Find & Ask › New York › this rule

Cybersecurity Incident Reporting (HCBS DAL 24-07 / NH DAL 24-18 / ACF DAL 24-30)

New Yorksub_regulatoryNYSDOH Office of Aging and Long-Term Care

What this rule requires your agency to do

1Providers must report a possible or confirmed cybersecurity incident (one with material adverse impact on operations or ransomware in a material part of information systems) to the Department as soon as practicable via the Surge Operations Center at (917) 909-2676.(Cybersecurity Incident Reporting (HCBS DAL 24-07 / NH DAL 24-18 / ACF DAL 24-30))

Applies to: cross-cutting

Updates requirements for CHHAs, LHCSAs, hospices, nursing homes, and ACFs to report possible or confirmed cybersecurity incidents to the Department.

Regulatory information, not legal advice — always confirm against the cited official source. Verification reduces error; it does not certify compliance.