In the complex arena of modern legislative policy, few voices carry as much weight as Donald Gainsborough. As the driving force behind Government Curated, Gainsborough has spent his career at the intersection of civil liberties and technological regulation, dissecting the ways in which our digital lives collide with our fundamental rights. Today, we sit down with him to discuss the urgent movement behind the New York Health Information Privacy Act, a piece of legislation currently awaiting a signature from the Governor’s desk. This conversation delves into the growing “digital trail” created by wellness apps, the specific vulnerabilities of marginalized communities in a post-Dobbs landscape, and the unprecedented coalition of over 150 organizations—ranging from reproductive health experts to religious liberty groups—who are demanding immediate action to protect the bodily autonomy and privacy of every New Yorker.
The interview explores how the revised act aims to bridge the gaps in existing privacy laws that currently allow corporations to profit from sensitive health data. Gainsborough sheds light on the shift from medical records to behavioral data, explaining why counting steps or tracking a period has become a liability in a landscape of increasing surveillance. We discuss the legal protections intended to shield residents from out-of-state law enforcement and the broader fight against the commodification of personal wellness by Big Tech.
The New York Health Information Privacy Act was recently revised to address previous concerns regarding corporate compliance. How do these amendments change the landscape for businesses and patients compared to the version that was vetoed last year?
The evolution of this bill between last year and 2026 reflects a sophisticated balancing act that addresses the friction between consumer protection and the operational realities of the tech sector. When the Governor vetoed the previous iteration in 2025, there was a clear signal that the requirements were perceived as too ambiguous for companies to implement without significant legal risk. This year, the advocates and legislators have been incredibly diligent in clarifying the specific requirements to smooth out the compliance process. By refining the language, the act now provides a clearer roadmap for businesses to follow, ensuring they know exactly how to manage, store, and dispose of data without the fear of accidental non-compliance. For the patients, this is a massive win because it moves the legislation from a theoretical ideal to a functional reality that can actually be enforced. We are seeing a shift where the burden of protection is placed on the entity collecting the data, rather than the individual user who is often forced to navigate 50-page terms-of-service agreements just to use a heart-rate monitor.
Many people assume their health data is already protected by existing laws, but advocates suggest there is a massive “digital trail” that remains vulnerable. Could you explain the specific types of information that are currently being exploited?
There is a dangerous misconception that HIPAA covers every piece of health data we generate, but that simply isn’t the case in our hyper-connected world. In reality, HIPAA generally only applies to “covered entities” like your doctor’s office or your insurance provider, leaving a massive void where most of our modern health interactions happen. When you are counting your steps on a wearable device, using a meditation app to manage anxiety, or tracking your period on a smartphone, that information is often considered commercial data rather than protected medical records. This “digital trail” is essentially a gold mine for bad actors and Big Tech companies who can harvest, share, and profit off these intimate details without your explicit consent. Over 150 organizations are now sounding the alarm because they see how this data is being commodified; it’s no longer just about seeing a doctor, it’s about the fact that your search history for “gender-affirming care” or “HIV support groups” can be sold to the highest bidder. This bill is designed to close that loophole, ensuring that searching for healthcare doesn’t leave you vulnerable to outside entities tracking your every move.
With reproductive rights and gender-affirming care under increasing scrutiny nationwide, how does this legislation act as a shield against out-of-state law enforcement and hostile legal environments?
The landscape of 2026 requires New York to be more than just a sanctuary in name; it must be a fortress of data security for those seeking care. The New York Health Information Privacy Act is specifically designed to help shield residents and visitors from the reach of out-of-state law enforcement who might attempt to use digital footprints to prosecute individuals for seeking lawful care. We are talking about a world where an individual’s location history or reproductive health app data could be subpoenaed by a hostile state to prove they traveled for an abortion or gender-affirming treatment. By establishing strict limits on how this data is collected and shared, New York is effectively saying that our digital infrastructure will not be a tool for surveillance or punishment. This is about bodily autonomy and the right to seek medical support without the looming fear that a trail of electronic breadcrumbs will be used as evidence in a criminal case elsewhere. It creates a necessary barrier of due process that respects the dignity of the patient and the provider alike, ensuring that care remains a private matter between an individual and their healthcare team.
There is a strong emphasis in the recent coalition letter on the impact of health data surveillance on marginalized communities. How does this bill address the intersections of racial justice, drug policy, and privacy?
The data reveals a stark reality: the misuse of sensitive health information is not an equal-opportunity threat, but rather one that falls hardest on Black, Brown, and historically marginalized communities. When we talk about the criminalization of people who use drugs or those living with HIV, we are talking about highly racialized systems of surveillance that have been in place for decades. This bill addresses that head-on by putting clear limits on the collection and sharing of information that has traditionally been used to target these populations. For a person in recovery or someone navigating the complexities of a chronic condition, the fear of their data being used against them by law enforcement or employers is a very real barrier to seeking treatment. The coalition of 150+ organizations, including racial justice and disability groups, recognizes that privacy is a prerequisite for safety and dignity. By preventing companies from exploiting these vulnerabilities for profit, the act affirms that a person’s health status should never be used as a weapon for discrimination or a justification for increased policing in over-surveilled neighborhoods.
The role of “Big Tech” and the wellness industry is a central theme in this debate. Why is it becoming so difficult to separate genuine health support from corporate data harvesting?
We are currently in a pivotal transitional stage where the very tools meant to improve our well-being—like mindfulness apps and mental health platforms—are also designed as sophisticated engines for data extraction. The wellness industry has convinced millions of New Yorkers that their most intimate vulnerabilities are “vital profit-driven information,” which is a fundamentally predatory framework. It is becoming difficult to find a digital health service that doesn’t require you to sign away your privacy before you can even access a single meditation session or symptom tracker. This power grab by elites and corporations transforms the act of seeking support into a transaction where the user is the product. The New York Health Information Privacy Act seeks to re-establish the boundary between service and surveillance, ensuring that when you use a tool for your health, you aren’t unknowingly feeding a massive data broker ecosystem. It’s about restoring the human element to wellness and making sure that our pursuit of a healthy life doesn’t come at the cost of our private identities.
Beyond medical records, the act covers everything from meditation apps to location history. What are the long-term risks for older adults and vulnerable populations if these specific data points remain unregulated?
For older New Yorkers, the risks of unregulated health data go far beyond targeted advertising; we are talking about the potential for massive financial abuse and manipulation. As technology allows more seniors to age safely in their communities through monitoring apps and telehealth, it also creates new surfaces for data exploitation. Sensitive information about a person’s cognitive health or physical mobility can reveal vulnerabilities that “bad actors” are all too eager to exploit for predatory lending or insurance discrimination. If these data points remain in the hands of corporations without oversight, we could see a future where an older adult’s digital health profile is used to deny them housing or services based on predictive modeling. The Center for Elder Law & Justice and other advocates are rightly concerned that without this act, the very technology meant to empower seniors will instead be used to strip them of their autonomy. We must recognize that health data belongs to the individual, not the corporation, and failing to regulate it today is a recipe for systemic elder abuse tomorrow.
Looking at the massive coalition of over 150 organizations—from religious groups to tech experts—what does this unity tell us about the current state of public trust in New York’s digital infrastructure?
The sheer breadth of this coalition is unprecedented and signals a profound breakdown in public trust regarding how our data is handled. When you have Jewish groups, atheists, LGBTQ+ advocates, and medical students all signing the same letter, it tells you that the fear of surveillance has crossed all traditional political and social boundaries. This isn’t just a niche concern for privacy hawks; it’s a universal outcry from New Yorkers who feel that their dignity is being stripped away byte by byte. People are waking up to the fact that they are living in a “surveillance state” disguised as a “tech-forward society,” and they are looking to the government to stand up against the greed of Big Tech. This unity is a powerful mandate for Governor Hochul, showing that a vast majority of her constituents believe that protecting health privacy is a fundamental responsibility of leadership. It’s a call for New York to lead the nation by proving that it is possible to embrace technology without sacrificing the core values of confidentiality and respect for the individual.
What is your forecast for the future of health data privacy in New York if Governor Hochul chooses to sign this bill into law this year?
My forecast is that New York will immediately become the gold standard for health data privacy in the United States, sparking a domino effect across other states that are currently struggling with similar issues. By signing this into law in 2026, the Governor would be establishing a “safe haven” where patients, providers, and advocates can operate without the constant shadow of data exploitation looming over them. We will likely see a surge in the development of “privacy-first” health technologies, as companies adjust their business models to meet these new, higher standards of consent and transparency. Most importantly, it will restore a level of trust in the medical and wellness systems that has been severely eroded in recent years. Patients will feel empowered to use apps for their mental health, research reproductive care, and manage their chronic conditions with the certainty that their information won’t be sold to the highest bidder or used against them in a court of law. It’s a rare opportunity to turn the tide against the commodification of the human experience and ensure that our health remains a private journey, rather than a corporate asset.
