HIPAA compliance for Chiropractic practices in New York
Chiropractic offices often run lean on documented policies and training, the two gaps OCR cites most often in small-practice settlements. In New York, the federal HIPAA Security Rule is only the floor. SHIELD Act (N.Y. Gen. Bus. Law §899-bb) stacks on top.
The law that stacks on top of HIPAA in New York
Exposure: Up to $5,000 per violation for security failures, up to $250,000 for notification failures.
The NY AG treats a HIPAA Security Rule violation as a SHIELD violation. Enzo Biochem settled with the NY, NJ, and CT AGs for $4.5M on August 13, 2024.
Enforced by the state Attorney General, alongside federal OCR.
Recent OCR enforcement in New York and nationally
- BST & Co. CPAs, LLP$175,000
NY · Aug 18, 2025 · Maze ransomware and no Security Risk Analysis, affecting 170,000 individuals.
- Enzo Biochem (NY/NJ/CT AGs)$4,500,000
NY/NJ/CT · Aug 13, 2024 · HIPAA Security Rule failure treated as a SHIELD Act violation, affecting 2.4M patients.
- Solara Medical Supplies$3,000,000
(multi) · Jan 14, 2025 · Phishing breach, no Security Risk Analysis, and breach notification failure.
- Warby Parker, Inc.$1,500,000
national · Feb 20, 2025 · Credential stuffing, no Security Risk Analysis, and no audit log review.
- Gulf Coast Pain Consultants$1,190,000
FL · Dec 3, 2024 · Access termination failure and no Security Risk Analysis.
Nearly every action above names the same first failure: no documented Security Risk Analysis. It is the cheapest gap to close and the most expensive to leave open.
How a New York Chiropractic practice gets compliant
- 1
Get your free HIPAA Risk Score
Answer about ten questions about your Chiropractic practice. You get a 0 to 100 score weighted by OCR enforcement priority and an estimated penalty exposure for New York.
- 2
Close the gaps, done for you
Honest Comply builds the documented Security Risk Analysis, policies, training records, and Business Associate Agreements your practice is missing, deployed in 72 hours from intake.
- 3
Stay provable
Your record stays dated, signed, and current, so the day a breach brings OCR or the New York Attorney General to your door, you can produce a defensible record in one sitting.
New York Chiropractic HIPAA questions
- Does New York have medical privacy rules stricter than HIPAA for chiropractic practices?
- Yes. New York enforces SHIELD Act (N.Y. Gen. Bus. Law §899-bb) on top of federal HIPAA. The NY AG treats a HIPAA Security Rule violation as a SHIELD violation. Enzo Biochem settled with the NY, NJ, and CT AGs for $4.5M on August 13, 2024.
- What is the penalty exposure for a HIPAA violation in New York?
- Up to $5,000 per violation for security failures, up to $250,000 for notification failures. That sits on top of federal OCR civil monetary penalties, which is why a single incident in New York can draw enforcement from two directions.
- Can patients sue my Chiropractic practice directly in New York?
- Not directly under SHIELD Act (N.Y. Gen. Bus. Law §899-bb), but the state Attorney General can pursue penalties alongside OCR, so one breach can mean two enforcers.
- What does OCR look at first in a Chiropractic practice?
- The Security Risk Analysis. Chiropractic offices often run lean on documented policies and training, the two gaps OCR cites most often in small-practice settlements. A missing or stale analysis is the single most cited failure in recent settlements.
- How fast can a New York Chiropractic practice become compliant?
- Honest Comply deploys a complete, documented, audit-ready HIPAA record in 72 hours, with the clock starting when you submit your intake form, not at checkout. It is a flat $299 a month with unlimited staff.
See exactly where your chiropractic practice stands.
The free Risk Score scores your exposure against New York law and real OCR settlements in about five minutes. No card, no sales call.
Practice information only. We never ask for patient data.