Understanding the NYS Department of Health’s New Hospital Cybersecurity Regulations

Strategies for Hospital Compliance and Industry Trends

As technology advances, hospitals and other health care organizations are facing increasing cybersecurity vulnerabilities. Cybersecurity trends across all sectors, and specifically health care, can inform stakeholders’ plans to safeguard and improve their organization’s cybersecurity. Health care organizations must also stay abreast of new cybersecurity regulations. Below, we discuss recently passed new cybersecurity regulations for New York State hospitals and review emerging cybersecurity trends.

I. New York State Department of Health‘s New Cybersecurity Regulations

In August 2023, Governor Kathy Hochul launched New York’s Cybersecurity Strategy, which outlines the state’s plan to address cybersecurity threats across various sectors.¹ Within this blueprint is a call for increased regulation of critical industries that are particularly vulnerable to cyberattacks to protect the communities they serve by establishing certain security level requirements.² Following this, in November 2023, Governor Hochul proposed cybersecurity regulations for hospitals with the intention of complementing the Department of Health and Human Services’ Health Insurance Portability and Accountability Act (HIPAA) Security Rule, by requiring the implementation and maintenance of specific, minimum cybersecurity standards, including with respect to staffing, network monitoring and testing, policy and program development, employee training and remediation, incident response, and reporting protocols and records retention.³

On October 2, 2024, the New York State Department of Health (NYSDOH) adopted cybersecurity regulations (the “Regulations”) which contain revisions to the regulations proposed in November 2023, and which require certain hospitals licensed under Article 28 of the Public Health Law to, among other requirements⁴:

Effective October 2, 2024

• Notify the NYSDOH within 72 hours after determining that a material cybersecurity incident has occurred.

Effective October 2, 2025

• Designate a Chief Information Security Officer (CISO), who is responsible for developing, overseeing and enforcing the cybersecurity program, and has certain reporting requirements.
• Maintain and implement policies and procedures on cybersecurity for the protection of its information systems and nonpublic information to be approved by the hospital’s governing body, upon recommendation by the CISO.
• Establish a written cybersecurity program with procedures, guidelines and standards, which shall be annually reviewed and attested by the CISO. At least annually, the CISO must report on the program and material cybersecurity risks to the hospital’s governing body, including the reporting requirements as prescribed in the Regulations.
• Conduct a risk assessment to inform the development of the cybersecurity program.
• Within the cybersecurity program, include monitoring and testing, developed in accordance with the hospital’s risk assessment, designed to assess the effectiveness of the hospital’s cybersecurity program and assess changes in information systems that may create or indicate vulnerabilities.
• The systems that are securely maintained by hospitals must include audit trails designed to detect and respond to cybersecurity events that have a reasonable likelihood of materially harming any material part of the normal operations of a hospital and cybersecurity incidents (defined under the law).
• Hospitals must utilize qualified cybersecurity personnel or a third-party service provider sufficient to manage the cybersecurity risks to carry out the cybersecurity program.
• Establish and implement policies and procedures governing third-party service providers regarding their access to the hospital’s information systems and nonpublic information.
• Hospitals shall use multi-factor authentication (MFA), risk-based authentication, or other compensating control to protect against unauthorized access to nonpublic information or information systems. At least annually, hospitals must review all user access privileges and remove or disable accounts and access that are no longer necessary.
• Hospitals shall develop and implement risk-based policies, procedures and controls designed to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information by such authorized users. Hospitals must also provide regular cybersecurity awareness training for all personnel that is updated to reflect risks identified by the hospital in its risk assessment, which may include annual phishing exercises and training/remediation for employees.
• Hospitals are required to establish written incident response plans designed to promptly respond to, and recover from, any cybersecurity incident materially affecting the confidentiality, integrity or availability of information systems or the continuing functionality of any aspect of the business or operations.

While the costs of implementing the regulations will depend on the cybersecurity programs currently in place, it is estimated that it may cost between $250,000 and $10 million to initially develop and implement, and about $50,000 to $2 million (or more) to maintain annually, depending on the facility size.

A. The Regulations Apply to Article 28 “General Hospitals”

The Regulations apply to all “general hospitals” licensed pursuant to Article 28 of the Public Health Law.⁵  Under Public Health Law § 2801(10), a general hospital is defined as “a hospital engaged in providing medical or medical and surgical services primarily to in-patients by or under the supervision of a physician on a 24-hour basis with provisions for admission or treatment of persons in need of emergency care and with an organized medical staff and nursing service, including facilities providing services relating to particular diseases, injuries, conditions or deformities.”⁶

Therefore at this time, the Regulations do not extend to nursing homes or residential health care facilities, public health centers, diagnostic and treatment centers (including ambulatory surgery centers), outpatient lodges for cancer treatment, dispensary and laboratory or central service facilities serving more than one institution.

B. The Data Protected Under the Regulations Expands Beyond Protected Health Information to Nonpublic Information

The Regulations include requirements for the protection of “nonpublic information,” which is a broadly defined term that includes protected health information (PHI) as well as all nonpublic electronic information that is:

• A hospital’s business-related information, the tampering with which, or unauthorized disclosure, access or use of which, would cause a material adverse impact to the business, operations or security of such hospital.
• Personally identifiable information (PII) including any information concerning a natural person which, because of name, number, personal mark or other identifier, can be used to identify such natural person.⁷

This expansive definition of protected “nonpublic information” is broader than HIPAA, which covers PHI.

C. Required Reporting of Cybersecurity Incidents Within 72 Hours

Effective immediately, hospitals are required to notify NYSDOH within 72 hours of determining that a material cybersecurity incident occurred.⁸ The Regulations define a cybersecurity incident as a “cybersecurity event⁹ that:

• Has a material adverse impact on the normal operations of the hospital.
• Has a reasonable likelihood of materially harming any part of the normal operation(s) of the hospital.
• Results in the deployment of ransomware within a material part of the hospital’s information systems.”¹⁰

Further, hospitals are required to submit certain documentation for examination by the NYSDOH, including records, schedules, reports and other data, and that such documentation be maintained for six years.¹¹  The hospital must also make available to the NYSDOH any documentation on areas, systems or processes identified that require material improvement, updating or redesign, which also must be maintained for six years.¹²

D. Cybersecurity Risk Assessment, Program and Policy

Although the requirement on reporting cybersecurity incidents is currently in effect, hospitals will have until October 2, 2025, to come into compliance with much of the Regulations, including, but not limited to, the requirements for regular risk assessments, establishing and implementing a robust cybersecurity program, and developing policies and procedures which must be approved by the hospital’s governing body. Additionally, if not already in place, hospitals must designate a qualified senior or executive-level staff member with proper training, experience and expertise to serve as CISO.¹³

1. Risk Assessments

Hospitals are required to perform thorough and regular risk assessments to evaluate potential vulnerabilities in their information systems.¹⁴  This includes, along with other components:

• Identifying risks related to network infrastructure, business operations, medical devices and third-party vendors.
• Documenting and implementing strategies to mitigate evolving threats and risks.
• Updating such risk assessments periodically and after significant changes in the information systems, but no less than annually.

It is the intention that the risk assessments inform the establishment and implementation of the cybersecurity program and be conducted in accordance with the hospital’s policies and procedures.¹⁵

2. Cybersecurity Program

Hospitals must establish a cybersecurity program within their policies and procedures designed to protect the confidentiality, integrity and security of nonpublic information stored on the hospital’s information systems.¹⁶ The program must include, among other requirements:

• Internal and external risk identification and mitigation measures to address known and emerging threats.
• Incident response capabilities to detect, manage and recover from cyberattacks and allow for continuity of the hospital’s business and operations.
• Policies and procedures to guide staff in maintaining secure operations and protecting hospital and patient data, which shall be reviewed annually and attested to by the CISO.¹⁷

3. Policies & Procedures

Compliance with the Regulations will include the development, the ongoing review and maintenance of cybersecurity policies to safeguard against potential threats across a variety of activities. The Regulations include requirements for policies such as:

• A security policy for third-party service providers.¹⁸
• A policy to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information by such authorized users.¹⁹
• A policy with instructions for carrying out a thorough risk assessment.²⁰
• An identity and access management policy to protect against unauthorized access to nonpublic information or information systems and identify the privileges of user accounts.²¹
• A policy to memorialize the cybersecurity program based on the hospital’s risk assessments.²²

The Regulations mark New York’s renewed focus on health care entities in response to threat actors’ sustained attacks on this sector, in an attempt to minimize data loss and delay of care.

These changes align with broader cybersecurity trends in health care, as further discussed below, including the adoption of zero trust frameworks by health care organizations, the use of artificial intelligence (AI) for cybersecurity threat detection, and the growing emphasis on regulatory compliance in the health care information technology sector.