New York businesses, health providers and individuals face notice requirements and waiting periods before releasing records about legally protected reproductive or gender-affirming care, under guidance released Monday by Attorney General Letitia James.
The Shield Law guidance explains protections for patients, providers and people who help them, along with rules for subpoenas and other requests for sensitive information. It reflects the attorney general’s interpretation of the law and how her office intends to enforce it.
Who and what the law protects
The protections cover care that is legal in New York, including abortion, contraception, fertility treatment, prenatal and postnatal care, miscarriage management and testing or treatment for sexually transmitted infections. Gender-affirming care includes counseling, hormone therapy, puberty-delaying medication and surgical procedures.
Patients, their families, providers, helpers, insurers and attorneys can qualify for protections. Helpers can include someone who drives a patient to an appointment or provides financial support. The law also covers attempts to obtain or provide care and care that patients manage themselves.
Patients are protected from penalties in New York regardless of where their protected activity occurred. Providers and helpers generally must have been physically in New York, although some specific protections can extend further. Telehealth is covered when the provider is in New York, even if the patient is elsewhere. Insurers qualify when the coverage comes from an entity located, headquartered or incorporated in the state.
New York can limit cooperation with out-of-state investigations and lawsuits, but it cannot prevent other states from starting them, the guidance cautions. The office recommends that affected people and organizations consult private legal counsel about their circumstances.
Four steps before releasing covered information
The records rules extend beyond medical offices. They can apply to social media companies, mobile applications, payment platforms, nonprofits, businesses and individuals located, headquartered or incorporated in New York. Protected information can include medical records, search histories, location information and billing records reasonably linked to protected health activity.
First, recipients must determine whether a request focuses on protected activity or asks for protected information. Clearly unrelated requests do not trigger the steps. When coverage is unclear, recipients should obtain a sworn coverage affirmation confirming that any protected information is incidental and will not be used to punish protected activity. Without that confirmation, they must continue through the applicable steps.
Second, a covered request requires a sworn affirmation of permitted purpose before records can be produced. The requester must confirm that the information will not be used to punish protected activity, or that it is for a patient-brought tort or contract claim actionable in New York. A legal representative can bring that claim when injury or death prevents the patient from consenting.
Without the required affirmation, the recipient cannot produce the records. The recipient should still notify the attorney general and may also need to notify affected individuals.
Third, recipients must send the attorney general a copy of the request within five business days of receiving it, or five business days before the requested response date, whichever comes first. That notice is required regardless of how the recipient plans to respond, unless the attorney general issued the request. The office provides an online notice form.
Recipients also must make a reasonable effort to notify affected patients, providers or helpers as soon as reasonably possible and at least 30 days before producing information. Verbal notice must be accompanied by written notice.
Fourth, recipients generally must wait 30 calendar days after notifying both the attorney general and affected individuals before releasing records.
Exceptions have specific limits
A written request or authorization for a person’s own records can excuse the steps, including a valid HIPAA authorization where applicable. Written consent can also permit disclosures for treatment or routine billing. These disclosures must be limited to the necessary records.
People defending themselves against an investigation or proceeding aimed at punishing protected care can request necessary records with a sworn affirmation. Government grant reports and audits have separate exceptions for necessary de-identified information and, for audits of government-paid services, identifying information that is strictly necessary.
- Letitia James reaffirms abortion access rights under federal law for New York hospitals
- Abortion protections expanded in New York: Hochul signs new shield law enhancements
- Walmart creates expanded abortion coverage for employees of the retailer
- Abortion: Doctor investigated over privacy laws and 10-year-old rape victim cleared
A court order enforceable in New York can change or eliminate particular steps, such as the waiting period. Any steps the order does not change still apply. An out-of-state order or an ordinary subpoena is generally insufficient by itself to create that exception.
Investigations of conduct that would violate New York law remain possible, but a request covered by the Shield Law generally still requires the steps unless an exception or enforceable court order applies.
Enforcement and other safeguards
Improper disclosure or intentionally, knowingly, willingly or recklessly failing to follow required steps can bring a $10,000 penalty. A false affirmation can bring a $15,000 penalty. Recipients can challenge covered requests in New York court, and complying with the Shield Law generally protects them from contempt or other punishment in New York unless they violate a specific enforceable court order.
State and local officials generally cannot help punish protected care through out-of-state investigations, arrests or detention. Extradition has an exception when the person was physically in the requesting state at the time of the alleged offense and then fled.
The guidance also describes safeguards against professional discipline for protected care, penalties by malpractice insurers and certain family-court consequences. People targeted for protected activity can seek damages and legal fees through a New York lawsuit, subject to the law’s deadlines.
Questions can be sent to shield.law@ag.ny.gov. People concerned about their safety because of involvement in protected care can contact the state’s Address Confidentiality Program at 1-855-350-4595.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.