Krueger, Rosenthal, James, Legislators, Advocates Call on Governor Hochul to Act on Health Data Privacy Bill
March 27, 2025
In Light of Privacy Concerns Stemming from 23andMe Bankruptcy and Trump Administration Attacks on Reproductive Care, Group Calls on Governor to Sign Health Information Privacy Act Immediately
Albany – Senator Liz Krueger and Assemblymember Linda Rosenthal, along with Attorney General Letitia James, legislative colleagues, and advocates, are calling on Governor Hochul to immediately sign the New York Health Information Privacy Act (S.929/A.2141). In light of the privacy concerns laid bare by the bankruptcy of DNA testing company 23andMe -- which prompted Attorney General Letitia James to urge customers to delete their data -- as well as the Trump Administration's ongoing attacks on reproductive rights, the group argues that urgent action is required to protect New Yorkers. The bill would regulate companies that collect and sell healthcare information, and provide additional rights and protections to consumers related to the sale of their private health information. It passed both houses of the Legislature earlier this year.
"Most New Yorkers think their healthcare data is their own, that's it's protected by federal HIPAA laws and is sacrosanct. But that could not be further from the truth," said Senator Krueger. "The 23andMe bankruptcy should be a wake-up call. Our health data is being collected, tracked, and sold to third parties by the very companies that are supposed to be taking care of us - including women's health apps, which tend to have vague or hard-to-find privacy policies. This critical legislation will empower New Yorkers by giving them control over how their health data is used - and it could not be more urgently needed. At this time when our privacy rights are under fierce attack, I urge Governor Hochul to act now and sign the bill."
“Unbeknownst to most New Yorkers, their healthcare data is up for grabs,” said Assemblymember Linda B. Rosenthal (D/WF-Manhattan), Chair of the Assembly Committee on Housing. “The bankruptcy filing by 23andMe underscores the need for tougher restrictions on the sale and dissemination of health information by commercial companies. It is high time, especially as the Trump Administration escalates its war on abortion and gender-affirming care, that New York safeguards its residents’ data. We must recognize the urgent nature of this moment, which is why it’s critical that Governor Hochul sign our Data Health Privacy Act into law.”
New York Attorney General Letitia James said: "New Yorkers deserve to have control over their most sensitive health information, but too often, companies exploit loopholes to collect, share, and profit from our private data. The bankruptcy of 23andMe is just the latest reminder that without strong protections, everyone's personal health information is vulnerable. I was proud to support this legislation, and I applaud the bill sponsors for taking this crucial step in safeguarding New Yorkers’ privacy. I look forward to seeing this important legislation signed into law as part of our ongoing efforts to protect New Yorkers' rights and privacy."
From fitness trackers to smartwatches to period tracking apps, New Yorkers increasingly use apps, devices, and other digital tools to monitor and maintain their physical and mental health. Because these tools process health information, many New Yorkers think they are protected by the federal Health Insurance Portability and Accountability Act (HIPAA). But this information is not protected by HIPAA or any other privacy protection.
In the wake of the Supreme Court’s decision to overturn Roe v. Wade, the stakes are even higher. It is nearly impossible to have an abortion without leaving a digital trail. There will be search histories; possibly phone records, travel itineraries, or fitness tracker or period-tracker app data; changes in purchasing history that suggest a pregnancy; and the list goes on. In fact, electronic health data have already been used to prosecute people for supporting others to access abortion care.
This past Sunday, DNA testing company 23andMe filed for bankruptcy and announced it is seeking a buyer. There is widespread uncertainty about what will happen to the genetic and other health information of the company's 15 million customers when the company is purchased. This has led to many sources, including Attorney General James and California Attorney General Rob Bonta, to advise 23andMe customers to attempt to delete their data from the company's database.
S929/A2141 will holistically protect New Yorkers’ electronic health data as well as electronic health data generated in New York. It will give New Yorkers control over their electronic health data and the ability to protect themselves from companies that may improperly use that data or share it with third parties, including law enforcement.
This groundbreaking legislation would create a legal framework for New Yorkers to reclaim and retain control of their healthcare information. Apps or websites that are designed to provide a diagnosis or retain health information will be required to receive affirmative consent by the user to retain such information and would need separate consent to sell such information to third-parties.
"Most New Yorkers think their healthcare data is their own, that's it's protected by federal HIPAA laws and is sacrosanct. But that could not be further from the truth," said Senator Krueger. "The 23andMe bankruptcy should be a wake-up call. Our health data is being collected, tracked, and sold to third parties by the very companies that are supposed to be taking care of us - including women's health apps, which tend to have vague or hard-to-find privacy policies. This critical legislation will empower New Yorkers by giving them control over how their health data is used - and it could not be more urgently needed. At this time when our privacy rights are under fierce attack, I urge Governor Hochul to act now and sign the bill."
“Unbeknownst to most New Yorkers, their healthcare data is up for grabs,” said Assemblymember Linda B. Rosenthal (D/WF-Manhattan), Chair of the Assembly Committee on Housing. “The bankruptcy filing by 23andMe underscores the need for tougher restrictions on the sale and dissemination of health information by commercial companies. It is high time, especially as the Trump Administration escalates its war on abortion and gender-affirming care, that New York safeguards its residents’ data. We must recognize the urgent nature of this moment, which is why it’s critical that Governor Hochul sign our Data Health Privacy Act into law.”
New York Attorney General Letitia James said: "New Yorkers deserve to have control over their most sensitive health information, but too often, companies exploit loopholes to collect, share, and profit from our private data. The bankruptcy of 23andMe is just the latest reminder that without strong protections, everyone's personal health information is vulnerable. I was proud to support this legislation, and I applaud the bill sponsors for taking this crucial step in safeguarding New Yorkers’ privacy. I look forward to seeing this important legislation signed into law as part of our ongoing efforts to protect New Yorkers' rights and privacy."
From fitness trackers to smartwatches to period tracking apps, New Yorkers increasingly use apps, devices, and other digital tools to monitor and maintain their physical and mental health. Because these tools process health information, many New Yorkers think they are protected by the federal Health Insurance Portability and Accountability Act (HIPAA). But this information is not protected by HIPAA or any other privacy protection.
In the wake of the Supreme Court’s decision to overturn Roe v. Wade, the stakes are even higher. It is nearly impossible to have an abortion without leaving a digital trail. There will be search histories; possibly phone records, travel itineraries, or fitness tracker or period-tracker app data; changes in purchasing history that suggest a pregnancy; and the list goes on. In fact, electronic health data have already been used to prosecute people for supporting others to access abortion care.
This past Sunday, DNA testing company 23andMe filed for bankruptcy and announced it is seeking a buyer. There is widespread uncertainty about what will happen to the genetic and other health information of the company's 15 million customers when the company is purchased. This has led to many sources, including Attorney General James and California Attorney General Rob Bonta, to advise 23andMe customers to attempt to delete their data from the company's database.
S929/A2141 will holistically protect New Yorkers’ electronic health data as well as electronic health data generated in New York. It will give New Yorkers control over their electronic health data and the ability to protect themselves from companies that may improperly use that data or share it with third parties, including law enforcement.
This groundbreaking legislation would create a legal framework for New Yorkers to reclaim and retain control of their healthcare information. Apps or websites that are designed to provide a diagnosis or retain health information will be required to receive affirmative consent by the user to retain such information and would need separate consent to sell such information to third-parties.
Senate Deputy Leader Michael Gianaris said: "So much sensitive personal data has already been commodified, and now there is potential that the most sensitive information — a person's DNA and family history — could be for sale to the highest bidder. People should be able to trust that their private information will be protected from bankruptcy or other mismanagement."
Senator Jeremy Cooney said: “Every New Yorker deserves the right to privacy, especially when it comes to their sensitive healthcare data. Whether it’s information on reproductive healthcare, mental healthcare, or any data on their devices, it’s vital that we protect this data from falling into the wrong hands. I want to thank Senator Krueger and Assemblymember Rosenthal for their leadership and I join their calls to have this bill signed which would put control of sensitive data back in the hands of New Yorkers.”
Senator Kristen Gonzalez said: “New Yorkers have a right to privacy and a right to healthcare access. In a time where these rights are being infringed upon, we need to protect New Yorkers from having their health data shared with any outside entities, a move much needed to reaffirm the safety of accessing reproductive care without fear of prosecution.”
Senator Brad Hoylman-Sigal said: “Just like medical records, electronically collected health data is personal and should be private unless a patient chooses to share it. The recent bankruptcy of genetic testing company 23andMe raises serious concerns about what will now happen to the sensitive information they have collected. It is crucial that Governor Hochul sign the legislation we have already passed to address this issue, sponsored by Senator Krueger and Assemblymember Rosenthal. Doing so would give New Yorkers ownership of their electronic health data and limit the ability of private companies, like 23andME, or government entities, from selling or sharing their data without affirmative consent.”
Senator Robert Jackson said: "At a moment when our most personal information is under siege—from corporate profiteers to political extremists—Governor Hochul must stand with the people and sign the Health Data Privacy Bill without delay. This legislation is not just a line of defense; it is a line in the sand. Our health decisions, our bodies, our futures—these are not for sale. With this legislation, we say loud and clear: New Yorkers will not be tracked, targeted, or traded. We demand protection. We demand dignity. And we demand it now."
Senator Brian Kavanagh said: "Many New Yorkers may believe their health data is protected, but the reality is that tech companies and data brokers are collecting, selling, and exploiting personal health information without meaningful consent. Thanks to the leadership of Senator Krueger and Assemblymember Rosenthal, we’ve passed this critical legislation that would empower New Yorkers to take back control of their private health data. I urge Governor Hochul to sign this bill into law."
Senator John Liu said: "The information we share online is increasingly subject to marketing, manipulation and misrepresentation. Our personal health data is among the most sensitive information we have, consisting of medical decisions and private lives, but it remains unprotected and subject to exploitation by companies like 23andMe, who are currently attempting to auction off the genetic information of 15 million customers. We need to put the control of our personal health data back in the hands of New Yorkers. Much thanks Senator Krueger and Assembly Member Rosenthal for fighting to safeguard the privacy of our most sensitive information."
Senator Christopher J. Ryan said: “The bankruptcy of 23andMe is a stark reminder of the risks posed when genetic data is left unprotected. Millions of consumers trusted these companies with their most personal information. Now, their privacy hangs in the balance. Senate Bill 2025-S.929 safeguards New Yorkers by ensuring strict protections on genetic data. I thank Senator Kreuger and Assemblymember Rosenthal for their attention to this matter, and I urge Governor Hochul to sign this bill into law immediately. We must act now to protect privacy, prevent misuse, and set a national standard for genetic data security.”
Senator Lea Webb said: "As a Co-Sponsor of this legislation, I've seen firsthand the importance of protecting the health data of every New Yorker. This bill will provide stronger privacy protections at a time when personal information is more at risk than ever. I urge Governor Hochul to sign this crucial legislation into law so we can take immediate action to secure the health data of millions and ensure New Yorkers’ rights to privacy are upheld.”
Allie Bohm, Senior Policy Counsel at the New York Civil Liberties Union, said: “New Yorkers may think that highly personal data stored in Fitbits or period tracking apps is protected by the law, but it’s not — and right now, millions of New Yorkers’ genetic information is at risk of being sold, with no safeguards limiting how the buyer can use the data, as an asset in 23&Me’s bankruptcy. Governor Hochul could take action and help protect New Yorkers by signing the New York Health Privacy Act, which would create safeguards against data misuse. This is yet another reason why Governor Hochul must sign NYHIPA immediately.”
Andrea Salwen Kopel, Executive Director, National Council of Jewish Women New York, said: "Since the Supreme Court's disastrous Dobbs decision overturning Roe v. Wade, it has become even more crucial to protect our private health data. Abortion care leaves a digital trail. If New York is to remain a leader and a haven for abortion access, we must ensure strong safeguards that allow people to seek medical care here without fear of improper access and misuse of their health data. The National Council of Jewish Women New York (NCJW NY) urges Governor Hochul to sign the New York Health Information Privacy Act, S.929/A.2141, immediately."
Matt Schwartz, Policy Analyst, Consumer Reports, said: "Consumer Reports commends the New York State Legislature for passing the New York Health Information Privacy Act, a crucial step in safeguarding the sensitive health data of New Yorkers. With concerns over 23andMe potentially selling user data after its bankruptcy announcement, the enactment of this bill is even more critical. It would provide New Yorkers much-needed protections including granting rights to access and delete their regulated health information, requiring affirmative consent for secondary data use, and banning the sale of regulated health data outright. We urge Governor Hochul to not delay and sign this bill into law to strengthen consumer health privacy."
Georgana Hanson, Executive Vice President, Planned Parenthood Empire State Acts, said: "New York has a proud legacy of protecting and advancing reproductive freedom. In this moment when attacks on our rights and bodily autonomy are unrelenting, we must boldly pursue impactful policies that defend the freedoms we have fought so hard for. We applaud the legislature for quickly advancing the New York Health Information Privacy Act this session. We urge Governor Hochul to sign this critical legislation to ensure consumers – not companies - are the ones in control of their personal health data."
Senator Jeremy Cooney said: “Every New Yorker deserves the right to privacy, especially when it comes to their sensitive healthcare data. Whether it’s information on reproductive healthcare, mental healthcare, or any data on their devices, it’s vital that we protect this data from falling into the wrong hands. I want to thank Senator Krueger and Assemblymember Rosenthal for their leadership and I join their calls to have this bill signed which would put control of sensitive data back in the hands of New Yorkers.”
Senator Kristen Gonzalez said: “New Yorkers have a right to privacy and a right to healthcare access. In a time where these rights are being infringed upon, we need to protect New Yorkers from having their health data shared with any outside entities, a move much needed to reaffirm the safety of accessing reproductive care without fear of prosecution.”
Senator Brad Hoylman-Sigal said: “Just like medical records, electronically collected health data is personal and should be private unless a patient chooses to share it. The recent bankruptcy of genetic testing company 23andMe raises serious concerns about what will now happen to the sensitive information they have collected. It is crucial that Governor Hochul sign the legislation we have already passed to address this issue, sponsored by Senator Krueger and Assemblymember Rosenthal. Doing so would give New Yorkers ownership of their electronic health data and limit the ability of private companies, like 23andME, or government entities, from selling or sharing their data without affirmative consent.”
Senator Robert Jackson said: "At a moment when our most personal information is under siege—from corporate profiteers to political extremists—Governor Hochul must stand with the people and sign the Health Data Privacy Bill without delay. This legislation is not just a line of defense; it is a line in the sand. Our health decisions, our bodies, our futures—these are not for sale. With this legislation, we say loud and clear: New Yorkers will not be tracked, targeted, or traded. We demand protection. We demand dignity. And we demand it now."
Senator Brian Kavanagh said: "Many New Yorkers may believe their health data is protected, but the reality is that tech companies and data brokers are collecting, selling, and exploiting personal health information without meaningful consent. Thanks to the leadership of Senator Krueger and Assemblymember Rosenthal, we’ve passed this critical legislation that would empower New Yorkers to take back control of their private health data. I urge Governor Hochul to sign this bill into law."
Senator John Liu said: "The information we share online is increasingly subject to marketing, manipulation and misrepresentation. Our personal health data is among the most sensitive information we have, consisting of medical decisions and private lives, but it remains unprotected and subject to exploitation by companies like 23andMe, who are currently attempting to auction off the genetic information of 15 million customers. We need to put the control of our personal health data back in the hands of New Yorkers. Much thanks Senator Krueger and Assembly Member Rosenthal for fighting to safeguard the privacy of our most sensitive information."
Senator Christopher J. Ryan said: “The bankruptcy of 23andMe is a stark reminder of the risks posed when genetic data is left unprotected. Millions of consumers trusted these companies with their most personal information. Now, their privacy hangs in the balance. Senate Bill 2025-S.929 safeguards New Yorkers by ensuring strict protections on genetic data. I thank Senator Kreuger and Assemblymember Rosenthal for their attention to this matter, and I urge Governor Hochul to sign this bill into law immediately. We must act now to protect privacy, prevent misuse, and set a national standard for genetic data security.”
Senator Lea Webb said: "As a Co-Sponsor of this legislation, I've seen firsthand the importance of protecting the health data of every New Yorker. This bill will provide stronger privacy protections at a time when personal information is more at risk than ever. I urge Governor Hochul to sign this crucial legislation into law so we can take immediate action to secure the health data of millions and ensure New Yorkers’ rights to privacy are upheld.”
Allie Bohm, Senior Policy Counsel at the New York Civil Liberties Union, said: “New Yorkers may think that highly personal data stored in Fitbits or period tracking apps is protected by the law, but it’s not — and right now, millions of New Yorkers’ genetic information is at risk of being sold, with no safeguards limiting how the buyer can use the data, as an asset in 23&Me’s bankruptcy. Governor Hochul could take action and help protect New Yorkers by signing the New York Health Privacy Act, which would create safeguards against data misuse. This is yet another reason why Governor Hochul must sign NYHIPA immediately.”
Andrea Salwen Kopel, Executive Director, National Council of Jewish Women New York, said: "Since the Supreme Court's disastrous Dobbs decision overturning Roe v. Wade, it has become even more crucial to protect our private health data. Abortion care leaves a digital trail. If New York is to remain a leader and a haven for abortion access, we must ensure strong safeguards that allow people to seek medical care here without fear of improper access and misuse of their health data. The National Council of Jewish Women New York (NCJW NY) urges Governor Hochul to sign the New York Health Information Privacy Act, S.929/A.2141, immediately."
Matt Schwartz, Policy Analyst, Consumer Reports, said: "Consumer Reports commends the New York State Legislature for passing the New York Health Information Privacy Act, a crucial step in safeguarding the sensitive health data of New Yorkers. With concerns over 23andMe potentially selling user data after its bankruptcy announcement, the enactment of this bill is even more critical. It would provide New Yorkers much-needed protections including granting rights to access and delete their regulated health information, requiring affirmative consent for secondary data use, and banning the sale of regulated health data outright. We urge Governor Hochul to not delay and sign this bill into law to strengthen consumer health privacy."
Georgana Hanson, Executive Vice President, Planned Parenthood Empire State Acts, said: "New York has a proud legacy of protecting and advancing reproductive freedom. In this moment when attacks on our rights and bodily autonomy are unrelenting, we must boldly pursue impactful policies that defend the freedoms we have fought so hard for. We applaud the legislature for quickly advancing the New York Health Information Privacy Act this session. We urge Governor Hochul to sign this critical legislation to ensure consumers – not companies - are the ones in control of their personal health data."
Christian LoBue, President of The National Institute for Reproductive Health (NIRH) and NIRH Action Fund said: “New Yorkers deserve security, privacy, and protection. Their consumer health data and private health care information should never be sold or shared by companies or governments without permission. However, we've already seen the Trump Administration, hostile state governments, and even private companies weaponize electronic health data to prosecute people for accessing abortion and other reproductive health care. We urge Governor Hochul to sign the New York Health Information Privacy Act to protect people providing, receiving, or accessing health care from invasive and unethical private data sharing that puts them at risk."
Danise Wilson, Executive Director, Reproductive Health Access Project, said: "The Reproductive Health Access Project remains steadfast in protecting the privacy of our clinicians providing and their patients accessing essential health care. In the wake of attacks on reproductive rights nationwide, people who are seeking abortion, contraception, and other sexual and reproductive health care need to know that their personal health information is protected from mismanagement and surveillance. The recent concerns around 23andMe highlight the urgent needs for NYS to uphold strict health data ethics. The RHAP community urges Governor Hochul to sign S.929/A.2141 into law to ensure that all New York residents, especially those seeking abortion and reproductive and sexual health care, can do so safely without fear of their private information being compromised."
Brittan Hardgers, Director Of Advocacy and Community Engagement, The New Pride Agenda, said: “Protecting private data about our personal health decisions is a critical element of the fight to safeguard our fundamental rights to bodily autonomy. We must ensure that New Yorkers’ health information remains private and secure. Without strong legal protections, individuals seeking essential healthcare—such as reproductive healthcare or gender-affirming care—are at risk of discrimination, criminalization, or harassment. The NEW Pride Agenda urges Governor Kathy Hochul to sign the New York Health Information Privacy Act into law, reaffirming New York's commitment to protecting our rights to control our own bodies, lives, families, and futures."
Danise Wilson, Executive Director, Reproductive Health Access Project, said: "The Reproductive Health Access Project remains steadfast in protecting the privacy of our clinicians providing and their patients accessing essential health care. In the wake of attacks on reproductive rights nationwide, people who are seeking abortion, contraception, and other sexual and reproductive health care need to know that their personal health information is protected from mismanagement and surveillance. The recent concerns around 23andMe highlight the urgent needs for NYS to uphold strict health data ethics. The RHAP community urges Governor Hochul to sign S.929/A.2141 into law to ensure that all New York residents, especially those seeking abortion and reproductive and sexual health care, can do so safely without fear of their private information being compromised."
Brittan Hardgers, Director Of Advocacy and Community Engagement, The New Pride Agenda, said: “Protecting private data about our personal health decisions is a critical element of the fight to safeguard our fundamental rights to bodily autonomy. We must ensure that New Yorkers’ health information remains private and secure. Without strong legal protections, individuals seeking essential healthcare—such as reproductive healthcare or gender-affirming care—are at risk of discrimination, criminalization, or harassment. The NEW Pride Agenda urges Governor Kathy Hochul to sign the New York Health Information Privacy Act into law, reaffirming New York's commitment to protecting our rights to control our own bodies, lives, families, and futures."
Catherine Lederer-Plaskett, President, Choice Matters, said: “The right to privacy is in free fall. Health care is under constant attack. Violence against women and prosecution of those receiving reproductive services is at an all-time high. Governor Hochul, Stand Up for New Yorkers. Sign the NY Health Information Privacy Act. There is NO time to waste."
Rindala Alajaji, Legislative Activist, Electronic Frontier Foundation (EFF), said: “When individuals seek reproductive health care or gender-affirming care, they leave behind a digital trail. The concerns everyday people have about what will happen to the genetic information they shared with 23andMe underscore how important it is to protect this kind of private, sensitive information. As digital surveillance expands, so does the risk of personal health data being used against individuals. Governor Hochul should sign this bill to ensure that out-of-state actors cannot easily access New Yorkers’ health data without due process."
Lisa David, President & CEO, Public Health Solutions, said: “In these unprecedented times, New York should lead the way with efforts to protects the rights of its citizens. The NY Health Information Privacy Act, does just that – it secures the electronic health data privacy of individuals by including guardrails against the sale of that data and other common-sense protections. We ask the Governor to sign this piece of legislation.”
David Siffert, Legal Director, Surveillance Technology Oversight Project, said: "The American healthcare system is under attack. Not only is science being undermined, but Americans are facing government retribution for seeking medically necessary treatments. Meanwhile, our laws fall woefully short of protecting the privacy of our medical data, as demonstrated most recently by the 23andMe bankruptcy. The Governor must sign the Health Information Privacy Act to ensure that New Yorkers have access to safe, private healthcare treatment."
Jacqueline Seitz, Deputy Director of Health Privacy, Legal Action Center, said: "Many apps and websites targeting people with sensitive health needs – including people seeking support for problematic substance use – advertise their services as confidential and private, but instead collect and share consumers’ health data for profit. This bill would close an important loophole in our privacy laws and protect New Yorkers against discrimination or criminalization on the basis of their electronic health data."
Rindala Alajaji, Legislative Activist, Electronic Frontier Foundation (EFF), said: “When individuals seek reproductive health care or gender-affirming care, they leave behind a digital trail. The concerns everyday people have about what will happen to the genetic information they shared with 23andMe underscore how important it is to protect this kind of private, sensitive information. As digital surveillance expands, so does the risk of personal health data being used against individuals. Governor Hochul should sign this bill to ensure that out-of-state actors cannot easily access New Yorkers’ health data without due process."
Lisa David, President & CEO, Public Health Solutions, said: “In these unprecedented times, New York should lead the way with efforts to protects the rights of its citizens. The NY Health Information Privacy Act, does just that – it secures the electronic health data privacy of individuals by including guardrails against the sale of that data and other common-sense protections. We ask the Governor to sign this piece of legislation.”
David Siffert, Legal Director, Surveillance Technology Oversight Project, said: "The American healthcare system is under attack. Not only is science being undermined, but Americans are facing government retribution for seeking medically necessary treatments. Meanwhile, our laws fall woefully short of protecting the privacy of our medical data, as demonstrated most recently by the 23andMe bankruptcy. The Governor must sign the Health Information Privacy Act to ensure that New Yorkers have access to safe, private healthcare treatment."
Jacqueline Seitz, Deputy Director of Health Privacy, Legal Action Center, said: "Many apps and websites targeting people with sensitive health needs – including people seeking support for problematic substance use – advertise their services as confidential and private, but instead collect and share consumers’ health data for profit. This bill would close an important loophole in our privacy laws and protect New Yorkers against discrimination or criminalization on the basis of their electronic health data."
###
