New York's Stop Hacks and Improve Electronic Data Security Act — the SHIELD Act — became effective March 21, 2020, and applies to any person or business that owns or licenses computerized data that includes private information about New York residents, regardless of whether the organisation is physically located in New York. For home health agencies serving New York patients or employing New York residents, the SHIELD Act operates independently of HIPAA as a state-level data security obligation with its own compliance requirements, its own breach notification timeline, and its own enforcement mechanism through the New York Attorney General.
HIPAA compliance is necessary but not sufficient for SHIELD Act compliance. The SHIELD Act was specifically designed to apply standards beyond what HIPAA requires in areas where the legislature determined that federal protection was inadequate. Understanding what the SHIELD Act adds — and how to build one programme that satisfies both frameworks — is essential for New York home health agencies.
What the SHIELD Act Requires: The Reasonable Security Programme Standard
The SHIELD Act requires covered businesses to implement and maintain reasonable safeguards to protect the security, confidentiality, and integrity of private information. Businesses with fewer than 50 employees, less than $3 million in gross revenue, or less than $5 million in total assets (small businesses under the SHIELD Act definition) may implement a simplified security programme that satisfies the standard. Most home health agencies serving New York patients will exceed at least one of these thresholds and must implement the full reasonable security programme standard.
The SHIELD Act's reasonable security programme specifies required administrative, technical, and physical safeguards that parallel the HIPAA Security Rule provisions but are framed as state-level obligations with independent enforceability. Key areas where the SHIELD Act adds specificity beyond what HIPAA's general standard requires:
• Risk assessment: the SHIELD Act explicitly requires a written risk assessment — not just risk analysis — that evaluates the threats to private information in the organisation's control. This aligns with HIPAA's risk analysis requirement but adds the "written" specification that HIPAA implies but does not state as explicitly.
• Workforce training: the SHIELD Act requires security awareness training of employees on the organisation's security programme and policies. This parallels HIPAA but applies to all employees who handle New York private information — not just those with access to ePHI as defined under HIPAA.
• Vendor oversight: the SHIELD Act requires that third-party service providers that access private information maintain appropriate safeguards — implemented through contractual requirements. This parallels the HIPAA BAA requirement but uses a broader definition of private information that may capture vendor relationships not covered by HIPAA's PHI definition.