NYS 405.46 Hospital Cyber

Section 405.46 of Title 10 of the New York Codes, Rules and Regulations is the New York State Department of Health's cybersecurity regulation for general hospitals licensed under Article 28 of the Public Health Law.

Adopted October 2, 2024, it required hospitals to begin reporting material cybersecurity incidents to the Department within 72 hours immediately, and gave them one year, until October 2, 2025, to meet the rest. It is the first state rule to require a full cybersecurity program of hospitals on top of HIPAA.

In writing, a hospital needs a cybersecurity program built on an annual risk assessment, written cybersecurity policies and procedures covering a listed set of topics (information security, access controls, asset and data governance, business continuity and disaster recovery, systems and network security and monitoring, application security, incident response, third-party service provider security, and more), a designated chief information security officer who reviews and attests to the written procedures each year, an incident response plan that is tested, records of annual penetration testing and vulnerability management, multifactor or risk-based authentication, staff training records, and audit trails and compliance documentation retained for six years.