Shield Law reporting form
The New York Shield Law prevents disclosure of records or information relating to legally protected health activity except under limited circumstances. In addition to barring state and local officials from cooperating with requests for information that fall under the Shield Law, the law requires any individual or entity receiving a request for protected information, including corporations and health care providers, to take certain steps before they can disclose that information, including notifying the Office of the Attorney General (OAG).
Please use the form below if you or the entity you represent has received a subpoena/information request covered by the Shield Law and need to provide notice to OAG. Notice is required within 5 days of receiving any request or 5 days prior to compliance whichever comes first.
Legally protected health activity includes the following actions taken by providers, facilitators, seekers, and recipients of reproductive health care and gender-affirming care, as long as those actions are lawful in New York:
- The receipt or attempt to receive reproductive health care or gender-affirming care, regardless of such person’s location;
- Any act or omission undertaken while physically present in this state to aid or encourage, or attempt to aid or encourage, any person in the receipt of or attempt to receive reproductive health care or gender-affirming care, regardless of the location of the recipient or providers of such care;
- The provision of or attempt to provide insurance coverage for reproductive health care or gender-affirming care, by any entity located, headquartered, or incorporated in the state, regardless of the location of the recipient or provider of such care; or
- The provision of or attempt to provide reproductive health care or gender-affirming care by a person duly licensed under the laws of this state and physically present in this state, regardless of the recipient’s location.
Relevant law: N.Y. Criminal Procedure Law § 570.17
Specifically, any person or entity located, headquartered, or incorporated in New York that receives any civil, criminal, or regulatory inquiry, investigation, subpoena, or summons for information (“subpoena/information request”) relating to legally protected health activity must take the following steps before they may comply with such a request:
- Notify the Office of the New York State Attorney General (OAG) within 5 business days of receiving the subpoena/information request or 5 days prior to any compliance, whichever comes first; and
- Provide OAG with a copy of the subpoena/information request and any related materials within the same timeframe (unless there is a court order enforceable in New York, issued by a court of competent jurisdiction, preventing them from doing so). Relevant law: N.Y. General Business Law § 394-i.
- Confirm that subpoena or information request includes an affirmation that it satisfies other requirements of the law.
Note that the above requirements do not apply to (a) written requests from patients (or their legal representatives) for their own records, or (b) requests that incidentally include information regarding legally protected health activity but where that activity is not the focus of the request. This includes requests accompanied by a valid HIPAA form that authorizes release of information regarding a patient’s legally protected health activity; such a HIPAA authorization constitutes a written request from the patient for their own medical records. The new provisions also do not prohibit compliance with a valid and enforceable federal court order, with routine grant reporting obligations, or with a request for information about alleged activity that, if proven, would violate the laws of this state.
Relevant law: N.Y. General Business Law § 394-i