Is Healthix Safe?

If you use or plan to use Healthix, you need to know: Is Healthix safe? 

Below, we explain whether Healthix is: 

• Safe to use. 
• Good for privacy. 

We also look at some steps you can take to improve both your safety and privacy when using this online service. 

What Is Healthix?

Healthix is a not-for-profit health information exchange (HIE) organization that operates in the state of New York, serving healthcare providers and patients by facilitating the secure exchange of medical information. 

It is funded by the NYS Department of Health. 

It lets hospitals, doctors, etc., share patient health information and medical records (lab results, medications, allergies, etc.) in real-time and brings together patient data from many places, such as hospitals, clinics, nursing homes, and even insurers. 

Is Healthix Safe?

Depends on your definition of “safe.”

In its ‘Policies, Privacy, Security’ page, Healthix says it uses various technologies to protect its servers and data. It then lists the technologies it uses: firewalls, antivirus, multi-factor authentication, network intrusion prevention system, and managed security services provider. 

It also says it has a range of cybersecurity programs, including incident response, data protection, and identity access management. 

Plus, it conducts various annual audits to ensure the integrity of security, privacy, and compliance with the New York State and Healthix policies. Again, it lists the audits (e.g., Consent Audit, User Access Audit, etc.) along with the compliance rate. 

Healthix adheres to HIPAA and HITECH requirements and has HITRUST CSF Certification for information security. 

In its privacy policy, Healthix says that participants who suspect/know Protected Health Information was accessed unlawfully via Healthix must report this to Healthix “in the most expedient time possible and without unreasonable delay.” 

If Healthix determines that a breach occurred, it will take action, including notifying any participants whose PHI was breached. 

Healthix has not been associated with any data breaches at the time of writing.

Is Healthix Private?

Again, depends on your definition of “private.”

Patients don’t need to provide consent for healthcare providers to send their data to Healthix. 

This is because Healthix functions as a business associate of the providers listed in its Participant List. As a business associate, Healthix is authorized under HIPAA to collect, organize, and store patient data from its participant providers. This is permitted for purposes such as improving care coordination without requiring explicit patient consent. 

However, although Healthix can collect and hold data, it can’t share it with other providers or entities without the patient’s consent. 

Facilities participating in Healthix must display a patient notice informing patients that their Protected Health Information (PHI) is being uploaded into Healthix. The notice should also explain how you can choose to deny consent. 

Note: You can see if your healthcare facility participates in Healthix by visiting the ‘Healthix Participant List’ page. 

Only healthcare providers directly involved in a patient’s care can access your information. Data is only accessed without consent during emergencies, ensuring responsible usage.

If you give consent, providers may access sensitive medical data, e.g., information related to mental health, alcohol or drug abuse, HIV/AIDS, genetic disease or tests, family planning, and sexually transmitted diseases. 

Patients can request a report showing who has accessed their data through Healthix. The report covers data access activities within a specific time frame, up to six years from the date of the patient’s request. The report also includes a record of consent values, showing what permissions have been granted or denied by the patient to different healthcare providers or participants in Healthix.

In its ‘Policies, Privacy, Security’ page, Healthix says it follows the New York Department of Health Policies developed for Health Information Exchange providers and performs regular audits to monitor patient data access. 

In its robust privacy policy, Healthix outlines that it collects medical records, lab results, diagnoses, medications, and treatment plans as part of its functionality. The data is shared with third parties, but only those involved in your medical care.

Healthix’s privacy policy has not been reviewed by an external privacy review site such as Terms of Service; Didn’t Read at the time of writing.

How to Improve Your Safety and Privacy On Healthix

Follow the below steps for a safer and more private experience while using Healthix. 

• Opt out of Healthix. If you’re worried about your information being shared across healthcare providers, you can opt out of Healthix. If you opt out, your medical information will not be shared through the Healthix network, except potentially in emergencies.
• Understand your consent options. Familiarize yourself with Healthix’s consent process. When you visit a new healthcare provider, they may ask you to opt in or out of sharing data via Healthix. You can also decide to opt in for certain providers but opt out of others.
• Discuss data-sharing preferences with your healthcare providers. Talk to your healthcare providers about your privacy concerns and ask them how they use Healthix to share your data. This helps ensure that your healthcare providers know your preferences and may guide you through the consent process or inform you about any additional privacy measures they can take when handling your data.
• Ask about data access and audits. Ask Healthix or your healthcare provider about their auditing processes and who can access your data. You can inquire about how frequently access is monitored and what protections are in place to prevent unauthorized use. Understanding who has access to your data and how it is tracked can help you assess how secure your information is and whether appropriate safeguards are in place.
• Stay informed of policy changes. Keep track of any changes in Healthix’s privacy policies or terms of service. As privacy laws and policies evolve, staying informed ensures you understand how your data is being used and shared, allowing you to adjust your privacy settings if necessary.
• Ensure strong passwords and authentication. If you use any patient portals or online health records systems associated with Healthix, use strong, unique passwords and enable two-factor authentication if available.