HIPAA Notice of Privacy Practices for New York Practices
New York has some of the most protective health information privacy laws in the United States, particularly for mental health and substance use disorder records. Practices in New York must comply with federal HIPAA and the New York Mental Hygiene Law — and where New York is stricter, New York law prevails.
New York Mental Hygiene Law — the key overlay
The New York Mental Hygiene Law (MHL) is the primary state law governing confidentiality of mental health and SUD records. It is significantly stricter than federal HIPAA in several respects:
| Topic | Federal HIPAA | NY Mental Hygiene Law |
|---|---|---|
| Mental health records disclosure | Permitted for TPO without authorization | Many disclosures require written consent (MHL Art. 33) |
| SUD records | 42 CFR Part 2 for Part 2 programs | MHL Art. 22 applies to all SUD treatment records in NY |
| Psychotherapy notes | Extra protection under § 164.501 | Stricter — broader definition of confidential records |
| Patient right to restrict | Limited statutory right | Broader consent requirements effectively expand restriction rights |
New York SUD treatment — triple layer compliance
New York SUD treatment providers face a three-layer compliance framework:
- Federal HIPAA. Standard HIPAA Privacy Rule applies to all covered entities.
- 42 CFR Part 2. Applies to federally-assisted SUD treatment programs; integrated into the HHS February 2026 NPP model.
- NY MHL Article 22. Applies to all chemical dependence programs in New York regardless of whether they receive federal funding. This is stricter than Part 2 in certain respects and cannot be preempted by the federal Part 2 framework where state law is more protective.
New York SUD programs should consult legal counsel for a complete compliance analysis. See Part 2 SUD language in your NPP for the federal framework.
What New York practices need in their NPP
- All federal HIPAA NPP requirements (HHS February 2026 model)
- A statement that New York law provides additional privacy protections for mental health and SUD records
- For behavioral health providers: acknowledgment of MHL confidentiality protections
- For SUD treatment programs: HIPAA + Part 2 + MHL Art. 22 compliance language
- Privacy Officer contact information for patients seeking state-law guidance
Frequently Asked Questions
Does New York require more in a HIPAA NPP than other states?▼
Yes, particularly for mental health and SUD practices. New York's Mental Hygiene Law imposes consent requirements for behavioral health record disclosures that go beyond what federal HIPAA permits without authorization.
I'm a therapist in New York — do I need a different NPP than my federal template?▼
You use the same federal NPP template, but it should acknowledge that New York law provides additional protections for mental health records (MHL Art. 33). For practices subject to MHL, a state-law flag and reference to applicable MHL sections is best practice.
Does Part 2 or MHL Article 22 apply to my New York SUD practice?▼
MHL Article 22 applies to all licensed chemical dependence programs in New York. Federal Part 2 applies to federally-assisted SUD programs. Many New York SUD programs are subject to both — the most protective standard governs in any conflict. Consult legal counsel for a program-specific analysis.
Does New York have stricter requirements for all health records, or only behavioral health?▼
New York's strictest overlays are specific to mental health (MHL Art. 33) and SUD (MHL Art. 22) records. General medical records in New York are governed by HIPAA at the federal level, with some additional state law provisions — but the most significant gaps from HIPAA are in the behavioral health context.
Generate your New York practice NPP in under 5 minutes.
Federal HHS February 2026 model with New York state-law flag. PDF + editable Word. $49 one-time — no subscription.
Start your NPP — $49Free watermarked preview available. See sample →