New York Hospital Cybersecurity Regulations: What 10 NYCRR 405.46 Requires, Clause by Clause

New York has written a dedicated cybersecurity regulation for general hospitals into its hospital minimum standards, and since 2 October 2025 every Article 28 general hospital in the state has had to meet all of it. The rule, 10 NYCRR section 405.46, was adopted under Public Health Law section 2803 and took effect on 2 October 2024, with the 72-hour incident reporting duty in force from that day and the rest of the section after a one-year compliance period. It reads much like the NYDFS cybersecurity regulation for financial firms, but it is enforced by the Department of Health and it adds hospital-specific items such as downtime procedures and patient data privacy policies. This guide walks through the section subdivision by subdivision, explains what evidence a surveyor or auditor is likely to expect, and shows where service accounts, automation and AI agents fall inside the rule. It is written for hospital CISOs, IT and compliance leads, and the boards that now have to approve the cybersecurity policy.

Key takeaways

• Full compliance has been due since 2 October 2025: the section took effect on 2 October 2024, incident reporting under subdivision (n) applied immediately, and hospitals had one year to meet the remaining requirements.
• The clock is 72 hours from determination: hospitals must report a cybersecurity incident to the Department no later than 72 hours after determining that one has occurred, and this sits alongside, not instead of, HIPAA and other notification duties.
• A named CISO and a board-approved policy are mandatory: the governing body approves the written policy on the CISO's recommendation, and the CISO reports to it in writing at least once a year.
• Identity controls are spelled out: MFA for remote access to internal networks unless the CISO approves compensating controls in writing, separate privileged accounts, a limited number of privileged accounts, and access reviews at least annually.
• Service accounts are in scope by definition: the definition of privileged account expressly covers "any authorized user account or service account" that can perform security-relevant functions, so machine identities count.

Scope: who and what is covered

Subdivision (a) applies the section to general hospitals licensed under Article 28 of the New York Public Health Law. It does not, by its own terms, extend to nursing homes, diagnostic and treatment centres or physician practices, although many of those sit inside health systems that will apply one programme across all sites. The Healthcare Cyber Regulation Map places 405.46 alongside HIPAA, FDA device rules and other regimes; this guide goes into the section itself.

Two features make the scope wider than it first looks. First, "information systems" is not limited to clinical systems, so building management, biomedical networks and administrative SaaS all fall within the risk assessment. Second, subdivision (i) lets a hospital use an affiliate or a qualified third party to meet the requirements, but responsibility for compliance stays with the hospital.

Key obligations

The table below takes the section in order. The wording is summarised from the official text published by the Department of Health; quote the regulation itself in your own policy documents.

The 15 policy topics in subdivision (d)

The policy set must address, at a minimum: information security; data governance and classification; asset inventory and device management; access controls and identity management; business continuity and disaster recovery planning and resources; systems operations and availability concerns; systems and network security; systems and network monitoring; systems and application development and quality assurance; physical security and environmental controls; patient data privacy; vendor and third-party service provider management; risk assessment; training and monitoring; and incident response. A single document can cover several topics, but an auditor will look for each topic by name, so a mapping table at the front of the policy set saves time.

What the CISO's annual report must cover

• Confidentiality and integrity: the confidentiality of nonpublic information and the integrity and security of information systems.
• Policies: the hospital's cybersecurity policies and procedures, implementation status and recommended revisions.
• Material risks: material cybersecurity risks to the hospital.
• Effectiveness: the overall effectiveness of the cybersecurity programme.
• Incidents: cybersecurity incidents during the reporting period and the steps taken to reduce future events.

The 72-hour report in practice

The clock in subdivision (n) runs from determining that a cybersecurity incident has occurred, not from first detection of an event. That makes the determination step in the incident response plan, which subdivision (m) requires in any case, the most important control for timely reporting. Record who made the determination, when, and on what facts. A ransomware deployment within a material part of the information systems is an incident by definition, so there is little room for debate in that scenario. The report is made in the manner the Department prescribes, and it does not replace HIPAA breach notification, FBI or CISA contact, or contractual notices. See the HIPAA Breach Notification Rule Guide for the federal clock.

Timeline and current status

As of November 2026 the section is in force as published on the Department of Health regulations site. Regulations can be amended, so check the official text before relying on a specific clause, and watch for Department guidance on the reporting channel.

Enforcement and penalties

Section 405.46 has no penalty clause of its own. It sits in Part 405 of the hospital minimum standards, so non-compliance is handled through the Department's normal hospital oversight, including surveys, statements of deficiencies and plans of correction. Civil penalties for violating the Public Health Law or its regulations are set by Public Health Law section 12, which provides for up to $2,000 per violation, up to $5,000 for a repeat violation of the same kind within twelve months where the violations posed a serious threat to health and safety, and up to $10,000 where a violation directly results in serious physical harm to a patient. The official text shows a later version of section 12(1), effective 1 April 2029, that lists only the $2,000 base amount, so check the current wording when you assess exposure. In practice the bigger exposures for a hospital after an incident are operational disruption, HIPAA enforcement and litigation; the Change Healthcare breach, where attackers used a remote access login without MFA, shows why regulators chose to write remote-access MFA into the rule.

What it means for AI agents and non-human identities

The regulation never mentions AI, but several clauses reach automation directly.

• Service accounts are privileged accounts when they can change security settings: integration engine accounts, EHR interface accounts, backup service accounts and directory sync accounts commonly can add or change accounts or alter configuration. Under (k)(4) to (k)(6) they need to be separate from user accounts, kept few in number, and limited to the functions they need. See the Service Account Security Guide.
• Access reviews include machine identities: the annual review in (k)(7) should list every service account, API key and OAuth application, with an owner who confirms it is still needed. The Service Account Inventory Template gives a starting structure.
• Prompt termination applies to vendor and contractor credentials: when a vendor contract ends, its API keys and remote access accounts should be revoked under (k)(9), not just its people's user accounts.
• AI agents and copilots act through accounts: an AI scribe, coding assistant or agent that reads the EHR or ticketing system holds tokens that are in scope for the risk assessment in (h), the third-party policies in (j) and the activity monitoring in (l). Give each agent its own identity, scope its permissions to its task, and log what it does so audit trails under (g) can attribute actions.
• Compensating controls need a human signature: where an interface account cannot use MFA, the CISO's written approval under (k)(2) and the annual review of compensating controls under (c) are the documented route. Record the controls, such as network restriction, credential vaulting and rotation, rather than leaving a silent exception.

For broader identity patterns in clinical environments, see the Healthcare Identity Security Guide.

Compliance steps

1. Confirm scope and ownership. List every Article 28 general hospital licence in the group, designate the CISO in writing, and confirm the governing body that will approve the policy.
2. Run or refresh the risk assessment. Cover clinical, biomedical, building and administrative systems and the third parties that reach them. Everything else in the section is meant to rest on it.
3. Map policies to the 15 topics. Build a coverage table, close gaps (patient data privacy and systems availability are commonly missing from IT-led policy sets), and take the set to the board.
4. Close the identity gaps first. Measure MFA on remote access, VPN and vendor portals; inventory privileged accounts including service accounts; split admin and daily accounts; document any compensating control with CISO sign-off.
5. Set retention to six years. Check log platforms, SIEM tiers and archive storage for audit trail retention, and keep architecture and maintenance records for the same period.
6. Write the determination step into the incident response plan. Name decision makers, include downtime procedures and contingency plans, add the Department report and other notices to the communications plan, and test it with a tabletop exercise.
7. Schedule testing. Book the annual penetration test, define scan frequency, and set remediation timeframes by severity. See the Penetration Testing Compliance Requirements Guide.
8. Prepare the first CISO report. Use the five required headings so the board record shows each one was covered.

Framework mapping

Hospitals already working to the HIPAA Security Rule will find overlap, but 405.46 is more prescriptive on MFA, penetration testing, the CISO role and the 72-hour report. See the HIPAA Security Rule Guide.

Measuring progress

• Remote access MFA coverage: share of remote access paths, including vendor access, with MFA or a CISO-approved compensating control on file.
• Privileged account count: number of privileged human and service accounts, trending down, with each one owned.
• Access review completion: percentage of systems reviewed in the last 12 months.
• Determination to report time: hours from incident determination to Department report in exercises and real events, against the 72-hour limit.
• Remediation within target: share of penetration test and scan findings fixed within the hospital's own risk-based timeframes.

Common failure patterns

• Treating it as a HIPAA rerun: the HIPAA risk analysis does not by itself cover business information, availability or the 15 named policy topics.
• Undocumented MFA exceptions: legacy clinical systems without MFA are common; the failure is having no written CISO approval and no annual review.
• Short log retention: SIEM hot storage of 90 days falls far short of the six-year record duty unless an archive tier exists.
• No owner for vendor accounts: vendor remote support accounts that stay active between visits defeat (k)(8) and (k)(9).
• Clock confusion: teams that wait for forensic certainty before "determining" an incident risk a late report; define criteria in advance.

Practitioner checklist

• Keep a dated copy of the official 405.46 text and track amendments.
• Hold the CISO designation and the latest board approval of the policy in one evidence folder.
• Maintain a policy coverage table for all 15 subdivision (d) topics.
• Inventory privileged accounts, including service accounts, and confirm each is separate, needed and owned.
• Record every MFA or encryption compensating control with written CISO approval and an annual review date.
• Set audit trail and systems records retention to at least six years.
• Write incident determination criteria, decision makers and the Department report into the response plan, with downtime procedures.
• Run the annual penetration test and track remediation against risk-based targets.
• Review third-party contracts for due diligence, protections and incident notice terms.

Standards and references

• New York State Department of Health: 10 NYCRR Section 405.46 Hospital Cybersecurity Requirements
• New York State Senate: Public Health Law Section 12, Violations and Penalties
• New York State Office of Information Technology Services: Governor Announces Proposed Hospital Cybersecurity Regulations
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev 5, Security and Privacy Controls
• US Department of Health and Human Services: HIPAA Security Rule

Related NHI Mgmt Group resources: Healthcare Cyber Regulation Map · NYDFS Part 500 Guide · Privileged Access Management Guide · Incident Response Plan Template · Healthcare Delivery Organisation Cybersecurity Programme Guide. This guide summarises 10 NYCRR 405.46 and related New York law and is not legal advice.