New York Enforces Cybersecurity Regulations for Hospitals to Combat Threats

Effective October 2, 2024, New York will enforce new cybersecurity requirements for licensed general hospitals to enhance their protection against cyber threats. Hospitals are mandated to establish comprehensive cybersecurity programs, including risk assessments and incident response plans, and to appoint a chief information security officer to oversee compliance. Immediate reporting of any cybersecurity incidents to the New York State Department of Health is also required. While these regulations apply only to general hospitals, they aim to supplement existing federal HIPAA Security Rule requirements, with potential extensions to other healthcare facilities considered in the future.

Opens on National Law Review