New York's Healthcare AI Laws: The AI Companion Law, the SHIELD Act and What Is Still Pending

Fewer than the volume of bills suggests, and the ones in force were not written with clinics in mind.

New York has not enacted a healthcare AI statute. It has enacted an AI companion law (General Business Law article 47, in force since November 5, 2025), a frontier model safety law (the RAISE Act, effective January 1, 2027 and aimed at developers), a state agency AI inventory law (State Technology Law section 103-e), and a New York City rule on hiring algorithms (Local Law 144). Around those sit the general statutes that already applied: the SHIELD Act on data security and breach, Penal Law article 250 on recording, Public Health Law article 29-G on telehealth, and the professional misconduct provisions of the Education Law.

Everything that would speak directly to a provider is pending. The Oversight of Technology in Mental Health Care Act (S8484 / A9106) would regulate how licensed clinicians use AI, including recorded sessions and note taking. Three bills (S7896 / A8556, S10241 / A11048, A1456) would restrict AI in utilization review. A chatbot impersonation bill (S7263-A / A6545-C) would bar an AI from posing as a practitioner of a licensed profession. A health information privacy act (S9269 / A10357) passed both houses in June 2026 and awaits the Governor. None was law in September 2026.

So the buyer's question splits in two. What must a New York clinic comply with today: article 47 if it runs a companion style agent, the SHIELD Act for every vendor holding patient data, Local Law 144 if it screens New York City job candidates with software, and the ordinary standard of care. What should it build for: the pending mental health and utilization review rules, which track what California and Colorado already require and which the state by state map puts in context.

It depends entirely on whether the agent is designed to sustain a relationship, and the statute does not care that you are a healthcare provider.

General Business Law section 1700 defines an AI companion as a system using artificial intelligence, generative AI or emotion recognition algorithms designed to simulate a sustained human or human like relationship with a user, by retaining information across sessions, asking unprompted emotion based questions, or sustaining ongoing dialogue on personal matters. Human relationships include, the text says, intimate, romantic or platonic interactions or companionship. The exclusions are narrow: a system used solely for customer service or to provide information about the entity's own products and services, a system primarily designed for efficiency, research or technical assistance, and a system used solely for internal purposes or employee productivity. There is no exclusion for healthcare, HIPAA covered entities or licensed clinicians.

Apply that to a real estate of agents. A scheduling or intake agent that answers questions about your services and books appointments is inside the customer service exclusion. An AI phone agent handling refill requests and directions is too. A between session support companion offered by a behavioural health practice, a mood check in agent that remembers last week's conversation, or a recovery coaching bot that asks how the patient is feeling is inside the definition. That is the product category the law was written for, and calling it a clinical tool does not change its function.

For a covered agent the duties are two. Section 1701 makes it unlawful to operate an AI companion unless it contains a protocol to take reasonable efforts for detecting and addressing suicidal ideation or expressions of self harm, including detection of such expressions and a notification referring the user to crisis service providers such as the 988 suicide prevention and behavioral health crisis hotline, a crisis text line or other appropriate crisis services. Section 1702 requires a clear and conspicuous notification, verbal or written, at the beginning of any interaction and at least every three hours for continuing interactions, that the user is not communicating with a human. Section 1703 lets the Attorney General seek up to fifteen thousand dollars per day.

Two design notes. First, a behavioural health provider will usually want a stronger crisis protocol than the statute's floor, routing to its own on call clinician as well as to 988, and the statute permits that. Second, the every three hours disclosure is the same cadence Washington adopted in ESHB 2225 for 2027, and a persistent identification at the start and throughout also satisfies Utah and Texas. Build it once.

No. New York has not enacted a restriction on AI in utilization review, which surprises people because the bills have been filed in every session since 2024. Checked September 2026 on the Senate's legislation site.

What does exist is regulator guidance in an adjacent area. DFS Insurance Circular Letter No. 7 (2024), issued July 11, 2024, addresses external consumer data and AI systems in underwriting and pricing, not utilization review. Its principles are still worth knowing because DFS applies them by analogy: insurers retain responsibility for understanding any tools or AI systems developed or deployed by third party vendors and ensuring they comply with all applicable laws, and the reasons given for an adverse decision should include details about all information the insurer relied on. DFS told an Assembly hearing on December 16, 2025 that many of the laws it enforces are technology agnostic, meaning the core obligations are the same for manual processes as for AI systems.

For a provider the practical position is this. Under existing Insurance Law article 49 and Public Health Law article 49, an adverse determination must already be made by a clinical peer reviewer and must state the clinical rationale, and a plan's use of AI does not relieve it of those duties. If a denial reads as though no clinician looked at the individual record, that is grounds for internal and external appeal today. Instrumenting your prior authorization workflow to flag template denials and reviewer specialty mismatches is how you use the existing law while the new one waits. If S7896 or S10241 passes, the notice provisions will give you a direct record of which plans use AI and where.

Two bills, both close to passage in 2026, both likely to return in January 2027, and both worth building to now because they describe how a licensing board will already read the standard of care.

S8484 (Gonzalez) / A9106 (Simon), the Oversight of Technology in Mental Health Care Act, would add Education Law section 6517. A licensed professional may not allow or otherwise use AI to make independent therapeutic decisions, or to directly interact with clients in any form of therapeutic communication. Two categories are expressly permitted. Supplementary support includes preparing and maintaining client records, including therapy notes, and analysing anonymised data to track client progress. Administrative support includes managing appointment scheduling and reminders, processing billing and insurance claims, and drafting general communications related to therapy logistics. Where a session is recorded or transcribed, the patient or their legally authorised representative must be informed in writing that AI will be used and of its specific purpose, and consent is defined as an unambiguous, explicit, express, freely given, informed, voluntary and specific agreement. The penalty proposed is up to fifty thousand dollars per violation, imposed by the Commissioner of Education after complaint and hearing. Religious counselling, peer support and self help materials are excluded. The Senate Higher Education Committee reported it 11 to 0 on May 5, 2026; it was committed to Rules on June 5 without a vote, and the Assembly companion sits in Higher Education.

S7263-A (Gonzalez) / A6545-C (Zaccaro) would add General Business Law section 390-f. An operator of a chatbot shall not knowingly permit it to impersonate an actual or fictitious practitioner of a covered profession, and an operator may not waive or disclaim liability by notifying consumers that they are interacting with a non human system. The penalty proposed is up to fifteen thousand dollars per day. Both houses had it on third reading at the start of June 2026 and neither passed it.

Read together with Illinois's Wellness and Oversight for Psychological Resources Act and Nevada's AB 406, these bills describe a settled national position: AI may write the note, handle the schedule and process the claim, but the therapeutic act belongs to the licensee, the patient is told in writing when a session is recorded or transcribed, and the agent never presents as a clinician. A behavioural health practice that adopts that position now loses nothing if New York fails to pass the bill again and gains a written consent process that its malpractice carrier will like. An ambient scribe in a therapy setting is squarely the recorded and transcribed session the bill describes, so the written notice should already exist.

The SHIELD Act reaches every vendor today. The health privacy act would reach the ones operating outside HIPAA, and it has now passed the legislature twice.

General Business Law section 899-bb requires any person or business that owns or licenses computerised data including the private information of a New York resident to develop, implement and maintain reasonable safeguards to protect its security, confidentiality and integrity. A compliant regulated entity, which includes one subject to and compliant with HIPAA and HITECH, is deemed compliant. Section 899-aa defines private information to include biometric information, meaning data generated by electronic measurements of an individual's unique physical characteristics such as a fingerprint, voice print, retina or iris image, and, since the 2024 amendment, any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis, plus health insurance information. Notice of a breach must be given in the most expedient time possible and within thirty days after discovery. For a scribe or phone agent vendor this is the state law reason to ask for the security programme, not just the business associate agreement described in our HIPAA and AI page, and to confirm that voice recordings are treated as private information in the breach plan.

The New York Health Information Privacy Act is the one to watch. The 2025 version, S929 / A2141, defined regulated health information as any information reasonably linkable to an individual or a device that is collected or processed in connection with the physical or mental health of an individual, barred its sale, and barred any processing beyond strict necessity without a valid authorization requested separately from any other transaction and at least twenty four hours after the individual first used the product. It passed both houses in January 2025 and the Governor vetoed it on December 19, 2025. The revised bill, S9269 / A10357, passed the Senate 48 to 13 on June 3, 2026 and the Assembly on June 4 and was awaiting delivery to the Governor in September 2026. If it is signed it will do for New York what the My Health My Data Act does for Washington: govern the health data your public website, marketing tools and non patient interactions generate, which HIPAA never reached.

What to do now is the same either way. Sort each AI vendor's processing into inside the BAA and outside it, and treat the outside category as if the act were in force: consent before collection, no sale, no secondary use. That is also the posture Washington and Nevada already require, so a multi state organisation is not building anything new.

New York is easier than most states on recording and no easier on the record.

Recording. Penal Law section 250.00 defines mechanical overhearing of a conversation as recording without the consent of at least one party by a person not present, and wiretapping as recording a telephonic communication without the consent of either the sender or receiver. New York is therefore a one party consent state, and the clinician's own consent to an ambient scribe or the practice's consent to recording its own phone line satisfies the Penal Law. Section 250.05 makes eavesdropping a class E felony where that consent is absent, which matters for a vendor that records without any party's knowledge. One party consent does not displace anything else: HIPAA, the confidentiality duties in Public Health Law section 18 and Mental Hygiene Law section 33.13, and the plain expectation of a patient that they will be told. The pending S8484 would require written notice for recorded therapy sessions, and every clinical body that has spoken on ambient documentation expects disclosure. Tell the patient at the start of the visit and record that you did.

Telehealth. Public Health Law section 2999-cc defines telehealth as the use of electronic information and communication technologies by telehealth providers to deliver health care services, limited to telemedicine, store and forward technology, remote patient monitoring and audio only telephone communication. An autonomous AI interaction with a patient is not telehealth under that definition, because there is no telehealth provider delivering the service, which is a useful thing to be able to say when a vendor claims its agent is providing care.

Documentation. Neither the State Board for Medicine nor the Office of the Professions has issued New York specific AI guidance. What the Board has before it, posted on the Office of the Professions site, is the Federation of State Medical Boards' 2024 policy on incorporating AI into practice and the FSMB's May 2026 announcement of a workgroup on regulating AI in medical practice, which says boards should address informed consent and disclosure of AI involvement in care, and documentation. Checked September 2026. Read that as the standard the Board will apply if a complaint arrives: the licensee is responsible for the content of the note, AI involvement should be disclosed, and the record must be accurate whoever or whatever drafted it. The scribe checklist covers the review gate that makes that defensible.

Local Law 144 binds any employer screening New York City candidates with software, which includes most hospitals in the five boroughs. The state agency rules bind SUNY hospitals and any provider acting as a vendor to a state agency.

NYC Local Law 144 of 2021, Administrative Code sections 20-870 to 20-874, in force since January 1, 2023 and enforced by the Department of Consumer and Worker Protection since July 5, 2023, covers any automated employment decision tool, defined as a computational process derived from machine learning, statistical modelling, data analytics or artificial intelligence that issues a simplified output. Before use the tool must have had a bias audit within the past year, meaning an impartial evaluation by an independent auditor including testing for disparate impact, with a summary published. Candidates and employees who reside in the city must receive notice no less than ten business days before the tool is used. Penalties are up to five hundred dollars for a first violation and five hundred to fifteen hundred dollars for each subsequent one, per day. A health system using an AI resume screener or a video interview scorer for New York City roles is inside this, and the audit summary is a public document a plaintiff's lawyer will read.

State Technology Law section 103-e, as rewritten by chapter 96 of 2025, requires every state agency to maintain an inventory of its AI systems and publish it annually from December 30, and article 4 of the same law requires agencies to publish their automated employment decision tools. State agency is defined as any department, public authority, board, bureau, commission, division, office, council, committee or officer of the state, which reaches SUNY and its hospitals. NYC Health + Hospitals is a city public benefit corporation and its coverage is not confirmed. The Office of Information Technology Services policy NYS-P24-001, updated June 24, 2026, adds that decisions that impact the public are not to be made without oversight by appropriate staff, that automated final decision systems are not permitted, and that public facing AI interactions should be disclosed. The policy also binds vendors and contractors using an agency's IT resources, so a private practice contracting with a state agency can inherit it.

None of this is healthcare regulation, but it is the closest thing New York has to a written human review requirement, and it is the standard a state funded provider will be measured against.

Seven items. New York's in force duties are light and its pending duties are heavy, so most of this is building once for what is coming.

1. Classify every conversational agent against General Business Law section 1700. If it retains information across sessions or asks unprompted emotional questions, it is an AI companion. Build the self harm protocol with a 988 referral and the three hour disclosure, and log both.
2. Give written notice before any recorded or transcribed therapy session. S8484 would require it, every licensing body expects it, and it costs a paragraph in the intake pack. Do it for medical visits too; the one party consent rule is a floor, not a standard.
3. Confine AI in behavioural health to the two permitted lanes. Supplementary support (notes, records, anonymised trend analysis) and administrative support (scheduling, billing, logistics). No therapeutic communication, no independent therapeutic decisions.
4. Never let an agent present as a clinician. No clinical titles, no first names that imply a licence, and an unprompted statement that it is an AI. S7263-A would make the disclaimer insufficient on its own, so the impersonation has to be absent, not merely disclosed.
5. Ask every vendor for its SHIELD Act programme and its thirty day breach plan, and confirm voice recordings and biometric identifiers are inside it.
6. If you hire in New York City with software, get the bias audit done and the notice out ten business days ahead. Local Law 144 has been enforced since July 2023.
7. Instrument denials for clinical oversight now. Existing article 49 already requires a clinical peer reviewer. Flag template denials and specialty mismatches and appeal them, and be ready to log AI use notices if S7896 or S10241 passes.

New York in 2026 punishes the organisation that assumes nothing applies because no healthcare AI act has passed. The AI companion law, the SHIELD Act and Local Law 144 are all live, and the pending bills describe a standard that boards and courts will already recognise. Mapping your agents against those definitions, writing the consent and review controls, and aligning them with Colorado, California and Texas in one programme is what our AI governance and compliance engagement delivers. The healthcare AI law checker will tell you which duties you already carry, and you can book a scoping call to go through the pending ones.