Every New York home health agency participating in SHIN-NY does so through one of four Regional Health Information Organizations. Which RHIO your agency works with depends on your geographic location — and that matters for compliance, because each RHIO has its own documentation formats, renewal processes, timeline requirements, and technical assistance offerings.
Understanding the RHIO-specific requirements for your organization — rather than treating SHIN-NY as a uniform statewide standard — is the difference between a smooth compliance process and a frustrating one.
This guide compares the four RHIOs on the dimensions that matter most for home health agency compliance officers: geographic coverage, CSPP documentation format, SCPA renewal timeline, incident notification process, and available support resources.
The Four New York RHIOs: Geographic Coverage
Hixny (Health Information Xchange of New York)
Serves the Capital Region, Hudson Valley, and parts of the Southern Tier. Coverage area includes Albany, Schenectady, Troy, Saratoga Springs, Poughkeepsie, Kingston, and surrounding counties. Home health agencies in these counties participate in SHIN-NY through Hixny.
Rochester RHIO
Serves the Greater Rochester region, including Monroe, Livingston, Ontario, Seneca, Wayne, and Yates counties. One of the oldest and most established RHIOs in the state, with a strong focus on care coordination across the regional health system.
HealtheConnections
Serves Central New York and surrounding areas, including Onondaga, Oswego, Madison, Cayuga, and Cortland counties, as well as portions of the Southern Tier. Syracuse-based agencies participate through HealtheConnections.
Healthix
The largest RHIO by patient population, serving New York City's five boroughs, Long Island, and the Hudson Valley south of the Capital Region. Home health agencies serving patients in the five boroughs, Nassau, Suffolk, Westchester, Rockland, Putnam, and Orange counties participate through Healthix.
CSPP Documentation: What Each RHIO Requires
All four RHIOs require a Cybersecurity Policies and Procedures Program document as a condition of SHIN-NY participation. The substantive requirements are consistent — they align with HIPAA Security Rule standards across all four RHIOs. The differences are in format, submission process, and review intensity.
Hixny: Requires submission of the CSPP document as part of onboarding and annual renewal. Provides a template framework that new participants can use as a starting point. Renewal process involves a self-attestation form confirming the CSPP remains current, supplemented by the updated CSPP document for organizations that have experienced significant changes.
Rochester RHIO: Has one of the most detailed CSPP review processes among the four RHIOs, reflecting its emphasis on clinical data quality and participant accountability. The CSPP must address specific Rochester RHIO technical integration requirements in addition to the standard SHIN-NY content areas. New participants should budget additional time for the initial CSPP review.
HealtheConnections: Provides a structured CSPP template that participants can complete and submit. The template is regularly updated to reflect current HIPAA and SHIN-NY requirements. HealtheConnections offers technical assistance sessions for organizations that need support completing the CSPP — a resource that smaller home health agencies should take advantage of.
Healthix: As the RHIO serving the highest-volume, highest-complexity market (NYC and Long Island), Healthix has developed robust compliance documentation and review processes. The CSPP submission includes specific sections addressing the multi-site and multi-provider complexity typical of the NYC home health market. Healthix has a dedicated compliance team that reviews CSPPs for completeness and technical adequacy.
SCPA Renewal: Timelines and Processes
Annual renewal is required by all four RHIOs. The Security Compliance Plan and Agreement must be renewed with an updated attestation each year. However, the specific timing and process differ:
Hixny: Renewal cycle tied to the anniversary of initial SCPA execution. Organizations receive renewal notices approximately 60 days before expiration. The renewal requires executive signature on an updated attestation form and confirmation that the CSPP remains current.