New attorney general guidance explains who is covered, how to handle requests for health information and where the law has limits.
By David LaGuerre | November 9, 2026
New York Attorney General Letitia James released guidance Monday explaining how the state’s Shield Law protects people who receive, provide or help others obtain reproductive and gender-affirming health care that is legal in New York.
The plain-language resource is aimed at patients, families, providers, attorneys, businesses and others who may receive a subpoena or request for information. For Mohawk Valley clinics and organizations, a central issue is what must happen before covered records can be shared.
The guidance describes existing protections and the attorney general’s approach to enforcing them. It is not an announcement that every request for health information is prohibited. The rules depend on what is being requested, why, and whether an exception or valid court order applies.
Protections reach beyond a doctor’s office
According to the guidance, protected activity includes receiving, providing or helping someone obtain reproductive or gender-affirming care, as long as the care is otherwise legal in New York. Patients managing their own care are included.
The protections extend to families, doctors, nurses, therapists, other health professionals, clinic staff and volunteers. They can also cover someone who drives a patient to an appointment or helps pay for care, as well as insurers and attorneys.
Location matters. The attorney general says patients are protected from being penalized in New York regardless of where their protected activity occurred. Providers and helpers are generally protected when they were physically in New York while providing care or assistance. Telehealth care can be protected when the provider is in New York, even if the patient is elsewhere.
The guidance also states an important limit: New York can restrict cooperation with out-of-state legal actions, but it cannot prevent another state from starting them.
Check a request before releasing records
The disclosure rules can reach more than medical records. The guidance says protected information may include billing records, internet searches and location information that can reasonably be linked to a person or organization’s protected health activity.
They also apply beyond hospitals. Individuals, businesses, nonprofits, payment platforms and social-media companies located, headquartered or incorporated in New York may have duties when they receive a covered request.
The first step is to determine whether the request is about legally protected activity or asks for protected health information. A request clearly unrelated to that activity does not trigger the Shield Law steps. When coverage is unclear, the guidance describes a sworn “Coverage Affirmation” that can help establish the request’s purpose.
For a covered request, recipients generally must obtain a separate sworn statement confirming a permitted purpose before releasing information. The guidance includes an affirmation form and explains when each part applies.
Notice and waiting periods matter
Where the notice requirements apply, the recipient must notify the attorney general and provide a copy of the request. The guidance gives a deadline of five business days after receiving it or five business days before the requested response date, whichever comes sooner.
The recipient must also make a reasonable effort to notify affected people whose protected information would be disclosed. That notice must come as soon as reasonably possible and at least 30 days before disclosure. Verbal notice must be accompanied by written notice.
The general waiting period is 30 calendar days after notifying both the attorney general and affected individuals. The official Shield Law notice form provides a way to notify the office and upload relevant documents.
These are general rules, not a deadline calculation for a particular subpoena. Anyone facing a request should read the full guidance and obtain legal advice about the facts and applicable exceptions before deciding how to respond.
Exceptions and other legal duties remain
The guidance describes circumstances that can change or remove some required steps. They include signed requests for a person’s own records, disclosures for treatment or routine medical billing, certain requests by someone defending against an investigation, and some government audits or grant reporting.
A court order that is valid and enforceable in New York can also change the requirements. The law does not prevent investigations into conduct that would violate New York law, though a covered information request may still require notice and other steps.
The attorney general says improper disclosure or failure to follow required steps can bring a $10,000 penalty. A false sworn statement used to get around the law can bring a $15,000 penalty. The office can pursue enforcement, and the guidance describes options for affected people to challenge requests or seek legal relief.
Where readers can get the details
The state’s full guidance includes examples, definitions, forms and a quick reference guide. Questions about the guidance can be sent to shield.law@ag.ny.gov.
The attorney general stresses that the resource reflects the office’s interpretation of the law and does not provide private legal or medical advice. It recommends consulting private counsel about legal duties and a medical provider about care.
Sources: New York Attorney General announcement distributed November 9, 2026, and Shield Law guidance updated the same day. This report is general news information, not legal or medical advice.