Shield Law Guidance
Protecting your rights to reproductive and gender-affirming health care
Updated November 9, 2026.
Overview of New York's Shield Law
In New York state, people have the right to get or provide reproductive health care (including abortion) or gender-affirming health care. They also have the right to help others get or provide this care. Getting, providing, or helping others to get or provide reproductive or gender-affirming health care is called legally protected health activity.
New York has laws that protect patients, health care providers, and helpers who exercise these rights. Together, these laws are known as New York’s Shield Law. The Shield Law is intended to protect people who engage in legally protected health activity from criminal or civil liability or other legal consequences that originate outside New York.
The Shield Law also prohibits others in New York from providing information about, or cooperating with investigations into, legally protected health activity in New York. These prohibitions apply very broadly, including to government officials and agencies, law enforcement, individuals, health care institutions and other HIPAA-covered entities, businesses, and other organizations.
The Office of the New York Attorney General (OAG) has developed this guidance to help explain the rights, protections, and requirements under New York’s Shield Law. This guidance reflects OAG’s interpretation of the Shield Law’s various provisions and how our office intends to enforce them.
The OAG does not offer private legal or medical advice.
This guidance does not discuss other laws that may apply to the release of information or cooperation with investigations in any specific circumstance.
The OAG strongly suggests that individuals and organizations consult with private legal counsel to understand their rights and obligations under the Shield Law, as well as under any other applicable laws, and that patients and families consult with medical providers for questions about medical care or treatment options.
Important forms and links
OAG Affirmation Form
Form to determine if a subpoena or information request is covered by the Shield Law (Coverage Affirmation) and is for a permissible purpose (Affirmation of Permissible Purpose)
OAG Shield Law Notice Form
Notice form to OAG for subpoenas or information requests covered by the Shield Law
Shield Law Quick Guide for Subpoenas or Information Requests
Reference guide for determining when Shield Law Steps apply to a subpoena or information request
Office of Court Administration (OCA) Form
Form for domestication of out-of-state subpoenas
Some key protections of the Shield Law
The Shield Law’s protections include:
- prohibitions on government officials, law enforcement, and courts from cooperating with efforts to punish legally protected health activity
- rules for responding to requests for information about legally protected health activity (including subpoenas, investigative demands by state or federal agencies, or other information requests), to protect against unauthorized disclosure
- safeguards for medical professionals, attorneys, and minor children and their families against certain legal and professional consequences for legally protected health activity
- legal options for fighting attacks on legally protected health activity
Note: New York can only limit cooperation with out-of-state investigations or legal actions. New York cannot prevent these actions.
People and groups protected by the Shield Law
The Shield Law protects the following:
- patients who receive, and individuals who provide themselves with (self-manage), reproductive or gender-affirming health care
- families of these patients
- health care providers, including clinicians (doctors, nurses, physician assistants, and medical technicians) and their staff and volunteers, therapists, and mental health practitioners
- people who help others get or provide reproductive health care or gender-affirming care, such as by driving someone to an appointment or providing financial support
- insurers who cover reproductive or gender-affirming care
- attorneys who represent or advise any of these individuals
Locations protected by the Shield Law
The Shield Law protects patients (including those who self-manage or administer their own health care) from being penalized in New York, no matter where they were when their legally protected health activity took place.
The protections for health care providers, helpers, and insurance providers depend on location:
- Health care providers and helpers are generally protected if they were physically in New York at the time of their legally protected health activity. In some circumstances, specific protections ─ such as protection from extradition ─ may apply even when the provider or helper was located outside New York.
- Health care provided by telehealth (such as medication abortion) is also protected, if the provider was located in New York when they provided the care, no matter where the patient was located.
- Insurers are protected when insurance coverage was provided by any entity located, headquartered, or incorporated in New York, regardless of the patient or provider’s location.
Important terms
Legally protected health care includes a broad range of medical treatments, surgical care, services, and products related to reproductive health care and gender-affirming care. This includes medication or medical devices; psychological, mental, and behavioral health care; and rehabilitative, therapeutic, and preventive care and treatment.
Care and services related to reproductive health care and gender-affirming care are legally protected as long as the care is otherwise legal in New York.
Reproductive health care includes all services, care, and products relating to the reproductive system provided to an individual, or self-managed care that an individual provides to themself, for example:
• abortion (both medication and procedural or surgical)
• gynecological care
• pre- and post-natal care
• fertility treatment, including assisted reproductive technology (ART)
• contraception (birth control), including oral contraceptives, contraceptive devices, and other methods of birth control
• miscarriage management
• lactation support
• testing or treatment for sexually transmitted infections
Gender-affirming health care means any type of health care provided to an individual to affirm their gender identity or gender expression. This care includes self-managed care that a patient provides to themself.
Gender-affirming care includes a broad range of services, treatments, and products that help a person adjust their body and appearance to match their gender identity more closely, for example:
- puberty-delaying medications (often called “puberty blockers”)
- hormone therapy
- counseling
- electrolysis or laser hair removal
- voice training
- surgical procedures
The definition of gender-affirming health care excludes surgical interventions on a minor who has a variation in their sex characteristics (commonly known as an intersex individual) and that the individual themself did not initiate or seek.
Legally protected health activity includes:
- getting, providing, or helping someone get or provide reproductive or gender-affirming health care
- attempting to get, provide, or help someone get or provide such care
- self-managing reproductive or gender-affirming health care
- providing or attempting to provide insurance coverage for reproductive or gender-affirming health care
Legally protected health information includes information in any format that can reasonably be linked to an individual or entity in connection with any past, present, or future engagement in legally protected health activity, such as:
- medical records
- internet search histories
- location information
- billing records
Rules for government, law enforcement, and courts
Cooperation with out-of-state investigations
New York state and local officials cannot help an out-of-state individual or agency investigate or punish legally protected health activity. This rule applies to elected officials, law enforcement, courts, and state and local employees.
New York law enforcement can investigate reproductive or gender-affirming health care only if the alleged conduct would violate New York laws – for example, if there is an allegation that domestic violence took place, or that a health care provider did not comply with New York state laws governing medical practice.
This rule does not apply to a valid subpoena or warrant that is not about legally protected health activity. If it is not clear whether the subpoena or warrant is about legally protected health activity, the recipient of the request should seek more information from the issuing entity.
In addition, the rule does not apply to written requests from anyone who is the subject of an investigation about legally protected health activity.
In March 2025, the Uster County Clerk’s Office refused to accept legal papers seeking to enforce a Texas state court judgment against a reproductive health care provider, pointing to New York’s Shield Law. After Texas challenged the clerk’s actions, a court confirmed that he had properly relied on the Shield Law in rejecting the case. The OAG has sought to intervene to defend the law on appeal.
Arrest, detention, and extradition
State and local law enforcement officers are generally prohibited from doing any of the following because an individual allegedly participated in legally protected health activity:
- arresting the person, with or without a warrant
- detaining the person
- extraditing the person to another state to face criminal charges
Extradition is allowed only in the fugitive from justice exception. This exception applies when the extradition request states that the person was physically present within that state’s borders at the time of the charged offense, and that the person then fled from that state.
In February 2025, under the Shield Law, Governor Hochul refused Louisiana’s request to extradite a reproductive health care provider.
Evidence of legally protected health activity
In New York courts, evidence that a person engaged in legally protected health activity cannot be used as proof of the person’s wrongdoing.
Exception: A person who received reproductive or gender-affirming health care is allowed to use this type of evidence for a tort or contract claim that would be actionable in New York, if the person themself (or their legal representative if they are unable to give consent because of injury or death) is bringing the tort or claim. This situation could involve, for example, a claim for medical malpractice.
Subpoenas, deposition orders, and affirmations
New York courts and attorneys cannot issue a subpoena or deposition order (an order forcing someone to testify or produce records) in a case or investigation seeking to punish legally protected health activity.
Anyone who wishes to make an out-of-state subpoena or deposition order enforceable (domesticated) in New York must submit a written statement, or affirmation, that the produced information will be used only for a permitted purpose. The affirmation, which must be sworn and signed under penalty of perjury, must specifically confirm either of the following:
- The requestor is not seeking the information to punish legally protected health activity. Any produced information will not be used for that purpose.
- The requestor is seeking the information for a tort or contract case that would be actionable in New York, and that is brought by the patient themself (or their legal representative if they are unable to give consent because of injury or death). The requestor must specify whether the information will be used for a tort or contract case.
The Office of Court Administration (OCA) has issued an affirmation form (OCA Form) that must be completed by the requesting person or entity.
Courts and attorneys in New York cannot domesticate a subpoena or deposition order without receiving the OCA Form. Knowingly or recklessly submitting a false affirmation can be punished by a fine of $15,000.
Rules for responding to a subpoena, request for information, or other inquiry that may be about legally protected health activity under the Shield Law
The Shield Law is intended to prevent unauthorized disclosure of information about legally protected health activity. Records or information about legally protected health activity can be disclosed only if the information is requested for specific, permitted reasons. To limit disclosures to permitted reasons, anyone who receives a request that is about legally protected health activity must take certain Steps (called the Shield Law Steps) before they can disclose the information. These Steps are detailed in a later section.
However, there are several circumstances where recipients may not have to take all, or any, of the Shield Law Steps. These circumstances include all of the following:
- written requests, authorizations, or consent forms signed by individuals for release of their own records
- disclosures related to medical treatment or routine medical billing
- written requests made by the subject of an investigation into legally protected health activity
- government grant reporting and audits
Court orders that are valid and enforceable in New York can also change or eliminate one or more Shield Law Steps.
The Steps that are generally required, along with the circumstances that may excuse those Steps, are described in more detail in a later section.
Any individual, group, or business located, headquartered, or incorporated in New York who receives a request covered by the Shield Law must follow these rules. These individuals and groups include, but are not limited to:
- health care providers
- social media companies
- mobile phone applications
- payment platforms
- nonprofits
- private individuals, groups, and businesses
Additional rules apply to electronic communications service providers who receive warrants for protected health information.
Types of requests that may require the Shield Law Steps include any civil, criminal, or regulatory inquiry, investigation, subpoena, or summons for information, or any other request for records or information that is about legally protected health activity. A request is about legally protected health activity if it is focused on legally protected health activity, or if the request asks for legally protected health information. Both formal and informal requests are included.
The Shield Law does not apply to requests that are not about legally protected health activity. The differences between requests that are and are not covered, along with examples, are discussed in more detail in later sections.
A request for information about a clinic’s provision of abortion care requires the Shield Law Steps because the request is focused on a legally protected health activity: abortion. In a similar way, a subpoena issued as part of a fraud investigation that requests the medical records of all patients who received gender-affirming care requires the Shield Law Steps because the subpoena asks for legally protected health information.
The Shield Law Steps
Steps to take before complying with a subpoena or information request that may be about legally protected health activity
Any individual, group, or business that receives a subpoena or information request that may be about legally protected health activity must take all of the following Steps before it may comply with the request, unless any of the following is true:
- The request is not covered by the Shield Law in the first place.
- The request falls under one of the circumstances listed in the following section, which may change or eliminate one or more of the Steps.
- Any of the Steps is eliminated or changed by a valid and enforceable court order.
Read the quick reference guide for a summary of the Shield Law Steps and circumstances that may excuse those Shield Law Steps for covered requests.
The Shield Law only covers requests that are about legally protected health activity.
Before responding to a request, the first step is to figure out whether the request is covered — that is, whether it is about legally protected health activity. A request is “about” legally protected health activity if it is focused on legally protected activity, or if it asks for legally protected health information.
- If the request does not do either of these things, then the request is not covered by the Shield Law: The recipient is not required to take the Shield Law Steps.
- If the request does either of these things, then the request is covered: The recipient must take the rest of the Shield Law Steps.
Requests that clearly are not covered
If it is clear that a subpoena or information request is not about legally protected health activity, then the request is not covered by the Shield Law. The recipient may produce the requested records without taking any Shield Law Steps.
A business receives a request in connection with a worker’s compensation claim brought by an employee who slipped and broke their ankle on the job, seeking the employee’s email communications about their fall. Because the request is seeking documents unrelated to any form of legally protected health activity, and does not ask for any legally protected health information, it is clear that the request is not covered.
The Shield Law does not apply. The recipient is not required to take any Shield Law Steps before producing records.
Requests that clearly are covered
If it is clear that a subpoena or information request is about legally protected health activity, then the request is covered by the Shield Law, and the recipient of the request should proceed to Step 2 and take the additional Shield Law Steps, as applicable, before complying with the request.
A period-tracking app company receives a request for user information in connection with a medical malpractice lawsuit about fertility care. The request does not include a written authorization or signed consent form from the patient. Because the request is focused on a form of reproductive health care, it is clear that the request is about legally protected health activity.
The Shield Law applies. The recipient must continue to Step 2.
An urgent care center receives a request seeking a patient’s test results for sexually transmitted infections in connection with a sexual assault investigation. Because the request specifically asks for records about the patient’s receipt of reproductive health care, it is clear that the request asks for legally protected health information.
The Shield Law applies. The recipient must continue to Step 2.
Note: While the request for medical records about sexually transmitted infection testing in this example is covered by the Shield Law, requests solely for the results of Sexual Assault Nurse Examinations (SANE), also known as rape kits, are not covered by the Shield Law because these examinations are used to collect evidence in connection with investigations of sexual offenses, rather than in connection with the provision or receipt of legally protected health care.
Requests that are unclear
In some cases, it may not be clear whether a subpoena or information request is about legally protected health activity, and whether it is therefore covered by the Shield Law. For instance, a request may not mention legally protected health activity, or expressly ask for legally protected health information, but the records that would be produced in response to the request may include some information about legally protected health activity. In this kind of situation, it is not clear whether that legally protected health information is being requested on purpose or is included only by chance.
When it is unclear whether a subpoena or information request is about legally protected health activity, the recipient is required to confirm that all of the following are true:
- The request is not about legally protected health activity.
- Any information about legally protected health activity that may be included in the response is inadvertent.
- The requestor is not seeking the information to punish legally protected health activity, and any produced information will not be used for that purpose.
The recipient should confirm all of these things are true by asking the requestor to provide a written statement, sworn and signed under penalty of perjury. The requestor can either fill out Part I of OAG’s Affirmation Form or provide a written statement, sworn and signed under penalty of perjury, that contains equivalent language (a Coverage Affirmation). The Coverage Affirmation may be included in or with the subpoena or information request itself. As long as the requestor provides the Coverage Affirmation, the recipient can rely solely on the affirmation, and is not required to follow further Shield Law Steps before responding to the request. Submitting a false affirmation is subject to penalties, described in a later section.
If the Coverage Affirmation is not provided, or indicates that the subpoena or information request is about or may be used to punish legally protected health activity, then the recipient must continue to Step 2 and take additional necessary Shield Law Steps before complying with the request.
Requested records include gender-affirming care
A hospital receives a subpoena for patient medical records in connection with a consumer fraud investigation. Although the request does not focus on legally protected health activity or explicitly ask for legally protected health information, the records that would be produced in response include medical records of patients who received gender-affirming health care, among other information.
In this case, it is not clear whether the request is covered by the Shield Law because the recipient would not be able to tell from the request whether the legally protected health care is the focus of the request or the legally protected health information is being requested on purpose.
Requested records include reproductive health care
A hospital receives a subpoena for medical records in connection with a lawsuit, and the request does not include a written authorization or signed patient consent form.
Although the request does not mention legally protected health activity or explicitly ask for legally protected health information, the requested medical records happen to include the patient’s pregnancy history. In addition, the records list birth control as one of the patient’s current medications. In this case, it is not clear whether the request is covered by the Shield Law because the recipient would not be able to tell whether legally protected health information is being requested on purpose.
Requested records include prescription that could be used for gender-affirming care
A pharmacy receives a subpoena that does not mention legally protected health activity, but requests records for prescriptions for puberty-blocking medications. Because puberty-blocking medications are used to treat gender dysphoria but are also used to treat other conditions unrelated to gender-affirming care, it is unclear whether legally protected health information is the focus of the request and is being requested on purpose. As a result, it is not clear whether this subpoena is covered by the Shield Law.
In each of these situations, the recipient of the information request (the hospital or pharmacy) cannot produce any records without first obtaining the Coverage Affirmation. If the Coverage Affirmation is provided and indicates that the subpoena or information request is not about and will not be used to punish legally protected health activity, the recipient is not required to take the rest of the Shield Law Steps before producing the records. If the Coverage Affirmation is not provided, or indicates that the subpoena or information request is about or may be used to punish legally protected health activity, then the recipient must continue to Step 2.
Step 2: Obtain the required Affirmation of Permitted Purpose
After determining that a subpoena or information request is about legally protected health activity, and thus covered by the Shield Law, the recipient must obtain an additional written statement from the person or entity requesting the information, before producing any records. This statement must be sworn and signed under penalty of perjury. This statement is to ensure that the request is for a permitted purpose. The statement must confirm either of the following:
- The requestor is not seeking the information, and the information will not be used, to punish legally protected health activity.
- The requestor is seeking the information for a tort or contract case that would be actionable in New York, and is brought by the patient themself (or their legal representative if they are not able to give consent because of injury or death). The requestor must specify whether they seek the information for a tort case or for a contract case.
To satisfy this requirement, the requestor should fill out Part II of the Affirmation Form, or provide a written statement that includes equivalent language (an Affirmation of Permitted Purpose). This statement must be sworn and signed under penalty of perjury.
If the requestor provides the necessary Affirmation of Permitted Purpose, the recipient can rely on this affirmation to determine which of the other Shield Law Steps apply. Submitting a false affirmation is subject to penalties, described in a later section.
If the requestor does not provide the Affirmation of Permitted Purpose, the recipient may not produce any records or information. In such cases, the recipient should still notify OAG using the official OAG notice form and may also need to notify any affected individuals using the process explained in Step 3 (see the following section). There are also protections and legal options that recipients can consider taking in these circumstances. These legal options are described in a later section.
Step 3: Notify OAG and affected individuals
In addition to obtaining the required Affirmation of Permitted Purpose, anyone receiving a subpoena or information request that is about legally protected health activity must notify OAG and affected individuals within a certain time frame. Recipients must specifically do all of the following:
- Notify OAG and provide OAG with a copy of the subpoena or information request (unless OAG itself issued the request). Recipients must provide this notice within five business days of receiving the inquiry, or five business days before the requested response date, whichever comes sooner. The notice to OAG must be provided within the required time period regardless of whether the recipient has decided to provide the records requested or to respond to the request in some other way. The recipient can provide this notice and upload documents on the OAG website.
- Make a reasonable effort to notify any individuals who engaged in legally protected health activity and whose legally protected health information would be included in the response, such as the patient, provider, or helper. This notice should be provided as soon as reasonably possible after receiving the request, and at minimum, must be provided at least 30 days before producing any information. Any verbal notice provided must be accompanied by notice in writing.
Step 4: Wait 30 calendar days
The recipient must wait 30 calendar days after notifying both OAG and any affected individuals before providing any records or information in response to the subpoena or request.
Circumstances when the Shield Law Steps may not be required
Generally, the recipient must take all four of the Steps described above before providing any information in response to the request. However, under certain circumstances, the recipient of a subpoena or information request may be allowed to disclose the information without taking one or more of the Shield Law Steps. Please refer to the Quick Reference Guide for a chart summarizing circumstances that may excuse certain Shield Law Steps.
Written requests by individuals, or their legal representatives, for their own records (including requests to entities covered under HIPAA)
The Shield Law is not intended to interfere when individuals or their legal representatives request information about their own legally protected health activity. Recipients of information requests may disclose information about legally protected health activity in response to a written request from a patient or their legal representative for the patient’s own records without taking any of the Shield Law Steps. Any information request accompanied by a written authorization or signed consent form meets this requirement. For entities that are covered under HIPAA, this requirement can be satisfied with a valid HIPAA authorization granting permission to release the records. The recipient must limit the disclosure to only those records that are necessary to fulfill the request.
A patient sends an email to their health care provider to request their own medical records and attaches a signed consent form.
In each of these situations, the recipient is not required to take any of the Shield Law Steps before responding.
Disclosures related to treatment and routine medical billing
The Shield Law does not change health care providers’ ability to exchange information with other health care providers to provide, coordinate, or manage health care for a specific patient, even if the information is about legally protected health activity. Health care providers may also continue to engage in activities related to routine billing for services provided to a specific patient, such as for any of the following:
- determining eligibility or coverage under an insurance plan
- submitting claims to insurers
- billing the patient
- engaging in collection activities
A written authorization or consent form signed by the patient (or their legal representative) permitting the release or sharing of their medical records for medical treatment or routine billing purposes is sufficient to allow disclosure for that purpose without taking any of the Shield Law Steps.
A health care provider complying with an information request under this exception must limit the disclosure to only those records that are necessary.
There are different rules for government audits of health care providers’ billing practices, which are described in a later section.
A minor patient and their parent arrive at a gender-affirming care clinic for a consultation about hormone therapy. The parent completes and signs a consent form allowing the clinic to release their child’s medical records to facilitate billing and payment. After the appointment, the clinic submits the bill for reimbursement to the insurance company. In response, the insurance company requests documentation related to the care provided at the appointment.
The clinic does not have to take any of the Shield Law Steps before responding.
Written request by the subject of the investigation or proceeding
Information about legally protected health activity can be disclosed in response to a written request from a person or entity who is the subject of an investigation or proceeding that is being conducted to punish legally protected health activity. The purpose of this exception is to ensure that people being investigated or punished for legally protected health activity can obtain the information they need to defend themselves. Such requests must be accompanied by a written statement, sworn and signed under penalty of perjury, confirming that the request is being used for this purpose. The requestor can use the Affirmation of Permitted Purpose form, or a written statement with equivalent language, sworn and signed under penalty of perjury. Once this affirmation is provided, the other Shield Law Steps are not required.
The recipient must limit the disclosure to only those records that are necessary to fulfill the request.
A doctor has been criminally charged by authorities in another state for allegedly prescribing abortion medications to a patient who lives in a state where abortion is banned. To support her own defense, the doctor submits a written request to a New York pharmacy seeking patient records related to the prescriptions she wrote.
The doctor must provide the required Affirmation of Permitted Purpose when making the request. Once the pharmacy receives the affirmation, it does not have to take any of the Shield Law Steps before responding.
Government grant-reporting requirements or audits
Recipients may share certain information necessary to comply with government audits or grant-reporting requirements without taking the Shield Law Steps, even if the information that is disclosed may contain information about legally protected health activity.
This exception to the Shield Law applies to federal grant-reporting requirements or audits. The OAG interprets this exception to apply equally to state grant-reporting or audit requirements.
Recipients may share the following specific information:
- information that has had all identifying data redacted and that is necessary to comply with grant-reporting or audit requirements
- information that contains identifying data only when that identifying data is strictly necessary to comply with an audit of specific services paid for by the government, such as claims paid by Medicare or Medicaid
A university gets federal funding to conduct research and is required to submit regular grant reports to demonstrate progress and outcomes.
The university may submit grant reports containing de-identified information and respond to related follow-up questions from the federal agency (or a private contractor that handles grant administration for the agency) without taking any of the Shield Law Steps.
A nursing home routinely gets reimbursed by Medicaid and Medicare for care of elderly patients and children with disabilities. An auditor from a state agency requests information related to the claims it submitted for specific residents to ensure compliance with reimbursement requirements.
The nursing home may submit identifying information for claims paid, to the extent strictly necessary to comply with the request, without taking any of the Shield Law Steps.
Court orders enforceable in New York
In some cases, a court order may require the recipient to comply with a subpoena or information request without taking one or more of the Shield Law Steps, such as the notice or waiting periods. For example, a court order may require that the information requested be provided before the 30-day waiting period has passed, or that the request be kept confidential. If a court order changes or eliminates only one of the Steps (for example, by setting a shorter time frame for a response than 30 days), the other Steps still apply.
However, a court order can change these requirements only if it is enforceable in New York. Subpoenas (unless so-ordered and signed by a judge from a New York court), civil investigative demands, and court orders issued by courts outside of New York are generally not court orders enforceable in this state. On their own, these types of orders do not excuse a recipient from taking the Steps described earlier. To be enforceable, a court order must be enforceable in New York and issued by a court of competent jurisdiction (for example, a New York state court).
A hospital receives a subpoena seeking medical records about a patient who received emergency contraception (Plan B). The subpoena does not include a written authorization or signed consent form from the patient. The subpoena has a seven-day return date, and is so-ordered and signed by a New York state court judge.
The subpoena is covered by the Shield Law because it asks for information about the provision of emergency contraception, which is legally protected health information. However, because it was signed by a New York state judge and has a seven-day response deadline, it qualifies as a valid and enforceable court order lifting the 30-day waiting period. The hospital may produce the records by the return date, but must comply with the rest of the Shield Law Steps, unless any other circumstances change or eliminate any of the Steps.
A hospital receives a civil investigative demand from OAG seeking medical records about a patient who received emergency contraception (Plan B). The demand does not include a written authorization or signed consent form from the patient. The demand requests a response within ten days.
The civil investigative demand is covered by the Shield Law because it asks for information about the provision of emergency contraception, which is legally protected health information. However, a civil investigative demand is not a valid, enforceable court order. The hospital must still take each of the Shield Law Steps, unless any other circumstances change or eliminate any of the Steps. In this case, notice to OAG is not required because OAG is the issuing entity.
Investigations into conduct that would violate New York law
The Shield Law does not prohibit the disclosure of information in connection with government or law enforcement investigations into conduct that would violate New York law. This exception applies to both civil and criminal investigations.
Importantly, the recipient of a subpoena or information request may not know whether the conduct being investigated would actually violate New York law. For example, in some cases, states that are hostile to abortion and gender-affirming care have attempted to hide behind neutral-seeming state laws to punish health care that the state disagrees with — even though the care was provided in a state where the care is legal.
Because of these efforts by hostile states, recipients of requests covered by the Shield Law must still take all of the Shield Law Steps before disclosing the records, even if a request claims to be about conduct that could violate New York law. Taking the Steps is required unless any other circumstances eliminate or change any of the Steps, including a valid, enforceable court order.
A hospital receives a request for medical records about a patient who received emergency contraception (Plan B) in connection with a sexual assault investigation. The request does not include a written authorization or signed consent form from the patient. This request is covered by the Shield Law because it asks for legally protected health information. The request also qualifies as an investigation into conduct that would violate New York law because it concerns sexual assault.
The hospital must still take each of the Shield Law Steps, unless any other circumstances change or eliminate any of the Steps, including a valid, enforceable court order.
Requests that qualify for multiple circumstances that could change the Shield Law Steps
Depending on the circumstances, a request may qualify for more than one circumstance that may affect the Shield Law Steps. In such cases, the recipient can follow the rule that requires the fewest Shield Law Steps.
A hospital receives a request for medical records about a patient who received emergency contraception (Plan B) in connection with a sexual assault investigation. This request is about legally protected health activity, but qualifies as an investigation into conduct that would violate New York law. Under that circumstance, the hospital must take the Shield Law Steps before responding to the request, unless one or more of those Steps is excused by a valid, enforceable court order. However, if the patient provides a valid HIPAA authorization, then the hospital can provide the requested records without taking any of the Shield Law Steps.
Protections for recipients of requests covered by the Shield Law and penalties for noncompliance
Protections and legal options for recipients of Shield Law requests
Individuals, groups, or businesses that receive a subpoena or information request about legally protected health activity can bring a lawsuit in New York to challenge that request and seek a court order declaring that they do not need to comply. If they win, they can obtain reasonable costs and fees. Such a challenge must be started within one year of receiving or being served the request, whichever comes later. The party bringing the lawsuit must serve OAG with the lawsuit, either before the suit is filed or at the time of filing. The OAG has the right to intervene in the court case.
In addition, there are other legal options for challenging a subpoena, such as asking a court to quash, fix the conditions of, or modify the subpoena. These options are available to subpoena recipients and others who are affected, such as patients or providers whose medical records could be released in response to the subpoena.
Recipients of covered requests cannot be held in contempt or otherwise legally punished in New York if the Shield Law delays or prohibits their compliance with a covered subpoena or information request, unless the recipient violated a specific court order that is enforceable in New York.
Penalties for violating Shield Law requirements
Violating the Shield Law can result in monetary penalties:
- Intentionally, knowingly, willingly, or recklessly failing to take the required Steps, or disclosing information that is not permitted to be disclosed under the Shield Law can incur a penalty of $10,000.
- Submitting any false affirmation can incur a penalty of $15,000. Anyone who submits a false affirmation is subject to New York law and the jurisdiction of New York courts.
Electronic communications service providers who receive warrants
Specific rules apply to electronic communications service (ECS) providers headquartered or incorporated in New York. An ECS provider is any business or organization that allows a user to send or receive an email or direct message. An ECS provider that receives a warrant issued by another state cannot cooperate with the warrant if the warrant seeks records that would reveal certain customer information, and if the ECS provider is aware that the warrant is being used, or will be used, to punish legally protected health activity.
Protected customer information includes:
- customer identity
- any data stored by or on behalf of customers
- customer use of the provider’s services
- recipient or destination of communications sent to or from customers
- content of any customer communications
The ECS provider can comply with the warrant if the warrant is accompanied by a sworn statement or affirmation that the evidence sought will not be used to punish legally protected health activity, or if the warrant is for a tort or contract case that would be actionable in New York and that is brought by the patient themself (or their legal representative if they are unable to give consent because of injury or death). Such a tort or contract case could be, for instance, a medical malpractice claim.
Protections for parents, children, and families
Parents and guardians cannot be punished for engaging in legally protected health activity, or for allowing their child to do so.
New York family courts cannot apply laws from other states that punish legally protected health activity. In a similar way, New York family courts cannot consider other state courts’ findings that a parent or guardian abused or neglected their child by engaging in legally protected health activity, or by allowing their child to do so, unless the conduct would separately be considered abuse or neglect under New York law.
Protections for attorneys and health care providers
In addition to offering the protections described in previous sections, the Shield Law prohibits punishing attorneys and health care providers for engaging in or supporting legally protected health activity.
Professional discipline
Attorneys cannot be professionally disciplined for representing or advising someone who engaged in legally protected health activity. Professional licensing bodies in New York cannot discipline health care providers for engaging in legally protected health activity. This protection applies to health care professionals, including doctors, nurses, therapists, speech pathologists, mental health practitioners, and advanced practice clinicians.
Professional liability and malpractice insurance
Medical malpractice or professional liability insurers cannot penalize a health care provider for engaging in legally protected health activity. Examples of this type of prohibited conduct include refusing to renew the provider’s contract, raising their rates, changing their policy coverage, or reporting the provider to other parties for investigation.
Right to sue
Anyone who is targeted with a lawsuit or criminal charges for engaging in legally protected health activity can bring a lawsuit, in New York state court, against the person or organization that initiated legal action against them. The plaintiff can seek compensation, plus costs and legal fees associated with bringing their claim. Such claims must be brought within six years.
A woman in Idaho obtains a medication abortion through a telehealth provider located in New York. The woman’s ex-boyfriend, who claims to be the fetus’s father, brings a lawsuit in Idaho against the telehealth provider for violating Idaho’s abortion ban. Using New York’s Shield Law, the provider may bring a lawsuit against the ex-boyfriend in New York state court seeking monetary damages and legal fees.
Enforcement by OAG
If a person or organization violates the Shield Law or there is reason to believe they will do so, OAG can bring a lawsuit in New York courts to enforce the law’s protections. Such a lawsuit could include:
- suing the requestor or the recipient of the request to prevent the disclosure of information about legally protected health activity
- prosecuting false affirmations submitted with subpoenas or deposition orders
Health Insurance Portability and Accountability Act (HIPAA)
Protected health information (PHI) is safeguarded by federal and state health privacy laws, including HIPAA. Under HIPAA, covered health entities, such as health plans and providers, must have appropriate safeguards to protect information from disclosure. Covered entities must get express permission to share PHI, except in limited situations when PHI can be shared without consent. Individuals have the right to examine their own records, transmit the information to others with permission, and request corrections. For more information about protections for PHI, visit the HIPAA webpage on the New York Office of Mental Health website.
Additional protections for electronic health information
For organizations and businesses not covered by HIPAA, there are additional protections for electronic health information. Without a warrant, law enforcement officers cannot buy or otherwise obtain any electronic data held by non-HIPAA-covered organizations that would reveal information about a person’s physical or mental health or disability.
Such information could include:
- the person’s attempt to obtain any form of health care
- the person’s health condition or treatment
- location information associated with a health care facility used by the person
- the person’s payment for services
These protections cover not only legally protected health care, but also all forms of health care. In other words, non-HIPAA organizations cannot give law enforcement any electronic information that would reveal an individual’s health care information, unless the law enforcement representative has a warrant.
Address Confidentiality Program
For people who fear for their own or another’s safety due to their involvement with legally protected health activity, the New York Department of State offers a program that prevents personal addresses from being revealed in public documents. Apply to the Address Confidentiality Program or call 1-855-350-4595.