NEW YORK — Anyone in New York who receives a subpoena or an official demand for health records now has a written roadmap for what to do next — and a $10,000 reason not to skip the steps. Attorney General Letitia James on Monday, November 9, released plain-language guidance on New York's Shield Law, the law that protects people who receive, provide, or help others access abortion and gender-affirming care that is legal in New York. The guidance explains what New Yorkers must do if they are asked for information about protected care, when information can legally be shared, and how the state blocks attempts from outside New York to investigate or punish that care. It is written for patients, families, health care providers, attorneys, businesses, and anyone else who might receive a subpoena or another request for information about legally protected health care.

“New York has some of the strongest protections in the country for reproductive and gender-affirming health care, and we want to make sure people know how to use them,” Attorney General James said. “This guidance gives New Yorkers a clear roadmap for protecting their private health information and standing up to unlawful attempts to reach across our state's borders. My office will always defend New Yorkers' right to make personal health care decisions free from interference.” The guidance is a practical document, not a speech: it sets out the exact sequence a hospital, a clinic, a company, or an individual must follow before any protected record changes hands.

Source: Office of the New York Attorney General press release, Nov 9 2026

What Shield Law 2.0 changed

New York's original Shield Law was passed in the wake of the U.S. Supreme Court's decision in Dobbs v. Jackson, the ruling that overturned the federal constitutional right to abortion. That first law bars New York government entities from helping out-of-state efforts to penalise protected health care. In December 2025, Governor Kathy Hochul signed Shield Law 2.0, which extends the protections to more providers — including therapists, speech pathologists, and other mental health practitioners — and establishes formal processes governing when protected health information may be disclosed at all. Monday's guidance explains those newer protections and turns them into steps a non-lawyer can follow.

The law covers a broad range of reproductive and gender-affirming health care that is legal in New York, and it protects everyone in the chain around that care: patients and their families; doctors, nurses, therapists and other health care professionals; clinic staff and volunteers; people who help someone reach an appointment or pay for care; insurers; and the attorneys who represent or advise patients and providers. Patients and people managing their own care are protected wherever they are. Health care professionals and those helping patients are generally protected when they are physically in New York while providing care. The protections also extend to telehealth — including medication abortion provided by a physician in New York to a patient elsewhere.

The steps before any records change hands

The Shield Law prohibits New Yorkers and New York companies from immediately handing over protected health information in response to a subpoena, an investigative demand, or any similar request. Anyone who receives such a request must first confirm whether it is about legally protected care or health information covered by the law; obtain a sworn statement from the requestor affirming that the information will not be used to punish someone for legally protected health care; notify the Office of the Attorney General and make a reasonable effort to notify anyone whose information would be included; and then wait 30 calendar days after notification before turning over any information. The Attorney General's office says those steps exist to alert people when someone is seeking their sensitive health information and to give the office a chance to decide whether disclosure is allowed under New York law. The guidance includes concrete examples of information that is and is not covered, plus tools for getting more information from the requestor and meeting the notification requirement.

Source: New York Attorney General, Shield Law guidance, Nov 9 2026

The other half of the law is what New York itself will not do. State officials, law enforcement, and courts cannot enforce subpoenas, warrants, or extradition requests — or cooperate with investigations or information requests — that seek to punish protected health care. New York courts cannot treat the fact that someone received or provided protected care as evidence against them, and parents and guardians cannot be punished for allowing their children to receive protected care. Licensing boards cannot discipline providers for offering protected care, or attorneys for representing people who provide or receive it. Professional-liability insurers cannot penalise medical professionals for providing protected care, including by raising their rates or refusing to issue policies.

There are exceptions, and the guidance lists them plainly. The law does not stop people from accessing their own health records, or providers from using patient information for billing or treatment. A person or entity being investigated or prosecuted for providing protected care can request information needed for their own defence, as long as they provide the required sworn statement. Exceptions also apply to certain government audits and grant-reporting requirements. And the Shield Law does not prevent investigations into conduct that would itself violate New York law — although if the request concerns protected care, the recipient generally must still follow the notice and waiting-period rules unless another exception applies or a valid court order changes them.

The enforcement side has teeth in both directions. New Yorkers who follow the required steps are protected: a person or organisation generally cannot be punished or held in contempt for delaying a response while complying with the Shield Law, and anyone who receives a covered request can also challenge it in court. Those who ignore the steps or improperly share protected information face a $10,000 penalty, and lying in a sworn statement to circumvent the law carries a $15,000 penalty. The Attorney General's office can take enforcement action over violations and false affirmations, and people targeted for providing or receiving protected care can sue those who try to punish them and, in certain circumstances, recover their costs and legal fees.

What happens next: the guidance takes effect as the working instruction for New York's hospitals, clinics, insurers, businesses, and law offices from today — there is no waiting period for a law that is already on the books. Anyone unsure whether a request they have received is covered is told to read the guidance, notify the Attorney General, and upload the relevant documents at www.ag.ny.gov/shield-law-notice; questions go to shield.law@ag.ny.gov. For New York's large Punjabi and South Asian community — concentrated in Queens, Long Island, and the Hudson Valley — the practical point is the same as for every New Yorker: if a letter ever arrives demanding records about care that is legal in New York, the law requires a pause, a sworn statement, and a notice to Albany before a single page changes hands.