HIPAA + NY SHIELD Act Compliance for New York Therapists — 2026 Guide
New York therapists navigate HIPAA (federal), the NY SHIELD Act, and New York Mental Hygiene Law — three overlapping frameworks. The NYC OCR office is among the most active in the country. Here is your complete 2026 compliance guide.
Quick Answer
Yes — New York therapists must comply with HIPAA, the NY SHIELD Act, and Mental Hygiene Law §33.13. The average HIPAA fine in New York is $52,000, and the SHIELD Act requires breach notification within 30 days — stricter than HIPAA's 60-day window. A signed BAA and HIPAA-compliant telehealth, both included with SimplePractice, close most of the technical gap.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Updated July 2026 · Fine data and state rules cross-checked against HHS OCR records and New York law
$52,000
Avg fine in New York
30 Days
NY breach notification
3 Laws
HIPAA + SHIELD + MHL
NY SHIELD Act — What Therapists Must Know
The SHIELD Act requires breach notification within 30 days of discovery — HIPAA allows 60
New York Mental Hygiene Law §33.13 provides extra protections for mental health records beyond HIPAA
NYC therapists sharing office space must have written agreements covering PHI handling
Psychotherapy notes have special status in NY — patients have stronger access rights than under federal HIPAA
NY SHIELD Act applies to any business handling NY resident data — including telehealth therapists in other states
Trusted by 225,000+ Therapists — Recommended for New York Therapist in New York
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — New York Therapist HIPAA
Does the NY SHIELD Act apply to therapists?
Yes. Any therapist who handles private information of New York residents — including through telehealth — must comply with the NY SHIELD Act's reasonable safeguards requirements, in addition to HIPAA.
What is New York Mental Hygiene Law §33.13?
NY MHL §33.13 provides additional confidentiality protections for mental health records. It restricts disclosure in ways that are often stricter than HIPAA and includes specific rules for court proceedings.
Can a telehealth therapist outside New York be subject to NY law?
Yes. If you provide therapy to clients who are physically located in New York, you may be subject to NY SHIELD Act requirements regardless of where your practice is based.