NY A10357

Prohibits the sale of regulated health information to third parties and requires either valid written authorization or a strictly necessary purpose (such as providing requested services, security, or legal compliance) before processing an individual's health information

Defines regulated health information broadly to include data linked to identifiable individuals concerning physical or mental health status, including conditions, medications, reproductive health, gender-affirming care, genetic data, biometric data, and location data indicating attempts to access health services

Grants individuals the right to access all their regulated health information within 30 days and request deletion within 30 days, with entities required to communicate deletion requests to service providers and third parties

Requires authorization forms to be separate from other transactions, written in plain language with 12-point minimum font, and allows individuals to revoke consent at any time through an easy-to-use mechanism

Authorizes the Attorney General to enforce violations with civil penalties up to $15,000 per violation, with a six-year statute of limitations from when the AG became aware of the violation; takes effect 6 months after becoming law