance challenges for consumers, businesses, and nonprofits.” So, what next?—NO |