The New York Attorney General issued guidance explaining Shield Law protections for reproductive and gender-affirming health care information and the steps required before responding to covered information requests. This is guidance, not an enforcement action against a named company; it describes potential penalties for improper disclosure or failure to follow required procedures.
No remedy or monetary penalty was imposed in this guidance. It explains that improper disclosure or failure to follow required steps can result in penalties of $10,000, and false sworn statements can carry a $15,000 penalty.
Review healthcare vendor and data-processing agreements for limits on disclosing reproductive or gender-affirming health information in response to subpoenas, warrants, investigative demands, or other government requests. Add or confirm prompt notice to the customer and, where required, affected individuals and the New York Office of the Attorney General; procedures to obtain required sworn statements; and controls that prevent disclosure before the applicable 30-day waiting period or legal review. Check customer, provider, insurer, and employee-facing privacy terms for accurate descriptions of permitted disclosures, escalation responsibilities, and cooperation with challenges to requests.
Entity
New York Office of the Attorney General
Industry
Healthcare"New York Attorney General Letitia James today released"
"New York’s original Shield Law"
"signed Shield Law 2.0"
"The Shield Law prohibits New Yorkers and New York companies from immediately handing over protected health information in response to a subpoena, investigative demand, or other request."
"Anyone who ignores the required steps or improperly shares protected information can face a $10,000 penalty."
"Lying in a sworn statement to circumvent the Shield Law carries a $15,000 penalty."
New York Attorney General Letitia James issued a consumer alert about fire risks from e-bike and other lithium-ion batteries and shared safety and disposal recommendations. The release describes no privacy enforcement action, monetary penalty, or remedy.
The New York Attorney General issued a consumer alert and online guide about scams targeting service members and veterans, including phishing and credit-monitoring scams that may misuse personal information. The release provides steps for protecting information and reporting suspected scams; it does not announce an enforcement action or monetary penalty.
New York’s investigation found that T-Mobile’s affordable broadband offerings did not meet the New York Affordable Broadband Act’s requirements, including because data caps sharply reduced customer speeds and plan information was hidden from search engines. Under an agreement, T-Mobile will remove the caps, offer plans in all areas where it provides home internet service, and make plan information easier to find.
$10.0M
A March 2023 breach exposed personal and protected health information associated with more than 13.3 million people after attackers accessed company systems using an employee’s credentials. The Perry Johnson companies agreed to pay at least $300,000, with an additional $9.7 million in penalties due if they fail to meet the agreement, and to implement security, incident response, and health-data handling reforms.
New York Attorney General James and Governor Hochul announced guidance advising county executives and sheriffs that they must end agreements to house or detain people for federal civil immigration violations by November 25, 2026. The Local Cops, Local Crimes Act makes those agreements void and unenforceable after the deadline; no monetary penalty or specific enforcement order is announced.
New York Attorney General Letitia James issued a consumer alert warning federal student loan borrowers that consolidating loans after changes under the One Big Beautiful Bill Act may limit repayment options and forgiveness eligibility. This is consumer guidance, not a privacy enforcement action; the release announces no fine or enforcement remedy.