A 920: Adds medical and health insurance information within the definitions of personal identifying information.

  
  STATE OF NEW YORK ________________________________________________________________________ 920 2025-2026 Regular Sessions  IN ASSEMBLY (Prefiled) January 8, 2025 ___________ Introduced by M. of A. LAVINE -- read once and referred to the Committee on Codes AN ACT to amend the penal law and the general business law, in relation to including medical information and health insurance information in the definition of personal identifying information for certain purposes; and to repeal certain provisions of the general business law and the state technology law relating thereto The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Subdivision 1 of section 190.77 of the penal law, as sepa- 2 rately amended by chapters 226 and 279 of the laws of 2008, is amended 3 to read as follows: 4 1. For the purposes of sections 190.78, 190.79, 190.80 [and], 190.80-a 5 and 190.85 of this article "personal identifying information" means a 6 person's name, address, telephone number, date of birth, driver's 7 license number, social security number, place of employment, mother's 8 maiden name, financial services account number or code, savings account 9 number or code, checking account number or code, brokerage account 10 number or code, credit card account number or code, debit card number or 11 code, automated teller machine number or code, taxpayer identification 12 number, computer system password, signature or copy of a signature, 13 electronic signature, unique biometric data that is a fingerprint, voice 14 print, retinal image or iris image of another person, telephone calling 15 card number, mobile identification number or code, electronic serial 16 number or personal identification number, medical information, health 17 insurance information, or any other name, number, code or information 18 that may be used alone or in conjunction with other such information to 19 assume the identity of another person. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD02690-01-5 
 A. 920 2 1 § 2. The opening paragraph of subdivision 2 of section 190.77 of the 2 penal law, as amended by chapter 226 of the laws of 2008, is amended to 3 read as follows: 4 For the purposes of subdivision one of this section and sections 5 190.78, 190.79, 190.80, 190.80-a, 190.81, 190.82 [and], 190.83 and 6 190.85 of this article: 7 § 3. Subdivision 1 of section 190.78 of the penal law, as amended by a 8 chapter of the laws of 2024 amending the penal law, the general business 9 law and the state technology law relating to adding medical and health 10 insurance information within the definitions of identity theft, as 11 proposed in legislative bills numbers S. 2376-B and A. 4737-B, is 12 amended to read as follows: 13 1. obtains goods, money, [medical information, health insurance infor- 14 mation,] property or services or uses credit in the name of such other 15 person or causes financial loss to such person or to another person or 16 persons; or 17 § 4. Subdivision 1 of section 190.79 of the penal law, as amended by a 18 chapter of the laws of 2024 amending the penal law, the general business 19 law and the state technology law relating to adding medical and health 20 insurance information within the definitions of identity theft, as 21 proposed in legislative bills numbers S. 2376-B and A. 4737-B, is 22 amended to read as follows: 23 1. obtains goods, money, [medical information, health insurance infor- 24 mation,] property or services or uses credit in the name of such other 25 person in an aggregate amount that exceeds five hundred dollars; or 26 § 5. Subdivision 1 of section 190.80 of the penal law, as amended by a 27 chapter of the laws of 2024 amending the penal law, the general business 28 law and the state technology law relating to adding medical and health 29 insurance information within the definitions of identity theft, as 30 proposed in legislative bills numbers S. 2376-B and A. 4737-B, is 31 amended to read as follows: 32 1. obtains goods, money, [medical information, health insurance infor- 33 mation,] property or services or uses credit in the name of such other 34 person in an aggregate amount that exceeds two thousand dollars; or 35 § 6. Clauses 6 and 7 of subparagraph (i) of paragraph (b) of subdivi- 36 sion 1 of section 899-aa of the general business law, as added by a 37 chapter of the laws of 2024 amending the penal law, the general business 38 law and the state technology law relating to adding medical and health 39 insurance information within the definitions of identity theft, as 40 proposed in legislative bills numbers S. 2376-B and A. 4737-B, are 41 amended to read as follows: 42 (6) medical information, meaning any information regarding an individ- 43 ual's medical history, mental or physical condition, or medical treat- 44 ment or diagnosis by a health care professional; or 45 (7) health insurance information, meaning an individual's health 46 insurance policy number or subscriber identification number, any unique 47 identifier used by a health insurer to identify the individual or any 48 information in an individual's application and claims history, including 49 but not limited to, appeals history; or 50 § 7. The second and third undesignated paragraphs of paragraph (b) of 51 subdivision 1 of section 899-aa of the general business law, as added by 52 a chapter of the laws of 2024 amending the penal law, the general busi- 53 ness law and the state technology law relating to adding medical and 54 health insurance information within the definitions of identity theft, 55 as proposed in legislative bills numbers S. 2376-B and A. 4737-B, are 56 REPEALED. 
 A. 920 3 1 § 8. Clauses 6 and 7 of subparagraph (i) of paragraph (a) and the 2 second and third undesignated paragraphs of such paragraph of subdivi- 3 sion 1 of section 208 of the state technology law, as added by a chapter 4 of the laws of 2024 amending the penal law, the general business law and 5 the state technology law relating to adding medical and health insurance 6 information within the definitions of identity theft, as proposed in 7 legislative bills numbers S. 2376-B and A. 4737-B, are REPEALED. 8 § 9. This act shall take effect on the same date and in the same 9 manner as a chapter of the laws of 2024 amending the penal law, the 10 general business law and the state technology law relating to adding 11 medical and health insurance information within the definitions of iden- 12 tity theft, as proposed in legislative bills numbers S. 2376-B and A. 13 4737-B, takes effect.