NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
 
BILL NUMBER: A4737B
SPONSOR: Lavine
 
TITLE OF BILL:
An act to amend the penal law, the general business law and the state
technology law, in relation to adding medical and health insurance
information within the definitions of identity theft
 
PURPOSE OR GENERAL IDEA OF BILL:
This bill intends to protect individuals from medical identity theft by
including medical and health insurance information within the definition
of identity theft.
 
SUMMARY OF SPECIFIC PROVISIONS:
Section one would add the definitions of medical information and health
insurance information to the definition of identity theft in Article 190
of the Penal Law.
Section two through four would add medical information and health insur-
ance information to the crimes: identity theft in the third degree,
identity theft in the second degree, and identity theft in the first
degree.
Sections five and six amend section 899-aa of General Business Law and
section 208 State Technology Law to add the definitions of medical
information and health insurance information.
 
DIFFERENCE BETWEEN ORIGINAL AND AMENDED VERSION (IF APPLICABLE):
The B-Print makes a conforming change to identity theft in the third
degree, so that it is consistent with identity theft in the second
degree and identity theft in the first degree.
 
JUSTIFICATION:
According to the World Privacy Forum (WPF) in 2006, medical identity
theft accounts for approximately 3 percent of total ID theft, which is
reported to be the fastest-growing crime over the last seven years.
Criminals now pay upwards to $50 for a stolen medical ID, in comparison
to $1 for a social security number. Victims of medical identity theft
are left with few avenues for assistance as compared to regular ID
theft, partially due to lack of knowledge regarding this crime. Stolen
items typically include patient records, documents on insurance bene-
fits, and passwords to medical servers.
Whether it is a physician identification number or patient identifica-
tion information that is stolen, medical identity theft is a serious
problem, estimated to affect 250,000-500,000 individuals per year.
Little assistance is provided for victims under the Health Insurance
Portability and Accountability Act (HIPAA). Rather, the rigidness of
HIPAA can create difficulties for victims trying to fix files that have
been altered by identity thieves.
For example, medications, allergies, and surgeries fraudulently billed
in the name of the victim become permanent records that are hard to
correct. In addition to the hardship on patients, medical identity theft
is a costly burden on the healthcare system. According to the National
Health Care Anti-Fraud Association, of the $60 billion in health care
fraud each year, 1 percent, or $6 billion per year is attributed to
medical identity fraud.
 
PRIOR LEGISLATIVE HISTORY:
2019-2020: A0809 referred to Codes
2017-2018: A4075 referred to Codes
2015-2016: A2115 referred to Code
2013-2014: A2249 referred to Codes
2012: A8890 referred to Codes
2011: A1050 referred to Codes
2009-2010: A6291 referred to Codes
 
FISCAL I=ICATIONS:
Unknown.
 
EFFECTIVE DATE:
This bill would take effect on the 90th day after it shall have become a
law.
STATE OF NEW YORK
________________________________________________________________________
4737--B
2023-2024 Regular Sessions
IN ASSEMBLY
February 23, 2023
___________
Introduced by M. of A. LAVINE -- read once and referred to the Committee
on Codes -- recommitted to the Committee on Codes in accordance with
Assembly Rule 3, sec. 2 -- committee discharged, bill amended, ordered
reprinted as amended and recommitted to said committee -- again
reported from said committee with amendments, ordered reprinted as
amended and recommitted to said committee
AN ACT to amend the penal law, the general business law and the state
technology law, in relation to adding medical and health insurance
information within the definitions of identity theft
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Subdivision 2 of section 190.77 of the penal law is
2 amended by adding two new paragraphs d and e to read as follows:
3 d. "medical information" means any information regarding an individ-
4 ual's medical history, mental or physical condition, or medical treat-
5 ment or diagnosis by a health care professional.
6 e. "health insurance information" means an individual's health insur-
7 ance policy number or subscriber identification number, any unique iden-
8 tifier used by a health insurer to identify the individual or any infor-
9 mation in an individual's application and claims history, including, but
10 not limited to, appeals history.
11 § 2. Section 190.78 of the penal law, as added by chapter 619 of the
12 laws of 2002, is amended to read as follows:
13 § 190.78 Identity theft in the third degree.
14 A person is guilty of identity theft in the third degree when [he or
15 she] such person knowingly and with intent to defraud assumes the iden-
16 tity of another person by presenting [himself or herself] themself as
17 that other person, or by acting as that other person or by using
18 personal identifying information of that other person, and thereby:
19 1. obtains goods, money, medical information, health insurance infor-
20 mation, property or services or uses credit in the name of such other
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD01629-08-4
A. 4737--B 2
1 person or causes financial loss to such person or to another person or
2 persons; or
3 2. commits a class A misdemeanor or higher level crime.
4 Identity theft in the third degree is a class A misdemeanor.
5 § 3. Section 190.79 of the penal law, as added by chapter 619 of the
6 laws of 2002 and subdivision 4 as amended by chapter 279 of the laws of
7 2008, is amended to read as follows:
8 § 190.79 Identity theft in the second degree.
9 A person is guilty of [identify] identity theft in the second degree
10 when [he or she] such person knowingly and with intent to defraud
11 assumes the identity of another person by presenting [himself or
12 herself] themself as that other person, or by acting as that other
13 person or by using personal identifying information of that other
14 person, and thereby:
15 1. obtains goods, money, medical information, health insurance infor-
16 mation, property or services or uses credit in the name of such other
17 person in an aggregate amount that exceeds five hundred dollars; or
18 2. causes financial loss to such person or to another person or
19 persons in an aggregate amount that exceeds five hundred dollars; or
20 3. commits or attempts to commit a felony or acts as an accessory to
21 the commission of a felony; or
22 4. commits the crime of identity theft in the third degree as defined
23 in section 190.78 of this article and has been previously convicted
24 within the last five years of identity theft in the third degree as
25 defined in section 190.78, identity theft in the second degree as
26 defined in this section, identity theft in the first degree as defined
27 in section 190.80, unlawful possession of personal identification infor-
28 mation in the third degree as defined in section 190.81, unlawful
29 possession of personal identification information in the second degree
30 as defined in section 190.82, unlawful possession of personal identifi-
31 cation information in the first degree as defined in section 190.83,
32 unlawful possession of a skimmer device in the second degree as defined
33 in section 190.85, unlawful possession of a skimmer device in the first
34 degree as defined in section 190.86, grand larceny in the fourth degree
35 as defined in section 155.30, grand larceny in the third degree as
36 defined in section 155.35, grand larceny in the second degree as defined
37 in section 155.40 or grand larceny in the first degree as defined in
38 section 155.42 of this chapter.
39 Identity theft in the second degree is a class E felony.
40 § 4. Section 190.80 of the penal law, as added by chapter 619 of the
41 laws of 2002, subdivision 4 as amended by chapter 279 of the laws of
42 2008, is amended to read as follows:
43 § 190.80 Identity theft in the first degree.
44 A person is guilty of identity theft in the first degree when [he or
45 she] such person knowingly and with intent to defraud assumes the iden-
46 tity of another person by presenting [himself or herself] themself as
47 that other person, or by acting as that other person or by using
48 personal identifying information of that other person, and thereby:
49 1. obtains goods, money, medical information, health insurance infor-
50 mation, property or services or uses credit in the name of such other
51 person in an aggregate amount that exceeds two thousand dollars; or
52 2. causes financial loss to such person or to another person or
53 persons in an aggregate amount that exceeds two thousand dollars; or
54 3. commits or attempts to commit a class D felony or higher level
55 crime or acts as an accessory in the commission of a class D or higher
56 level felony; or
A. 4737--B 3
1 4. commits the crime of identity theft in the second degree as defined
2 in section 190.79 of this article and has been previously convicted
3 within the last five years of identity theft in the third degree as
4 defined in section 190.78, identity theft in the second degree as
5 defined in section 190.79, identity theft in the first degree as defined
6 in this section, unlawful possession of personal identification informa-
7 tion in the third degree as defined in section 190.81, unlawful
8 possession of personal identification information in the second degree
9 as defined in section 190.82, unlawful possession of personal identifi-
10 cation information in the first degree as defined in section 190.83,
11 unlawful possession of a skimmer device in the second degree as defined
12 in section 190.85, unlawful possession of a skimmer device in the first
13 degree as defined in section 190.86, grand larceny in the fourth degree
14 as defined in section 155.30, grand larceny in the third degree as
15 defined in section 155.35, grand larceny in the second degree as defined
16 in section 155.40 or grand larceny in the first degree as defined in
17 section 155.42 of this chapter.
18 Identity theft in the first degree is a class D felony.
19 § 5. Paragraph (b) of subdivision 1 of section 899-aa of the general
20 business law is amended by adding two new undesignated paragraphs and
21 subparagraph (i) of such paragraph is amended by adding two new clauses
22 6 and 7 to read as follows:
23 (6) medical information; or
24 (7) health insurance information; or
25 For the purposes of this paragraph, "medical information" means any
26 information regarding an individual's medical history, mental or phys-
27 ical condition, or medical treatment or diagnosis by a health care
28 professional.
29 For the purposes of this paragraph, "health insurance information"
30 means an individual's health insurance policy number or subscriber iden-
31 tification number, any unique identifier used by a health insurer to
32 identify the individual or any information in an individual's applica-
33 tion and claims history, including, but not limited to, appeals history.
34 § 6. Paragraph (a) of subdivision 1 of section 208 of the state tech-
35 nology law is amended by adding two new undesignated paragraphs and
36 subparagraph (i) of such paragraph is amended by adding two new clauses
37 6 and 7 to read as follows:
38 (6) medical information; or
39 (7) health insurance information; or
40 For the purposes of this paragraph, "medical information" means any
41 information regarding an individual's medical history, mental or phys-
42 ical condition, or medical treatment or diagnosis by a health care
43 professional.
44 For the purposes of this paragraph, "health insurance information"
45 means an individual's health insurance policy number or subscriber iden-
46 tification number, any unique identifier used by a health insurer to
47 identify the individual or any information in an individual's applica-
48 tion and claims history, including, but not limited to, appeals history.
49 § 7. This act shall take effect on the ninetieth day after it shall
50 have become a law. Effective immediately, the addition, amendment
51 and/or repeal of any rule or regulation necessary for the implementation
52 of this act on its effective date are authorized to be made and
53 completed on or before such effective date.