CFA wrote to leaders in the Governors office and the state legislature to urge the speedy signing of A2141/S929, which was passed by the New York legislature but not signed by Governor Hochul yet. Health data is extraordinarily sensitive and has already been risked through purchase, sale, and more. A 2023 Duke University study illustrated how easy it is to buy individual’s data from mental health apps, a 2024 investigation by Senator Ron Wyden illustrated how location history from people accessing reproductive health clinics was sold to an adversarial anti-abortion organization for purposes of targeting, and a 2023 FTC enforcement action against GoodRX exposed how they sold sensitive customer data for advertising.

The bill restricts the sale of New Yorkers’ electronic health data, including to out-of-state buyers, and requires affirmative consent for processing unless strictly necessary for specific purposes. It mandates that electronic health data be deleted after sixty days unless the individual requests otherwise and provides individuals with access and deletion rights.CFA-Hochul-HIPA