sensitive data survey

At HealtheConnections, almost all data can only be accessed when there is a written Yes consent for the organization accessing the data. However, there are some HIE services (alerting and public health access) that allow access without a written Yes consent. In these situations, we need to ensure that we can identify sensitive data (42 C.F.R. Part 2, OMH, OPWDD), since sensitive data may need to be excluded when access is made without a written Yes consent. Please fill out the below information and if you have selected “All” or “Some” to any of the below options, our team will be reaching out to ensure we are correctly identifying your data.

Substance Use Disorder (Part 2) Data

Federal confidentiality laws, specifically 42 C.F.R. Part 2, protect the confidentiality of certain patient records relating to alcohol and drug use that are maintained by a “Covered Program” as defined in 42 C.F.R. Part 2. A "Covered Program" is one that both:

1) holds itself out (e.g., advertises) as a provider of Substance Use Disorder (SUD) treatment or services and

2) is federally assisted. “Federally assisted” includes any provider/organization that is described by at least one of the following:

  1. is a nonprofit
  2. receives federal funding
  3. is registered to dispense controlled substances related to treatment of SUDs

To ensure compliance with patient confidentiality laws, Participant Data Providers that have a Covered Program must inform HealtheConnections if any data from a Covered Program is transmitted to HealtheConnections.


Please select the statement which correctly describes Participant Data Provider with respect to being a Covered Program, as defined by 42 C.F.R Part 2:

ALL - The entire Participant has an Operating Certificate issued by NYS OASAS and/or Participant is a Covered Program.
SOME - Participant is a General Medical facility or a mixed-use facility but has one or more departments, sites, or providers that is/are Covered Program(s).
N/A - No part of Participant nor any of its providers is a Covered Program.

If you answered “Some”, please indicate which department(s), site(s), or provider(s) is/are Covered Part 2 Program(s):

Mental Health (OMH) Data

New York State Mental Hygiene Laws, specifically MHY Section 33.13, protect the confidentiality of certain patient records that are maintained by a licensed OMH facility. To ensure compliance with patient confidentiality laws, Participant Data Providers that have a licensed OMH facility must inform HealtheConnections if any data from a licensed OMH facility is transmitted to HealtheConnections.


Please select the statement which correctly describes Participant Data Provider with respect to OMH data:

ALL - The entire Participant is a licensed OMH facility.
SOME- Participant is a General Medical facility or a mixed-use facility but has at least one department or site that is a licensed OMH facility.
N/A - No part of Participant is a licensed OMH facility.

If you answered “Some”, please indicate which department(s), site(s), or provider(s) is/are Covered OMH Program(s):

Office for People with Developmental Disabilities (OPWDD) Data

New York State Mental Hygiene Laws, specifically MHY Section 33.13, protect the confidentiality of certain patient records that are maintained by a licensed OPWDD facility. To ensure compliance with patient confidentiality laws, Participant Data Providers that have a licensed OPWDD facility must inform HealtheConnections if any data from a licensed OPWDD facility is transmitted to HealtheConnections.


Please select the statement which correctly describes Participant Data Provider with respect to OPWDD data:

ALL - The entire Participant is a licensed OPWDD facility.
SOME - Participant is a General Medical facility or a mixed-use facility but has at least one department or site that is a licensed OPWDD facility.
N/A - No part of Participant is a licensed OPWDD facility.

If you answered “Some”, please indicate which department(s), site(s), or provider(s) is/are Covered OPWDD Program(s):


Participant Information

The Participant acknowledges that any data uploaded to HealtheConnections by Participant may be disclosed by HealtheConnections as allowed by its Policies and Procedures and the Business Associates Agreement between Participant and HealtheConnections. Participant Data Provider is responsible for identifying any sensitive data that may not be re-disclosed by HealtheConnections based on the HealtheConnections Policies and Procedures and applicable law, including, but not limited to, the Health Insurance Portability and Accountability Act, NYS Mental Hygiene law, and 42 CFR Part 2, as amended and modified.

Participant is responsible for notifying HealtheConnections, in a timely manner, of any changes in its operations that would change its selected statement above.

Participating Organization:

Completed By:

Title:

E-Mail: