Healthix is the largest New York RHIO by patient population, serving New York City's five boroughs, Long Island, and portions of the Hudson Valley. The breadth and complexity of the markets it serves are reflected in its CSPP review process — which is the most comprehensive and detailed of the four New York RHIOs. Home health agencies that submit CSPPs to Healthix expecting the same review experience as smaller RHIOs typically encounter clarification requests, resubmission requirements, and extended timelines that they were not prepared for. The agencies that complete the Healthix CSPP process smoothly are the ones that understand what Healthix specifically requires — not just what a generic SHIN-NY CSPP should contain.
The Healthix CSPP Structure: What Makes It Different
The Healthix CSPP template is more prescriptive than the templates used by other New York RHIOs. Where some RHIOs accept a narrative security programme document that addresses the required content areas in the organisation's own format, Healthix expects submissions that follow its template structure closely, with each section addressing specific questions in a specific sequence. Deviating significantly from the template structure — even with a substantively complete and accurate programme description — results in clarification requests that delay approval.
Obtain the current Healthix CSPP template directly from your Healthix participant services contact before beginning your CSPP development or update. The template is updated periodically, and using an older version of the template creates avoidable revision requirements. Confirm the current version date when you receive the template.
Required Content Areas: Section by Section
Section 1: Organisational Information and Security Programme Overview
This section requires the organisation's legal name (as registered with Healthix), the primary contact for CSPP-related correspondence (with direct phone and email), the HIPAA Security Officer name and title, and a brief description of the organisation's security programme framework — referencing the NIST CSF, the HIPAA Security Rule, or another recognised framework as the foundation. The Security Officer information must match the designation documentation in the HIPAA compliance programme.
Section 2: Risk Assessment and Management
Describe the organisation's risk assessment process: the frequency of risk assessments (annually plus when significant operational changes occur), the methodology used (referencing the HIPAA Security Rule risk analysis requirements), and the process for implementing risk management measures based on assessment findings. Include the date of the most recent risk assessment. Healthix reviewers check that the risk assessment date falls within the past 12 months — a risk assessment dated more than 12 months ago at the time of submission will generate a clarification request.
Section 3: Access Controls and Authentication
This is the section most commonly requiring revision at Healthix. The required content: description of how user access to SHIN-NY data is provisioned (role-based, documented by named roles); confirmation that MFA is enforced (describing the enforcement mechanism — conditional access policy, application-level enforcement, or equivalent); description of the access review process (frequency, documentation format, responsible party); and the process for terminating access when staff leave or change roles. "MFA is available to staff" does not satisfy this section. "MFA is enforced through Microsoft Conditional Access Policy for all accounts accessing SHIN-NY data, with no exceptions permitted" does.