New York A 1911: Establishes the biometric privacy act

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
A01911 Summary:

BILL NOA01911 

&nbsp

SAME ASNo Same As

&nbsp

SPONSORRosenthal

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Add §3239-a, Ins L

&nbsp

Establishes the wellness program privacy act; requires employers and insurers to take certain measures to protect the security of wellness program participants' private information.

Go to top A01911 Actions:

BILL NOA01911 

&nbsp

01/14/2025referred to insurance

01/07/2026referred to insurance

Go to topA01911 Committee&nbspVotes:

Go to topA01911 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topA01911 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 1911

 2025-2026 Regular Sessions

 IN ASSEMBLY

 January 14, 2025
 ___________

 Introduced by M. of A. ROSENTHAL -- read once and referred to the
 Committee on Insurance

 AN ACT to amend the insurance law, in relation to the establishment of
 the "Wellness Program Privacy Act"

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. This act shall be known and may be cited as the "Wellness
 2 Program Privacy Act".
 3 § 2. The insurance law is amended by adding a new section 3239-a to
 4 read as follows:
 5 § 3239-a. Wellness program privacy. (a) Definitions. For purposes of
 6 this section:
 7 (1) "Employer" means:
 8 (i) any person who directly employs fifty or more persons to perform
 9 services for a wage or salary; or
 10 (ii) the state and any political or civil subdivision of the state, or
 11 any county or city or other municipality.
 12 (2) "Collects," "collected," or "collection" means buying, renting,
 13 gathering, obtaining, receiving, or accessing any personal information
 14 or protected health information pertaining to a consumer by any means.
 15 This includes receiving information from such consumer, either actively
 16 or passively, or by observing such consumer's behavior.
 17 (3) "Administration and operation of a wellness program" means, but is
 18 not limited to, the use of personal information when reasonably neces-
 19 sary and proportionate to achieve one of the following purposes:
 20 (i) detecting and responding to security incidents arising from a
 21 wellness program and protecting against malicious, deceptive, fraudu-
 22 lent, or illegal activity related to a wellness program;
 23 (ii) executing functions of a wellness program for the benefit of the
 24 insured;

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD05293-01-5

 A. 1911 2

 1 (iii) undertaking internal research for technological development and
 2 demonstration related to a wellness program; or
 3 (iv) undertaking activities to verify or maintain the quality or safe-
 4 ty of a service or device that is owned by, manufactured by, manufac-
 5 tured for, or controlled by the insurer, or to improve, upgrade, or
 6 enhance the service or device that is owned by, manufactured by, manu-
 7 factured for, or controlled by the insurer related to a wellness
 8 program.
 9 (4) "Personal information" means information that identifies or could
 10 reasonably be linked, directly or indirectly, with a particular consum-
 11 er, household, or consumer device. "Personal information" shall not
 12 include publicly available information.
 13 (5) "Publicly available" means information that is lawfully made
 14 available from federal, state, or local government records, if any
 15 conditions associated with such information. "Publicly available" shall
 16 not mean information collected by an employer or insurer about an enrol-
 17 lee without the enrollee's knowledge. "Personal information" does not
 18 include enrollee information that is de-identified or aggregate enrollee
 19 information.
 20 (6) "Retaliatory" or "adverse action" in the context of an employer
 21 offering a wellness program to its employees shall include: denial of
 22 coverage, termination of employment, requiring one hundred percent
 23 payment of medical care premiums when an employer pays a portion of the
 24 premium for wellness program participants, or reducing contributions to
 25 participants' health savings accounts.
 26 (7) "Retaliatory" or "adverse action" in the context of an insurer
 27 offering