New York Governor Vetoes NY Health Privacy Act

On December 19, 2025, New York Governor Kathy Hochul vetoed the New York Health Information Privacy Act (NY HIPA), a health data privacy bill that would have afforded consumer protections to non-HIPAA health data.

Although NY HIPA resembled existing laws, like Washington's My Health My Data Act, it had several important differences that would have greatly expanded its impact—including by applying to employee data, data held by financial institutions subject to the Gramm-Leach-Bliley Act, and data that had been de-identified in accordance with HIPAA. NY HIPA would have also required regulated entities to maintain a publicly available retention schedule and dispose of an individual's regulated health information pursuant to that schedule subject to certain regulatory requirements.

Unsurprisingly, NY HIPA was the subject of intense lobbying on both sides of the debate. Ultimately, Governor Hochul stated in her veto memo that the legislation, as written, is too broad, "creating potentially significant uncertainty about the information subject to regulation and compliance challenges."

NY HIPA could still technically pass into law if two-thirds of the members of each house vote to override the Governor's veto. While NY HIPA did originally pass with that level of support, the likelihood of overriding a veto is very slim from a historical standpoint.

In many ways, 2025 was a relatively tame year for privacy legislation, and the NY HIPA veto is a fitting conclusion. As we move into 2026, companies should carefully monitor whether states push more aggressively, as well as the emerging fight between the states and federal government over the authority to regulate AI and privacy issues.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.