New York's Value-Based Payment transformation is reshaping how home health agencies are compensated — moving from a pure fee-for-service model toward outcome-based arrangements that reward agencies for keeping patients healthy, managing chronic conditions effectively, and reducing unnecessary hospital utilisation. The data infrastructure through which much of this value measurement and care coordination occurs is SHIN-NY. The security posture required to participate meaningfully in VBP arrangements is, consequently, inseparable from the security posture required for strong SHIN-NY compliance.
Home health agencies that view their SHIN-NY security programme as a compliance obligation separate from their VBP strategy are missing a strategic connection that their more sophisticated competitors have already made. SHIN-NY compliance is not just about RHIO access — it is about the data exchange capability that VBP success depends on.
How VBP and SHIN-NY Are Structurally Connected
New York's VBP arrangements between home health agencies and their health system and MCO partners depend on data sharing that flows through the SHIN-NY infrastructure in several ways. Performance measurement for VBP quality metrics requires access to claims and encounter data that is enriched by clinical information available through SHIN-NY queries — medication reconciliation data, prior utilisation patterns, and care transition documentation. Care management for VBP risk pools depends on identifying high-risk patients through the clinical alerts and utilisation pattern data that SHIN-NY provides. Attribution and patient assignment for VBP models requires data matching between health system and home health patient populations — a matching process that health system partners increasingly conduct through SHIN-NY connectivity.
An agency that loses SHIN-NY access due to security compliance failure is not just losing HIE capability — it is losing the data infrastructure that supports its VBP performance measurement and care management capabilities. For agencies in VBP arrangements, SHIN-NY suspension is a VBP performance risk, not just a compliance finding.
How SHIN-NY Security Compliance Appears in VBP Contracting
Medicare Advantage plans and Managed Medicaid plans administering VBP arrangements in New York are increasingly including data security and HIE participation questions in their preferred provider and network credentialing processes. The questions are not always specifically about SHIN-NY — they may be framed as general data security assessments or health information exchange participation confirmations — but the underlying question is whether the home health agency has the security infrastructure to participate safely in the data sharing that VBP requires.
A home health agency with a current, RHIO-approved SHIN-NY CSPP has a concrete, third-party-reviewed security credential that directly answers these VBP credentialing questions. The CSPP approval letter from the RHIO is evidence that a third party has reviewed the agency's security programme and found it adequate for health information exchange participation — which is precisely what the VBP credentialing team is asking for.
Positioning Your Agency as a Preferred VBP Partner Through Security
The agencies I see winning the most favourable VBP arrangements with New York health systems and MCOs are consistently the ones that can demonstrate three security capabilities simultaneously: a compliant HIPAA Security Rule programme (documented risk analysis, implemented 2026 mandatory controls); active SHIN-NY participation with a current CSPP (evidencing RHIO-reviewed security for data exchange); and a data security representation in their VBP contract that reflects the documented programme. This three-part demonstration is what separates agencies that are treated as preferred data partners from agencies that are tolerated as service providers.
Protecting your New York home health agency is not optional — and it does not have to be overwhelming. ShieldForce delivers everything described in this article as a fully managed service, starting at $35/user/month. No IT department needed. BAA signed on day one. Core controls live within 72 hours. Start with a free assessment and see exactly where you stand.
→ Schedule Your Free HIPAA Risk Assessment — shieldforce.io/hipaa-assessment
→ Schedule a Free SHIN-NY Consultation — shieldforce.io/schedule-demo
→ View Transparent Pricing from $35/user/month — shieldforce.io/pricing-comparison