HIPAA compliance for pediatric practices in New York

New York keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, New York has 8 recorded rules that apply to pediatric practices differently from other businesses in the state — set out below with their conditions and sources.

New York jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether New York's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Pediatric practices that electronically conduct claims, eligibility, authorization, or other adopted transactions are HIPAA covered entities. Once covered, the duties below are required, including the additional work of managing parents, minors, personal representatives, and age-dependent confidentiality.

State — how New York law interacts with HIPAA

New York substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Pediatric practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Where an entity provides individual notice under HIPAA/HITECH, § 899-aa(2)(b) provides that such notice satisfies the individual-notification requirement of § 899-aa. State regulator obligations under § 899-aa(8) and the HIPAA-specific AG-notification obligation under § 899-aa(9) still apply.

What New York adds for pediatric practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not New York's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A minor voluntarily seeking outpatient mental health services may receive them without parental consent where the practitioner determines that the minor is knowingly and voluntarily seeking the services, that provision of the services is clinically indicated and necessary to the minor's well-being, and that either a parent or guardian is not reasonably available, or requiring parental consent would have a detrimental effect, or a parent or guardian has refused consent and a physician determines treatment is necessary.

Service: outpatient mental health services
Patient population: minors voluntarily seeking services

Reaches this practice type when the practice itself provides outpatient mental health services.

What this means operationally

New York sets no age floor and no session cap. The gate is a three-part clinical determination instead, so what the record has to carry is the reasoning rather than a date of birth or a visit count. A practice that ports Ohio's six-session counter or Illinois's eight-session rule here will be tracking something New York does not measure, and will still be missing the determination New York does require.

Applies when

The minor is knowingly and voluntarily seeking the services
The services are clinically indicated and necessary to the minor's well-being
A parent or guardian is not reasonably available, or parental consent would have a detrimental effect on treatment, or a parent or guardian has refused consent and a physician determines treatment is necessary

State statuteN.Y. Mental Hyg. Law § 33.21(a), (c)Minors voluntarily seeking outpatient mental health servicesVerified 2026-08-29

Left to professional judgment

Medical, dental, health and hospital services may be rendered to persons of any age without the consent of a parent or legal guardian where, in the physician's judgment, an emergency exists and the person is in immediate need of medical attention and an attempt to secure consent would result in delay of treatment which would increase the risk to the person's life or health.

Provider class: a physician
Service: emergency medical, dental, health or hospital services

What this means operationally

The test is not that an emergency exists but that SEEKING CONSENT would itself increase the risk — two findings, and the second is the one a record usually fails to show. There is no age floor and no requirement that the parent be unreachable, which distinguishes it from the Florida and Virginia emergency routes.

Applies when

In the physician's judgment an emergency exists and the person is in immediate need of medical attention
An attempt to secure consent would delay treatment and increase the risk to life or health

State statuteN.Y. Pub. Health Law § 2504(4)Persons of any age in a medical emergencyVerified 2026-08-29

Minor may consent

A licensed physician, or a staff physician of a hospital, may diagnose, treat or prescribe for a person under the age of twenty-one years for a sexually transmitted disease or exposure to one, without the consent or knowledge of the parents or guardian.

Provider class: a licensed physician, or a staff physician of a hospital
Service: diagnosis, treatment or prescribing for a sexually transmitted disease or exposure to one
Patient population: persons under 21

What this means operationally

The threshold is twenty-one, not eighteen — the widest age reach of any consent provision in this corpus, and it means an adult patient of nineteen or twenty is inside a rule written about minors. Note the statute says without the parents' consent OR KNOWLEDGE, which is a confidentiality instruction sitting inside a consent provision, and it pairs with the records prohibition in Public Health Law § 17.

Applies when

The patient is under 21
The care concerns a sexually transmitted disease or exposure to one

State statuteN.Y. Pub. Health Law § 2305(2)Persons under 21Verified 2026-08-29

Minor may consent

A minor sixteen years of age or older may be provided psychotropic medications without parental consent where the minor has the capacity to consent and the medications are in the minor's best interests, and additionally: the parent or guardian is not reasonably available; or parental involvement would be detrimental and the treating physician and a psychiatrist who is not an employee of the hospital agree; or the parent has refused consent and both physicians agree. Where consent was refused, notice must be given to the parent or guardian. The basis for proceeding under any of these exceptions must be documented in the clinical record.

Service: psychotropic medication
Patient population: minors 16 and older
Provider class: the treating physician, with a psychiatrist who is not an employee of the hospital where applicable

Reaches this practice type where the practice prescribes psychotropic medication to minors.

What this means operationally

New York separates medication from therapy and sets a higher bar for it: sixteen rather than the general minor threshold, a capacity finding, and in two of the three branches a SECOND physician who is not employed by the hospital. That independence requirement is the operationally hard part — it cannot be satisfied inside the treating institution, so a practice relying on this route needs an external psychiatrist arrangement in place before the situation arises.

Applies when

The minor is 16 or older and has capacity to consent
The medications are in the minor's best interests
One of the three parental circumstances applies

Exceptions

Two of the three branches require the concurrence of a psychiatrist who is not an employee of the hospital
Where the parent refused consent, notice of the determination must be given

State statuteN.Y. Mental Hyg. Law § 33.21(e)Minors 16 and older receiving psychotropic medicationVerified 2026-08-29

Minor may consent

The consent of a parent or guardian is required for outpatient mental health services for a minor, and for psychotropic medications for a hospitalised minor in a non-emergency, except as provided in subdivisions (c), (d) and (e).

Service: outpatient mental health services, and psychotropic medications for hospitalised minors

Reaches this practice type where the practice delivers outpatient mental health services.

What this means operationally

Worth recording as its own rule rather than leaving implied, because it is what makes the rest of § 33.21 read correctly. New York's default is parental consent and the minor-consent routes are departures from it — the opposite of Washington, where an adolescent's own request is the ordinary route. A policy written from the exceptions alone will describe New York as more permissive than it is.

Applies when

A minor is receiving outpatient mental health services, or a hospitalised minor is to receive psychotropic medication in a non-emergency

Exceptions

Subdivision (c) allows outpatient services without parental consent on the stated findings
Subdivision (d) allows an initial interview without parental consent
Subdivision (e) allows psychotropic medication for a minor 16 or older on the stated findings

State statuteN.Y. Mental Hyg. Law § 33.21(b)Minors receiving outpatient mental health servicesVerified 2026-08-29

Parental access to records

Release prohibited

Records concerning the treatment of an infant for venereal disease or the performance of an abortion shall not be released, or in any manner be made available, to the parent or guardian of such infant.

Service: records concerning treatment for venereal disease or the performance of an abortion
Patient population: infants, meaning persons under 18 in New York usage

What this means operationally

An outright prohibition, not a permission to withhold — there is no clinical-judgment test to apply and no discretion to exercise, which distinguishes it from the Virginia and Colorado provisions where a clinician decides. That makes it a records-system problem rather than a clinical one: if a parent portal or a combined record can surface these encounters, the prohibition is being breached by configuration.

Applies when

A parent or guardian seeks the record of an infant's venereal disease treatment or abortion

State statuteN.Y. Pub. Health Law § 17Minors treated for venereal disease, or who had an abortionVerified 2026-08-29

Provider disclosure to a parent

Provider may disclose, subject to a test

Where treatment proceeds because a parent or guardian has refused consent and a physician has determined treatment is necessary, notice of that determination shall be provided to the parent or guardian as clinically appropriate.

Service: outpatient mental health services provided under § 33.21(c)
Patient population: minors treated over a parent's refusal

Reaches this practice type when the practice provided services under § 33.21(c).

What this means operationally

The notice duty attaches to one of the three routes into treatment and not to the others, so the workflow has to know which determination opened the case. It is also qualified by clinical appropriateness rather than being automatic, which means the decision to give or withhold notice is itself a clinical judgment that belongs in the record.

Applies when

Treatment proceeded under the parental-refusal limb of § 33.21(c)
Notice is clinically appropriate

State statuteN.Y. Mental Hyg. Law § 33.21(c)Minors treated under the parental-refusal limbVerified 2026-08-29

Who may act for the patient

Minor may consent

Consent to the immunization of a child may be given by a person in parental relation to the child, by a grandparent, adult brother or sister, or adult aunt or uncle who has assumed care of the child, or by an adult who has written authorization from a person in parental relation — unless that person knows a parent objects.

Service: immunization of a child

What this means operationally

New York confines its substitute-consent list to IMMUNIZATION, where Texas, Florida, Virginia and Washington run general lists. So a relative who may lawfully consent to a vaccination in New York has no authority at all over the visit that surrounds it, and a practice combining an immunization with a well-child examination is dealing with two different consent questions in one appointment.

Applies when

The service is the immunization of a child

Exceptions

No one on the list may consent where they know a parent objects

State statuteN.Y. Pub. Health Law § 2504(5)Children presenting for immunizationVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

New York breach obligations

These apply to businesses generally rather than to pediatric practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

New Yorkbreach data →

Individual notice deadline

In the most expedient time possible and without unreasonable delay, and no later than 30 days after discovery, subject to the statutory law-enforcement delay.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required

Notice must be provided to the New York State Attorney General, the New York State Department of State, and the New York State Division of State Police.

Source: N.Y. Gen. Bus. Law § 899-aa(2)

Statewide rules that also reach pediatric practices

Minor may consent

Any person who is eighteen years of age or older, or is the parent of a child, or has married, or is a homeless youth, may give effective consent for medical, dental, health and hospital services for themselves, and the consent of no other person is necessary. Any person who has been married or has borne a child may give effective consent for such services for their child, and a pregnant person may give effective consent for medical, dental, health and hospital services relating to prenatal care.

What this means operationally

New York's general consent statute runs on STATUS and reaches the whole of medical, dental, health and hospital services rather than a list of conditions, which makes it the route that reaches a dental chair. It names homeless youth in the statute itself rather than through a separate certification scheme, and the minor-parent limb extends to the minor's child, so a pediatric practice may be taking consent from a minor for the baby.

Applies when

The person is 18 or older, is a parent, has married, or is a homeless youth
Or is consenting for their own child, having married or borne a child
Or is pregnant and the services relate to prenatal care

Exceptions

Consent for the minor's child does not reach major medical treatment, electroconvulsive therapy, or withdrawal of life-sustaining treatment

StatewideN.Y. Pub. Health Law § 2504(1)-(3)Minors who are parents, married, pregnant or homeless youthVerified 2026-08-29

Consent deemed effective

Anyone who acts in good faith based on the representation by a person that they are eligible to consent under § 2504 shall be deemed to have received effective consent.

What this means operationally

The same safety valve Minnesota, Maryland and Texas each build, and it is what makes the status routes in § 2504(1)-(3) workable — married, parenting and homeless-youth status cannot be verified at the desk. What is protected is good-faith reliance on a REPRESENTATION, so the record should capture what the patient said about their eligibility, not merely that treatment proceeded.

Applies when

A person represented that they are eligible to consent under § 2504

Exceptions

The reliance must be in good faith

StatewideN.Y. Pub. Health Law § 2504(6)Persons representing eligibility to consentVerified 2026-08-29

Duty to keep an accurate record

UNPROFESSIONAL CONDUCT shall also include, in the enumerated professions, FAILING TO MAINTAIN A RECORD FOR EACH PATIENT WHICH ACCURATELY REFLECTS THE EVALUATION AND TREATMENT OF THE PATIENT.

What this means operationally

New York states the whole record-content duty in one clause, and the standard is ACCURATE REFLECTION rather than an enumerated content list — unlike Colorado, Florida or Texas, which prescribe elements. That makes the duty harder to audit against a checklist and easier to breach through drift: a template-driven note that no longer reflects what was actually evaluated and done fails this even though every field is populated. Because it is framed as unprofessional conduct, the consequence runs through license discipline against the individual practitioner.

Applies when

A licensed practitioner in one of the enumerated professions treats or evaluates a patient

Statewide8 N.Y.C.R.R. § 29.2(a)(3)Patients of a New York licensed health professionalVerified 2026-08-30

How long the record must be kept

UNLESS OTHERWISE PROVIDED BY LAW, ALL PATIENT RECORDS MUST BE RETAINED FOR AT LEAST SIX YEARS. OBSTETRICAL RECORDS AND RECORDS OF MINOR PATIENTS must be retained for AT LEAST SIX YEARS, AND UNTIL ONE YEAR AFTER THE MINOR PATIENT REACHES THE AGE OF 21 YEARS.

What this means operationally

Six years is the general period, and the minor rule is the one most often misstated. The text imposes BOTH a six-year minimum AND a minimum of one year past the patient's twenty-first birthday — conjunctive, not alternative, and not the three-years-after-eighteen formulation that circulates. Resist the tempting shorthand: age twenty-two is an AGE FLOOR rather than a destruction date, because the rule never says what the six years run FROM, so the actual endpoint cannot be computed from this authority alone. A practice needs the later of the two, and one of the two is unquantifiable here. Obstetrical records sit on the same extended clock as minors' records regardless of the mother's age, which is a record-class rule a general-practice retention schedule will miss. The opening qualifier matters too: six years yields to any longer period provided by other law, which for a New York practice includes federal program requirements. ONE THING THE RULE DOES NOT SAY: it states no CLOCK. Six years from what is left unstated — not from last treatment, not from creation, not from discharge. The trigger is recorded as NOT_SPECIFIED_BY_THIS_AUTHORITY rather than assumed, because picking one would invent a rule New York has not written, and the safe operational reading is to measure from the latest defensible event in the file rather than the earliest.

Applies when

A New York licensed practitioner in one of the enumerated professions holds a patient record

Exceptions

A longer period provided by other law prevails
Obstetrical records and records of minor patients carry the extended endpoint

Statewide8 N.Y.C.R.R. § 29.2(a)(3)Patients of a New York licensed health professionalVerified 2026-08-30

What applies to pediatric practices everywhere

Pediatric privacy is not simply adult privacy with a parent copied. Access rights can change based on the child's age, custody status, the service provided, who consented to the care, and state law. The SRA and compliance program must account for those changing relationships.

The EHR and patient portal, including proxy, parent, guardian, adolescent, and transitioning-adult access

Immunization registry, public-health, school, daycare, camp, sports, and specialty-referral workflows

Systems containing reproductive-health, mental-health, substance-use, STI, or other state-protected adolescent records

Custody, guardianship, foster-care, personal-representative, and restricted-access documentation

Claims, laboratories, e-prescribing, messaging, email, text, e-fax, and patient forms

Workforce access to sensitive pediatric and adolescent information

Full pediatricscompliance guide →

Knowing the New York rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the New York rules on this page.

Start the risk assessment