The Health & Fitness Association strongly opposed the New York Health Information Privacy Act, which it claims would’ve harmed tech companies and gym operators
The New York Health Information Privacy Act (NYHIPA) is not going into law anytime soon, after Governor Kathy Hochul vetoed the act in what’s being categorized as a major win for fitness companies.
The bill would have had considerable consequences for businesses across fitness and wellness, including advertisers, mobile app providers, wearable device providers, wellness and nutrition companies and processors handling health information, and, potentially, gyms and studios.
NYHIPA would have imposed strict requirements on entities that handle health or wellness-related consumer data by requiring apps or websites to obtain affirmative consent from the user to retain their information, as well as separate consent to sell that data to third parties.
The Health & Fitness Association (HFA) actively lobbied against the bill, claiming that it “would have created significant operational, financial and compliance challenges for fitness facilities and the companies that provide the connected equipment and technology they rely on.”
The data encompassed in the bill ranged from an individual’s personal wellness habits and purchase histories to location and payment information that “relates to an individual’s physical or mental health” as well as “any inference drawn or derived about an individual’s physical or mental health that is reasonably linkable to an individual.”
“The bill’s expansive treatment of fitness technology data would have limited how operators incorporate these tools in their facilities and disrupted equipment, wearable, and technology companies’ ability to sell, support, and scale these solutions across New York,” HFA manager of government affairs Charles Regnante wrote in a letter to members.
The bill’s sponsor, New York State Senator Liz Krueger (D), fiercely defended the bill and opposed the governor’s veto.
“At a time when Americans’ privacy rights are under fierce attack, Governor Hochul has put the interests of big tech over protecting regular New Yorkers,” Krueger said in a statement.
“Most of us think our healthcare data is our own, that it’s protected by federal HIPAA laws and is sacrosanct, but that could not be further from the truth,” she continued. “Our health data is being collected, tracked, and sold to third parties by the very companies that are supposed to be taking care of us — including women’s health apps.”
HFA argued that the bill’s various layers of affirmative authorization would be both onerous for regulated entities to create and manage, and burdensome for customers to read and use.
“HFA expects similar legislation to be reintroduced during the 2026 legislative session and will continue engaging lawmakers to pursue a more balanced, practical approach to consumer data privacy that reflects how fitness facilities and industry partners actually operate,” Regnante wrote.
The win comes on the heels of another major success for fitness operators this year, after a U.S. appeals court struck down the Federal Trade Commission’s “click-to-cancel” rule, which would have forced gyms to make it easier for people to cancel their memberships.
