HealtheConnections is the SHIN-NY RHIO serving Central New York — a region that includes Onondaga, Oswego, Madison, Cayuga, Cortland, Jefferson, Lewis, and surrounding counties. For home health agencies serving the Syracuse metropolitan area and surrounding Central New York communities, HealtheConnections manages CSPP review, SCPA execution, and ongoing compliance monitoring. Understanding the specific submission process, review timeline, and content expectations for HealtheConnections — which differ in several practical respects from the Healthix process for NYC and Long Island agencies — ensures that your renewal is completed without avoidable delays.
HealtheConnections CSPP Overview and Template Access
HealtheConnections provides a CSPP template to participating organisations upon request through the participant services portal. Unlike Healthix, which has a highly structured template with specific section sequences, the HealtheConnections template is more flexible — it provides content area headings and guidance notes but allows organisations to present their programme information in a format that reflects their actual operational structure. This flexibility can be either an advantage or a complication: agencies that write a clear, well-organised narrative submission find the HealtheConnections review process straightforward; agencies that interpret the flexibility as a license to submit a minimal document frequently receive requests for additional information.
Contact your HealtheConnections participant services representative to confirm the current template version before beginning your CSPP development or update. HealtheConnections makes technical assistance available to participating organisations during the CSPP development process — a resource that is underutilised by most home health agencies and that can significantly reduce the revision cycles required to reach approval.
Required Content Areas for HealtheConnections Submission
Organisational Security Programme Description
HealtheConnections requires a description of the organisation's overall information security programme — the governance structure (who is responsible for security oversight), the policy framework (what written policies govern ePHI handling), and the risk management approach (how the organisation identifies and addresses security risks). The Security Officer designation, the risk assessment process and most recent completion date, and the workforce training programme should all be addressed in this section.
Technical Controls Documentation
HealtheConnections' compliance team specifically examines: MFA status for accounts accessing SHIN-NY data (enforcement mechanism, not just availability); encryption at rest and in transit for SHIN-NY data; access controls including role-based access configuration and access review frequency; and incident detection and response capability. The 2026 HIPAA mandatory requirements — biannual vulnerability scanning and annual penetration testing — should be documented in this section even if the HealtheConnections template does not explicitly prompt for them, as the compliance team is aware of the 2026 update and expects to see it reflected.
Incident Response and RHIO Notification Procedures
Address the HealtheConnections-specific notification requirement explicitly: incidents involving SHIN-NY data should be reported to HealtheConnections within 72 hours of discovery. Include the HealtheConnections security incident contact information in this section — obtained from your participant services representative — and describe the content of the initial notification (nature of the incident, systems affected, initial assessment of SHIN-NY data involvement). This section should be written for the HealtheConnections audience specifically, not copied from a generic HIPAA incident response plan.
HealtheConnections Technical Assistance Resources
HealtheConnections offers technical assistance to participating organisations through its RHIO operations team. For home health agencies approaching CSPP development without a managed security provider, a preliminary review of a draft CSPP by HealtheConnections staff — available through the participant services portal — can identify content gaps before formal submission, reducing the revision cycle time. This pre-submission review service is voluntary but valuable for first-time submitters.
Protecting your New York home health agency does not have to be complicated. It has to be done — completely, correctly, and documented in a way that holds up when it matters. ShieldForce makes that possible for organisations without IT departments, without compliance staff, and without the budget of a hospital system. Start with a free assessment.
→ Schedule Your Free HIPAA Risk Assessment — shieldforce.io/hipaa-assessment
→ Explore SHIN-NY Compliance Solutions — shieldforce.io/shin-ny
→ View Transparent Pricing from $35/user/month — shieldforce.io/pricing-comparison