SHIN-NY Data Extract Privacy: What Independent Specialty Practices in New York Need to Know

Statewide Common Participation Agreement Compliance

As an independent specialty practice, your use of SHIN-NY data extracts is governed by the Statewide Common Participation Agreement and the SHIN-NY Privacy and Security Policies. These instruments define who may access data, why, and how extracts must be safeguarded once they leave the SHIN-NY environment.

What the Agreement Requires

• Use and disclosure limited to permitted purposes (e.g., treatment, payment, operations, and other authorized purposes) and the minimum necessary standard.
• Strict prohibitions on re-disclosure except as explicitly authorized by the Statewide Common Participation Agreement, Qualified Entity Policies, or patient consent.
• Role-based access, training, and sanctions for violations, plus written procedures covering extract creation, storage, sharing, and destruction.
• Business Associate Agreements and vendor due diligence when third parties touch SHIN-NY data extracts.

Applying Requirements to Data Extracts

• Define “data extract” in your policy (e.g., CCD/FHIR exports, flat files, reports) and map each extract to a permitted purpose.
• Label extracts with purpose, sensitivity, and retention limits; store only as long as necessary and securely dispose when no longer needed.
• Segment specially protected information (e.g., behavioral health, HIV, substance use disorder) and apply additional controls before any disclosure.

Governance and Documentation

• Maintain a current inventory of extracts, owners, locations, and recipients.
• Document approvals, consent dependencies, and review cycles; align policies with SHIN-NY Privacy and Security Policies and your QE’s participation terms.

Qualified Entity Connection Requirements

Every practice connects to SHIN-NY through a regional Qualified Entity. Your QE sets technical, administrative, and operational prerequisites you must meet before receiving or generating data extracts.

Technical Onboarding

• Establish secure transport (e.g., mutually authenticated channels) and confirm interface specifications (HL7, C-CDA, FHIR, or batch formats) required for extracts.
• Separate test and production, manage certificates/keys, and validate that extract processes do not bypass QE controls.

Administrative and Policy Alignment

• Accept and operationalize Qualified Entity Policies, including access approval workflows, training, and attestations.
• Designate a privacy/security officer to coordinate with the QE on incidents, audits, and policy updates.

Ongoing Compliance

• Maintain accurate user rosters, promptly remove access, and monitor account activity.
• Notify the QE about material changes (systems, vendors, or data flows) that affect extract handling.

Data Sharing Protocols and Restrictions

Data sharing via extracts must follow purpose-based access, minimum necessary, and re-disclosure limits. You should be able to show why each extract exists and who is authorized to view it.

Permitted Purposes and Minimum Necessary

• Tie every extract to a permitted purpose and document the clinical or operational need.
• Limit fields, time frames, and patient sets to the minimum necessary to achieve that purpose.

Special Protections and Segmentation

• Apply heightened controls for sensitive categories (e.g., substance use disorder information under 42 CFR Part 2, mental health, HIV, reproductive health, and genetic data).
• Prevent downstream systems from commingling sensitive data with routine datasets unless equally protected.

Re-disclosure and Third Parties

• Do not re-disclose SHIN-NY data extracts to external parties (including vendors) without explicit authorization, appropriate agreements, and documented consent where required.
• For research or quality reporting, ensure protocol approvals and consent align with Statewide Common Participation Agreement and Qualified Entity Policies.

De-identified and Aggregate Use

• When feasible, use de-identified or aggregated data; document the method and ensure no re-identification risk.
• Prohibit attempts to re-identify de-identified data unless lawfully permitted and documented.

Patient Consent Management Processes

Patient Consent Management is central to SHIN-NY participation. Your workflows must capture, verify, and honor patient preferences before accessing or sharing data via extracts.

Capture and Verification

• Collect affirmative consent (written or electronic as allowed), present clear purpose information, and retain proof.
• Record consent status in both your EHR and the QE; verify current status before generating or using extracts.

Revocation and Exceptions

• Offer simple revocation; promptly update systems and cease reliance on prior consent.
• Use emergency access only as permitted, with strict audit logging and post-event review.

Special Situations

• Handle minors, proxies, and sensitive services according to SHIN-NY Privacy and Security Policies and your QE’s guidance.
• When consent is denied, block extract creation or scrub restricted data elements before use.

Data Security Measures Implementation

Protecting SHIN-NY data extracts requires layered technical and administrative safeguards aligned with User Authentication Standards and industry best practices.

Access Controls and User Authentication Standards

• Enforce unique user IDs, least privilege, and multi-factor authentication for systems that store or process extracts.
• Use session timeouts, IP/location controls where appropriate, and rapid offboarding for role changes or departures.

Encryption and Key Management

• Encrypt data in transit and at rest; protect keys with strong separation of duties and rotation schedules.
• Use secure transfer for extracts (e.g., managed SFTP or API channels) and avoid unencrypted email or removable media.

Endpoint and Network Safeguards

• Harden endpoints with EDR/anti-malware, patching, and disk encryption; restrict local downloads unless required.
• Segment networks, apply firewalls, and monitor for data exfiltration with DLP tooling where feasible.

Secure Extract Handling

• Adopt standardized file naming, sensitivity labels, and storage locations with strict access lists.
• Define retention periods; automate deletion and maintain destruction logs for Audit Trail Compliance.

Vendor and Cloud Management

• Execute Business Associate Agreements, perform security assessments, and ensure subcontractor oversight.
• Validate that cloud storage and analytics platforms meet your security baseline before hosting extracts.

Workforce Training and Governance

• Conduct initial and annual privacy/security training, including real-world scenarios for extract misuse.
• Run periodic risk analyses and document remediation tied to SHIN-NY Privacy and Security Policies.

Audit and Breach Notification Procedures

Robust logging and disciplined incident response prove that you respect SHIN-NY requirements and can meet Data Breach Notification Requirements if something goes wrong.

Audit Trail Compliance

• Log user, timestamp, patient, action (view, export, modify), source system, and success/failure for extract events.
• Retain logs per policy, reconcile them against extract inventories, and review high-risk access routinely.

Monitoring and Reporting

• Alert on unusual query volumes, after-hours extract activity, or access outside assigned patient panels.
• Perform scheduled audits, document findings, and report significant issues to your QE as required.

Data Breach Notification Requirements

• Follow HIPAA and applicable New York requirements for timing and content of notices to patients and regulators.
• Coordinate with your QE immediately upon suspected exposure of SHIN-NY data extracts and preserve evidence.

Post‑Incident Remediation

• Complete a documented risk assessment, close control gaps, retrain staff, and update procedures for lasting fixes.
• Validate improvements with targeted audits and share lessons learned with leadership and the QE.

Conclusion

Align your policies with the Statewide Common Participation Agreement, your QE’s rules, and SHIN-NY Privacy and Security Policies. Protect every extract with strong authentication, encryption, least privilege, and comprehensive auditing to sustain trust and compliance.

FAQs.

What is the deadline for signing the Statewide Common Participation Agreement?

There is no single statewide date for every organization. You must execute the current Statewide Common Participation Agreement before gaining SHIN-NY access, and you must adopt updated versions by the effective dates communicated by your Qualified Entity. Treat QE notices as binding timelines and complete any required attestations or training by the stated deadlines.

How must independent practices manage patient consent within SHIN-NY?

Capture affirmative consent using approved forms or electronic workflows, record the status with your QE and in your EHR, and verify consent before viewing or exporting patient data. Honor revocations immediately, use emergency access only when permitted and fully audited, and apply extra precautions for minors, proxies, and sensitive services in line with SHIN-NY Privacy and Security Policies and Qualified Entity Policies.

What security measures are required to protect SHIN-NY data extracts?

Enforce User Authentication Standards (unique IDs, least privilege, MFA), encrypt data in transit and at rest, control endpoints and networks, and store extracts only in approved, access-controlled locations. Use standardized retention and destruction, maintain detailed audit trails, oversee vendors via BAAs and assessments, and train staff regularly to prevent misuse or unauthorized disclosure.