What's happening
This bill expands the definition of identity theft to include medical and health insurance information in New York State law.
Why it matters
Expanding identity theft to cover medical and health insurance data gives victims of these types of fraud the same legal protections and recourse as those whose financial information is stolen. This means people whose health or insurance details are used without consent can now pursue criminal charges and potentially receive restitution.
Including medical and health insurance information in breach notification laws increases obligations for businesses and government agencies to promptly notify individuals if such sensitive data is compromised. This change could lead to more timely warnings and better opportunities for affected people to take protective actions.
The bill reflects the growing threat and real-world impact of medical identity theft, which can result in financial loss, fraudulent insurance claims, and even dangerous mix-ups in medical records. By recognizing these risks in law, New York is responding to evolving tactics of identity thieves and the increasing value of health-related information.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Protect Medical Info from Theft
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to codes
- Referred to codes
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Add Health Data to ID Theft
In Assembly Committee · Codes · Sponsor Dan Quart
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
1088
2019-2020 Regular Sessions
IN SENATE
January 10, 2019
Introduced by Sen. PERSAUD -- read twice and ordered printed, and when printed to be committed to the Committee on Codes
AN ACT to amend the penal law, the general business law and the state technology law, in relation to adding medical and health insurance information within the definitions of identity theft
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Section 190.78 of the penal law, as added by chapter 619 of the laws of 2002, is amended to read as follows: § 190.78 Identity theft in the third degree.
A person is guilty of identity theft in the third degree when he or she knowingly and with intent to defraud assumes the identity of another person by presenting himself or herself as that other person, or by acting as that other person or by using personal identifying information of that other person, and thereby:
1. obtains goods, money, medical information, health insurance information, property or services or uses credit in the name of such other person or causes financial loss to such person or to another person or persons; or
2. commits a class A misdemeanor or higher level crime.
3. (a) For the purposes of this section, the term "medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(b) For the purposes of this section, the term "health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual or any information in an individual's application and claims history, including, but not limited to, appeals history.
Identity theft in the third degree is a class A misdemeanor.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD00861-01-9
S. 1088 2
§ 2. Section 190.79 of the penal law, as added by chapter 619 of the laws of 2002 and subdivision 4 as amended by chapter 279 of the laws 2008, is amended to read as follows: § 190.79 Identity theft in the second degree.
A person is guilty of identify theft in the second degree when he or she knowingly and with intent to defraud assumes the identity of another person by presenting himself or herself as that other person, or by acting as that other person or by using personal identifying information of that other person, and thereby:
1. obtains goods, money, medical information, health insurance information, property or services or uses credit in the name of such other person in an aggregate amount that exceeds five hundred dollars; or
2. causes financial loss to such person or to another person or persons in an aggregate amount that exceeds five hundred dollars; or
3. commits or attempts to commit a felony or acts as an accessory to the commission of a felony; or
4. commits the crime of identity theft in the third degree as defined in section 190.78 of this article and has been previously convicted within the last five years of identity theft in the third degree as defined in section 190.78, identity theft in the second degree as defined in this section, identity theft in the first degree as defined in section 190.80, unlawful possession of personal identification information in the third degree as defined in section 190.81, unlawful possession of personal identification information in the second degree as defined in section 190.82, unlawful possession of personal identification information in the first degree as defined in section 190.83, unlawful possession of a skimmer device in the second degree as defined in section 190.85, unlawful possession of a skimmer device in the first degree as defined in section 190.86, grand larceny in the fourth degree as defined in section 155.30, grand larceny in the third degree as defined in section 155.35, grand larceny in the second degree as defined in section 155.40 or grand larceny in the first degree as defined in section 155.42 of this chapter.
5. (a) For the purposes of this section, the term "medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(b) For the purposes of this section, the term "health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual or any information in an individual's application and claims history, including, but not limited to, appeals history.
Identity theft in the second degree is a class E felony.
§ 3. Subparagraph 3 of paragraph (b) of subdivision 1 of section 899- aa of the general business law, as added by chapter 442 of the laws of 2005, is amended and two new subparagraphs 4 and 5 and two new closing paragraphs are added to read as follows:
(3) account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account; or
(4) medical information; or
(5) health insurance information;
For the purposes of this paragraph, "medical information" means any information regarding an individual's medical history, mental or phys-
S. 1088 3
ical condition, or medical treatment or diagnosis by a health care professional.
For the purposes of this paragraph, "health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual or any information in an individual's application and claims history, including, but not limited to, appeals history.
§ 4. Subparagraph 3 of paragraph (a) of subdivision 1 of section 208 of the state technology law, as added by chapter 442 of the laws of 2005, is amended and two new subparagraphs 4 and 5 and two new closing paragraphs are added to read as follows:
(3) account number, credit or debit card number, in combination with any required security code, access code, or password which would permit access to an individual's financial account[.]; or
(4) medical information; or
(5) health insurance information.
For the purposes of this paragraph, "medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
For the purposes of this paragraph, "health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual or any information in an individual's application and claims history, including, but not limited to, appeals history.
§ 5. This act shall take effect on the ninetieth day after it shall have become a law. Effective immediately, the addition, amendment and/or repeal of any rule or regulation necessary for the implementation of this act on its effective date are authorized and directed to be made and completed on or before such effective date.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the penal law, the general business law and the state technology law, in relation to adding medical and health insurance information within the definitions of identity theft
Purpose or general idea of bill
This bill intends to protect individuals from medical identity theft by including medical and health insurance information within the definition of identity theft.
Summary of specific provisions
*Adds medical information and health information to the definition of identity theft in Section 190.78-79 of the penal law, Section 899-aa of the general business law, and Section 208 of the state technology law.
*Defines medical information to mean "any information regarding an indi- vidual medical history, mental or physical condition, or medical treat- ment of diagnosis by a health care professional."
*Defines health insurance information to mean "an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual or any information in an individual's application and claims history, includ- ing, but not limited to, appeals history."
Justification
According to the World Privacy Forum (WPF) in 2006, medical identity theft accounts for approximately 3 percent of total ID theft, which is reported to be the fastest-growing crime over the last seven years. Criminals now pay upwards of $50 for a stolen medical ID, in comparison to $1 for a social security number. Victims of medical identity theft are left with few avenues for assistance as compared to regular ID theft, partially due to lack of knowledge regarding this crime. Stolen items typically include patient records, documents on insurance bene- fits, and passwords to medical servers. Whether it is a physician iden- tification number or patient identification information that is stolen, medical identity theft is a serious problem, estimated to affect 250,000-500,000 individuals per year. Little assistance is provided for victims under the Health Insurance Portability and Accountability Act (HIPAA). Rather, the rigidness of HIPAA can create difficulties for victims trying to fix files that have been altered by identity thieves. For example, medications, allergies and surgeries fraudulently billed in the name of the victim become permanent records that are hard to correct. In addition to the hardship on patients, medical identity theft is a costly burden on the healthcare system. According to the National Health Care Anti-Fraud Association, of the $60 billion in health care fraud each year, 1 percent, or $6 billion per year is attributed to medical identity fraud.
Prior legislative history
2017/2018: S8595 REFERRED TO CODES 2015/2016: A2115 referred to Codes
2014/2013: A2249 referred to Codes
2012:A8890 referred to Codes
2011:A1050 referred to Codes
2009/2010: A6291 referred to Codes
Fiscal implications
Unknown
Effective date
This bill would take effect on the 90th day after it shall have become a law.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.