Resource Center

Personal Health Information, known as PHI, requires enhanced security to ensure confidentiality and integrity of patient medical records. HealtheConnections is governed by regulations and policies set forth by the New York State Department of Health (NYSDOH) for the Statewide Health Information Network of New York (SHIN-NY). As a Qualified Entity (QE) of the SHIN-NY, HealtheConnections must comply with all security certification requirements.

These certifications include requirements such as password protection, encryption of data, virtual private networks, data transmission standards, auditing, physical premises security, training for staff and authorized users at participating organizations, and more. The policies, procedures, and implementations of all security controls by HealtheConnections has created an environment based on best practice security measures to protect patient data.

HealtheConnections complies with all New York State and Federal regulations and policies that are applicable to healthcare information. Each of HealtheConnections' participating organizations are required to sign agreements and to fulfill the terms and conditions that allow authorized users of that organization to access and view a patient’s medical records. Audits of the accesses are conducted on a regular frequency, depending on the type of access.

If you have questions about HealtheConnections’ security or privacy policies, call 315.671.2241 x5 and request to be transferred to the Chief Information Security Officer (CISO) or Privacy Officer. To learn more about SHIN-NY Privacy & Security Policies, click here to review patient resources. 

A list of participating organizations who have accessed your records and a list of your provided consents are available. Click to download the Patient Audit Log Request Form. Complete and follow the instructions on the sheet to return to HealtheConnections. If you prefer to return the form to HealtheConnections in-person, you must make an appointment. To schedule an appointment, call 315.671.2241 extension 5.

For additional information, you can find our procedures by clicking Patient Audit Log Request Policy and Procedures. If you have difficulty downloading any of these files, an option to have copies sent to you is available by contacting us. Be sure to include the form name(s) in the Message box. Or, if you prefer, you may also contact our Support Team at 315.671.2241 extension 5.

Yes, HealtheConnections generates daily, weekly, and monthly audit reports that are provided to their participating organizations through a secure, on-line process. HealtheConnections’ participants are required to review and attest to their audit reports, as follows:

Daily Audits

• Break-the-Glass (BTG) report – a Break-the-Glass event is when an Authorized User gains one-time access to patient information used by a HealtheConnections participating organization in an emergency situation when the patient has selected “Emergency Only” consent or in a life-threatening medical emergency when a patient has not yet consented to that participant. Participants who have used the BTG functionality are notified on the next business day to review and attest to these events.

Weekly Audits

• Public Health and Organ Procurement Services – public health authorities, health oversight agencies, and federally designated organ procurement organizations are allowed to view patient records without the patient’s consent for purposes of public health activities, health oversight activities, and for facilitating organ, eye, or tissue donation and transplantation. The participants that are designated as public health or organ procurement organizations are notified at the beginning of each week to review and attest to their user accesses for the previous week.

Annual Audits

• Organizations are required to review a sample of patient records they have accessed and ensure that:
  • accesses to patient records were appropriate
  • all active users are still working in roles that require them to have access, and users were actually working in those roles at the time that they accessed patient records.
• Organizations are required to review a sample of consents they have sent to HealtheConnections and ensure that they have kept a copy of each consent form, and that the information on the form matches the information in the Consent Sample report.
• Audit results can be seen here.

There are penalties for inappropriate access to or use of your electronic health information. If at any time you suspect that someone who should not have seen or gotten access to information about you has done so, you may call your Provider’s office; or contact HealtheConnections at 315.671.2241 x5; or call the NYS Department of Health at 518-474-4987; or follow the complaint process of the federal Office for Civil Rights at www.hhs.gov/ocr/privacy/hipaa/complaints.