STATE OF NEW YORK
________________________________________________________________________
2376
2023-2024 Regular Sessions
IN SENATE
January 20, 2023
___________
Introduced by Sen. PERSAUD -- read twice and ordered printed, and when
printed to be committed to the Committee on Codes
AN ACT to amend the penal law, the general business law and the state
technology law, in relation to adding medical and health insurance
information within the definitions of identity theft
The People of the State of New York, represented in Senate and Assem-
bly, do enact as follows:
1 Section 1. Section 190.78 of the penal law, as added by chapter 619 of
2 the laws of 2002, is amended to read as follows:
3 § 190.78 Identity theft in the third degree.
4 A person is guilty of identity theft in the third degree when he or
5 she knowingly and with intent to defraud assumes the identity of another
6 person by presenting himself or herself as that other person, or by
7 acting as that other person or by using personal identifying information
8 of that other person, and thereby:
9 1. obtains goods, money, property or services or uses credit in the
10 name of such other person or causes financial loss to such person or to
11 another person or persons; or
12 2. commits a class A misdemeanor or higher level crime; or
13 3. obtains medical information and/or health insurance information in
14 the name of such person.
15 4. (a) For the purposes of this section, the term "medical informa-
16 tion" means any information regarding an individual's medical history,
17 mental or physical condition, or medical treatment or diagnosis by a
18 health care professional.
19 (b) For the purposes of this section, the term "health insurance
20 information" means an individual's health insurance policy number or
21 subscriber identification number, any unique identifier used by a health
22 insurer to identify the individual or any information in an individual's
23 application and claims history, including, but not limited to, appeals
24 history.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01629-02-3
S. 2376 2
1 Identity theft in the third degree is a class A misdemeanor.
2 § 2. Section 190.79 of the penal law, as added by chapter 619 of the
3 laws of 2002 and subdivision 4 as amended by chapter 279 of the laws
4 2008, is amended to read as follows:
5 § 190.79 Identity theft in the second degree.
6 A person is guilty of [identify] identity theft in the second degree
7 when he or she knowingly and with intent to defraud assumes the identity
8 of another person by presenting himself or herself as that other person,
9 or by acting as that other person or by using personal identifying
10 information of that other person, and thereby:
11 1. obtains goods, money, medical information, health insurance infor-
12 mation, property or services or uses credit in the name of such other
13 person in an aggregate amount that exceeds five hundred dollars; or
14 2. causes financial loss to such person or to another person or
15 persons in an aggregate amount that exceeds five hundred dollars; or
16 3. commits or attempts to commit a felony or acts as an accessory to
17 the commission of a felony; or
18 4. commits the crime of identity theft in the third degree as defined
19 in section 190.78 of this article and has been previously convicted
20 within the last five years of identity theft in the third degree as
21 defined in section 190.78, identity theft in the second degree as
22 defined in this section, identity theft in the first degree as defined
23 in section 190.80, unlawful possession of personal identification infor-
24 mation in the third degree as defined in section 190.81, unlawful
25 possession of personal identification information in the second degree
26 as defined in section 190.82, unlawful possession of personal identifi-
27 cation information in the first degree as defined in section 190.83,
28 unlawful possession of a skimmer device in the second degree as defined
29 in section 190.85, unlawful possession of a skimmer device in the first
30 degree as defined in section 190.86, grand larceny in the fourth degree
31 as defined in section 155.30, grand larceny in the third degree as
32 defined in section 155.35, grand larceny in the second degree as defined
33 in section 155.40 or grand larceny in the first degree as defined in
34 section 155.42 of this chapter.
35 5. (a) For the purposes of this section, the term "medical informa-
36 tion" means any information regarding an individual's medical history,
37 mental or physical condition, or medical treatment or diagnosis by a
38 health care professional.
39 (b) For the purposes of this section, the term "health insurance
40 information" means an individual's health insurance policy number or
41 subscriber identification number, any unique identifier used by a health
42 insurer to identify the individual or any information in an individual's
43 application and claims history, including, but not limited to, appeals
44 history.
45 Identity theft in the second degree is a class E felony.
46 § 3. Subparagraph (i) of paragraph (b) of subdivision 1 of section
47 899-aa of the general business law is amended by adding two new clauses
48 6 and 7 and two new undesignated paragraphs to read as follows:
49 (6) medical information; or
50 (7) health insurance information; or
51 For the purposes of this paragraph, "medical information" means any
52 information regarding an individual's medical history, mental or phys-
53 ical condition, or medical treatment or diagnosis by a health care
54 professional.
55 For the purposes of this paragraph, "health insurance information"
56 means an individual's health insurance policy number or subscriber iden-
S. 2376 3
1 tification number, any unique identifier used by a health insurer to
2 identify the individual or any information in an individual's applica-
3 tion and claims history, including, but not limited to, appeals history.
4 § 4. Subparagraph (i) of paragraph (a) of subdivision 1 of section 208
5 of the state technology law is amended by adding two new clauses 6 and 7
6 and two new undesignated paragraphs to read as follows:
7 (6) medical information; or
8 (7) health insurance information; or
9 For the purposes of this paragraph, "medical information" means any
10 information regarding an individual's medical history, mental or phys-
11 ical condition, or medical treatment or diagnosis by a health care
12 professional.
13 For the purposes of this paragraph, "health insurance information"
14 means an individual's health insurance policy number or subscriber iden-
15 tification number, any unique identifier used by a health insurer to
16 identify the individual or any information in an individual's applica-
17 tion and claims history, including, but not limited to, appeals history.
18 § 5. This act shall take effect on the ninetieth day after it shall
19 have become a law. Effective immediately, the addition, amendment
20 and/or repeal of any rule or regulation necessary for the implementation
21 of this act on its effective date are authorized to be made and
22 completed on or before such effective date.