Statewide Common Participation Agreement (SCPA)

The Statewide Common Participation Agreement (SCPA) is the contract that will govern the relationship between the Health Information Networks (HINs) that comprise the Statewide Health Information Network for New York (SHIN-NY) and the individuals and organizations that participate in the SHIN-NY (SHIN-NY participants). All SHIN-NY participants are required to execute the SCPA pursuant to the regulations governing the SHIN-NY (10 NYCRR Part 300), which the Department amended in July 2024.

The SCPA is intended to make participation in the SHIN-NY more valuable and efficient, and will allow the SHIN-NY to adapt to change and advances in health information exchange and to offer participants meaningful choices in how and where they receive SHIN-NY services. Key benefits of SHIN-NY participation under the SCPA include:

• The ability to develop consistent SHIN-NY standards for interoperability with input from participants that allow the SHIN-NY to adapt to current technology and best practices.
• Consistency in how health information may be shared and used, which will also allow the SHIN-NY to build a structure for more efficient and transparent data governance across the SHIN-NY.
• Consistency in services provided to participants and, where participants aren’t satisfied with the services they’re receiving, real choices about how and where to get their services.
• Flexibility in how participants connect and contribute data to the SHIN-NY with the evolution and advancement of new technology in health information exchange and national networks. Where the SHIN-NY might be able to rely on those national networks for data exchange in the future, it will be a more effective and valuable resource to the New York healthcare ecosystem.
• The ability to develop consistent SHIN-NY standards for interoperability with input from participants that allow the SHIN-NY to adapt to current technology and best practices.

Under 10 N.Y.C.R.R. § 300.6(a), certain organizations – called “Regulated Participants” in the SCPA – must connect to the SHIN-NY and therefore must sign the SCPA. These organizations are health care facilities as defined in section 18(c)(1) of the Public Health Law, which consist of:

1. Hospitals subject to Public Health Law Article 28;
2. Clinics (including diagnostic and treatment centers) subject to Public Health Law Article 28;
3. Home Care Services Agencies subject to Public Health Law Article 36;
4. Hospices subject to Public Health Law Article 40;
5. HMOs subject to Public Health Law Article 44;
6. Shared Health Facilities subject to Public Health Law Article 47; and
7. Nursing Homes subject to Public Health Law Article 28 – Note: Nursing homes are listed as a voluntary participant in Exhibit A, Form Election Schedule of the SCPA. This is an error; Nursing homes are regulated participants and should select this category. Nursing homes that have selected the voluntary participant category will be counted as a regulated participant.

A regulated participant does NOT include independent provider/physician practices. Organizations that are not required to connect to the SHIN-NY – called “Voluntary Participants” in the SCPA – must still sign the SCPA if they wish to participate in the SHIN-NY.

Generally, no, although the timeframe for the termination of existing participation agreements will vary for Regulated Participants and Voluntary Participants, as described in FAQ 5.

Prior to their amendment in July 2024, the SHIN-NY Regulations required that QEs maintain participation agreements with their participants. The amended SHIN-NY Regulations now require SHIN-NY participants to sign the SCPA in order for them to participate in the SHIN-NY. The SCPA is intended to be the sole agreement that governs the provision of Required Participant Services to SHIN-NY Participants.

The SHIN-NY cannot function efficiently and effectively if the parties have two separate agreements governing the same subject, since that will lead to confusion as to what rules govern the exchange of data—the very problem that the SCPA is seeking to solve. Moreover, it is commonplace when parties sign an agreement that the agreement replaces prior agreements of the same subject matter.

Importantly, the SCPA does not prevent the parties from retaining (or entering into) agreements that address a different subject matter, such as agreements that exclusively govern the provision of Value-Added Services (so long as applicable requirements under the SCPA are met).

All Regulated Participants must sign the new SCPA on or before September 30, 2025. On October 1, 2025, the SCPA will go into effect for Regulated Participants, and their existing participation agreements will terminate.

Voluntary Participants will have an extended timeline in which to transition to the SCPA. During this transition, Voluntary Participants may continue to participate in the SHIN-NY under the terms of their existing participation agreements with QEs. In this case, data contributions to the Statewide Data Infrastructure (SDI) and the use of such data for approved purposes will continue under the Data Use and Contribution Agreement between each QE and NYeC.

Alternatively, some QEs may amend their existing participation agreement to enable Voluntary Participants to participate in and contribute data to the SHIN-NY on substantially the same terms and conditions as the SCPA, while giving them additional time to execute the SCPA.

To help Voluntary Participants transition to the SCPA, some QEs may amend their existing participation agreement to enable Voluntary Participants to participate in and contribute data to the SHIN-NY on substantially the same terms and conditions as the SCPA, while giving them additional time to execute the SCPA. Please contact your QE for additional information.

SOPs that have been finalized to date include those listed on this website. NYeC is working with stakeholders to release additional draft SOPs prior to the time the SCPA will be available for signature. In addition, NYeC has established the Statewide Data Use Committee (“SDUC”) and Technical Advisory Committee (“TAC”) and will recommend that they consider adding provisions related to Audits and Permitted Purposes to existing SOPs.

However, some SOPs may not be finalized prior to the date on which the SCPA is released for signature and new SOPs may be created after that date. The SOPs are designed to be modified over time, so even if all SOPs were released by October 1, they could change or additional SOPs could be adopted at a later date.

Participants and HINs should remember that all SOPs are subject to the statewide collaboration process, meaning that Participants and HINs can play an active role in their development. To the extent Participants or HINs have concerns about what is included (or not included) in a particular SOP, they can voice such concerns through the statewide collaboration process, which may result in those SOPs being modified to address such concerns.

Example Language:
PARTICIPANT TO CHECK ONE:
(1) Participant is executing this SCPA and does not currently have a Designated HIN under a separate Election Form or filling such substantially similar roles under a Prior Agreement.
(2) Participant is executing this SCPA, at least in part, to effectuate its switch from its current Designated HIN to the Designated HIN set forth in fields (2) or (3) below, as applicable.

Answer: All participants signing the SCPA for the first time should select option (1). In the future, if a participant decides to switch its current Designated HIN, the second choice would be used.

The data tagging language in the SCPA is not intended to change current requirements. Rather, the intention is to make clear that Participants must provide notice to the Designated HIN that the data are subject to these additional requirements.

For example, a Part 2 program must notify the Designated HIN that the data being disclosed are subject to 42 C.F.R. Part 2. This type of notification is required under applicable law. Part 2 programs must notify their recipients that the data that is being provided is subject to 42 C.F.R. Part 2. Similarly, Section 33.13 of the Mental Hygiene Law imposes more restrictive consent requirements that apply to most other forms of protected health information. HINs cannot abide by these laws without knowing what data is subject to these laws.

The SCPA does not facilitate the disclosure of reproductive health or immigration status to out-of-state public health agencies. In fact, the SCPA limits such disclosures in a manner that existing participation agreements do not. Section 9.3 limits disclosures to parties seeking to conduct a criminal, civil, or administrative investigation into any person who is the subject of SHIN-NY data, among other protections. While this provision was modeled on the HIPAA reproductive health rule, it is not dependent on such rule, so that it remains in effect even though a court has struck down such rule. Further, using SHIN-NY data to investigate the subject of data is not a “permitted purpose” under the SCPA.

References in the SCPA to “SHIN-NY participants located both within and outside New York State” and “Government Participants” simply reflect the status quo that some of those entities qualify as “SHIN-NY participants.” Prior to the SCPA, government entities have been able to participate in the SHIN-NY through a QE by signing a QE Participation Agreement and complying with the same general rules that apply to other participants (with exceptions, see below).

Under the SCPA, those entities can continue to participate in the SHIN-NY under the same general rules that apply to other participants (except for provisions relating to issues like insurance and indemnification, to which government agencies can generally not agree). But the fact that some out-of-state public health agencies can become SHIN-NY participants does not mean that all of them can, nor does it mean that such agencies can use data for any purpose. Section 3.5(c) affirms that a Selected HIN has the right to decline to accept an applicant’s election for cause. If a HIN has reason to believe that an out-of-state public health agency that is seeking to become a SHIN-NY participant is seeking access for purposes that are not in the best interest of New York State patients or other SHIN-participants, such HIN can reject the request to become a SHIN-NY participant.

Finally, to the extent there are still concerns about potential disclosures to out-of-state public health agencies, the SOPs can be modified to further limit such disclosures.

Yes, a participant can select none, one, or more than one additional HIN or VAS HIN.

No, the SCPA does not require that regulated facilities connect to more than one QE.

Yes, participants can connect to more than one QE if they wish to do so but can select only one “Designated HIN” under the SCPA. The Designated HIN is the HIN to which the participant will connect for the purpose of receiving free “required participant services” and making required data contributions. A
system may designate one or more additional QEs as “Additional HINs” and/or “Value Added Services HINs.” An Additional HIN can also provide required participant services if selected but may charge fees in that case.

Yes, participants can designate one or more QEs to which they are not currently connected.

Full adoption of the SCPA statewide is an important foundational step in getting the SHIN-NY to a point of “statewideness.” This means that, right now, a
participant may still find a need to connect to more than one QE to receive the full scope of data needed. However, once the SCPA and the regulatory reforms are fully implemented, statewide records will be more accessible to each QE and thus to participants.

Neither the BAA nor the SCPA require that QEs respond to subpoenas served to QEs. Rather, the BAA and the SCPA both impose restrictions intended to minimize any data being shared in the event a QE is legally mandated to respond to a subpoena. The BAA says that if a QE is “required by law” to disclose data, it still must obtain reasonable assurances from the data recipient that the data will be protected, among other restrictions. Similarly, Section 13.4 of the SCPA permits a QE to disclose confidential information in response to a subpoena only to the extent applicable law requires disclosure, among other protections. Further, Section 9.3 of the SCPA imposes additional restrictions in the event a subpoena relates to a criminal, civil, or administrative investigation of any person who is the subject of SHIN-NY data.

To the extent a QE has generally taken the position that it is not required to respond to subpoenas and that any responsibility to do so rests with its participants, who are the data suppliers, the SCPA is saying only that if such a QE did receive a valid subpoena to which it was required to respond, then it could only disclose that which is affirmatively required by applicable law. QEs retain the ability to contest subpoenas on the basis that they have no obligation under the law to respond to them.

16A. QEs are Business Associates of their Participants and should be prohibited from responding to subpoenas unless specifically directed to do so by a Participant. Neither the BAA nor the SCPA prohibit a QE from consulting with and handling subpoenas in accordance with direction from the QE’s Covered Entity Participants. The SCPA is saying only that if a QE does receive a valid subpoena to which it is required to respond, then it could only disclose that which is affirmatively required by applicable law. QEs retain the ability to contest subpoenas on any appropriate grounds, including that they are prohibited by their Covered Entity Participant(s) from doing so and/or have no obligation under the law to respond to them.

Section 3.4 does provide that, upon execution of the SCPA, any Prior Agreement between Participant and any HIN is terminated and replaced as of the SCPA Effective Date (with exceptions). However, Section 16.1(c) includes provisions that permit participants to negotiate with their Designated HIN for the inclusion of certain business terms in the SCPA (see next FAQ), which may include business terms that were included in a Prior Agreement.

It is important to note that the SCPA does not prevent the parties from retaining (or entering into) agreements that address a different subject matter, such as agreements that exclusively govern the provision of Value-Added Services (so long as applicable requirements under the SCPA are met).

Yes. NYeC agrees that the parties to the SCPA should be able to agree to alternative terms relating to indemnification, liability, and insurance. Therefore, Section 16(c) of the SCPA includes provisions that the parties may mutually agree to an alternative to the default terms, provided that the modification does not modify the rights or obligations of any other HIN that has not agreed to such modification. The SCPA provisions for which the parties may agree to an alternative to the default terms are:

• Section 7.11 – Disclaimer of Warranties: The parties may modify or replace any term or provision of this Section, or this Section in its entirety, provided that no such amendment shall affect the rights of any other HIN except as agreed to in writing by such other HIN.
• Section 14 – Dispute Resolution: The parties may set forth terms to submit a Dispute to any alternative mechanism of dispute resolution in place of or in addition to one or more of the mechanisms specified in Section 14.1 (Information Dispute Resolution) and Section 14.2 (Mediation).
• Section 15.1 – Indemnification by HINs of Participant: The parties may modify or replace any term or provision of this Section, or this Section in its entirety, provided that no such amendment shall affect the rights of any other HIN except as agreed to in writing by such other HIN.
• Section 15.2 – Indemnification by Participant of HINs: The parties may modify or replace any term or provision of this Section, or this Section in its entirety, provided that no such amendment shall affect the rights of any other HIN except as agreed to in writing by such other HIN.
• Section 15.3 – Indemnification Procedure: The parties may modify or replace any term or provision of this Section, or this Section in its entirety, provided that no such amendment shall affect the rights of any other HIN except as agreed to in writing by such other HIN.
• Section 15.4 – Limitation of Liability: The parties may modify or replace any term or provision of this Section, or this Section in its entirety, provided that no such amendment shall affect the rights of any other HIN except as agreed to in writing by such other HIN.
• Section 15.5 – Sole Recourse: The parties may modify or replace any term or provision of this Section, or this Section in its entirety, provided that no such amendment shall affect the rights of any other HIN except as agreed to in writing by such other HIN.
• Section 15.8 – Insurance: The parties may modify this Section to set forth insurance policy limits for any coverage type set forth therein, with respect to an HIN, in amounts exceeding the minimum amounts set forth therein, and with respect to Participant, in any particular amount specified by the parties.
• Section 16.11 – Government Participants: The parties may modify this Section to set forth a specific exclusive venue for any legal action, suit or proceeding.
• SCPA BAA: The parties may modify the SCPA BAA with respect to any terms relating to:
  1. Additional Safeguards with which an HIN must comply, including those required under 10 N.Y.C.R.R. § 405.46, and any representations and warranties that an HIN or Participant must make with respect to such Safeguards.
  2. The time period by which an HIN must report any Data Breaches or Security Incidents to Participant.
  3. The information that an HIN must report to Participant with respect to any Data Breaches or Security Incidents.

The terms of any modification pursuant to Section 16.1(c) may not conflict with the terms of the SCPA and to the extent any term of such a modification conflicts with any term of the SCPA, such term of the modification shall be null and void and severable from the rest of the modification and the SCPA.

Each HIN and Participant are required to promptly produce a copy of any modifications made pursuant to Section 16.1(c) upon NYeC’s request. In the event that such HIN and Participant have agreed to terms in any such modification that do not comply with the requirements of Section 16.1(c), NYeC has the right to pursue any applicable remedy available to it under QEPA and/or the Funding Agreement.

18A. What is the process for negotiating and executing alternative SCPA terms where permissible? NYeC has issued an HIN-Specific Modifications Addendum Template [PDF] and related SOP outlining the process for negotiating and executing an HINSpecific Modifications Addendum to the SCPA.

18B. My organization wants to include specific provisions in our SCPA BAA to protect our PHI (e.g., “offshoring provisions,” required attestation methods to provide sufficient assurance of security and privacy controls [e.g., security questionnaire; SOC2 Type 2 report; certifications (ISO, HITRUST)]). Is this allowable? Yes. Under Section 16.1(c) of the SCPA, the parties can modify the SCPA BAA to add terms related to additional Safeguards with which an HIN must comply and any representations and warranties that an HIN or Participant must make with respect to such Safeguards. The SCPA defines “Safeguards” as administrative, technical, and physical safeguards implemented to govern and protect the security of hardware, software, systems (including, as applicable, the SHIN-NY Platforms), and users of the foregoing, and the privacy and security of the data contained therein.

Yes. The references to Section 16.1(b) (Amendments to Appendix A of the BAA) in Sections 16(d) and 16(e) of the SCPA are intended to refer to and should be read as Section 16(c) (HIN-Specific Modifications).

The SCPA currently does not allow such a modification. However, the Parties can ensure the insurance coverage is protected by another means.

By including Section 15.6(c) in the SCPA, NYeC recognized that the type of assignment contemplated in Section 15.6(b) would not always be permitted by participants’ insurance policies. Therefore, in the event a participant concludes that the assignment of insurance proceeds would jeopardize insurance coverage, the participant should send a letter to all HINs representing that this is the case and that Section 15.6(b) is inapplicable to the participant. This will ensure that the requirements in Section 15.6(b) will not apply to such participant. NYeC will include this issue for consideration for future proposed amendments to SCPA.

NYeC recognizes the concerns raised and will propose SOPs and future amendments to the SCPA through the Statewide Collaboration Process to further address this issue.

Section 15.8(e) requires that copies of insurance binders and policies be provided by participants upon request of the Selected HIN. Likewise, Section 15.8(d) requires that, upon request by a participant, each HIN must provide copies of insurance binders and policies. Disclosure of confidential information under the SCPA is governed by the confidentiality provisions of Section 13 of the SCPA.

The purpose of these requirements is to ensure that participants and HINs can provide evidence that their insurance coverage is maintained as required by the SCPA. NYeC recognizes that it may be necessary to redact portions of insurance binders and policies that are not directly relevant to the requesting party’s ability to determine whether the policies maintain coverage required by the SCPA.

For example, it is typical practice to redact portions of cyber liability policies prior to disclosure to protect highly sensitive information that would expose aspects of an organization’s internal security controls or vulnerabilities. Disclosure of such binders and policies, if requested, should ensure that the requester has sufficient information to evidence that the coverage required by the SCPA is maintained.

NYeC recognizes the concerns raised and will propose SOPs and future amendments to the SCPA through the Statewide Collaboration Process to further address this issue.

The SCPA currently does not allow such a modification. However, it is unlikely that a participant will need to rely on an HIN to meet regulatory requirements to provide patients with access to designated record sets since HINs generally only have copies of data that participants already have in their own systems. That is, if a patient asks a participant for access to the patient’s records, the participant will likely be able to fulfill its regulatory obligations without receiving any data from the HIN.

In the event that the participant does need to rely on the HIN to meet regulatory requirements to provide patients with access to designated record sets, nothing requires the HIN to wait until the 7th day to provide such records to the participant. Participants are free to communicate to HINs that they need access to data as soon as possible, and HINs should endeavor to comply with such requests.

Under Section 16.1(c)(v) of the SCPA, the parties can modify the SCPA BAA with respect to various terms, including Safeguards with which an HIN must comply and any representations and warranties that an HIN or Participant must make with respect to such Safeguards (see FAQ 18B for the SCPA’s definition of “Safeguards”). Requiring the HIN to follow certain processes with respect to how it de-identifies data would qualify as a Safeguard.

While prohibiting the use of de-identified data for commercial purposes may not qualify as a “Safeguard,” Section 1.6 of the Privacy and Security Policies and Procedures for Qualified Entities and their Participants (one of the SOPs) already limits the disclosure of de-identified data by QEs (soon to be updated to include HINs).

Consistent with the SHIN-NY SOPs, HINs may disclose de-identified data without affirmative consent if the HIN enters into a data use agreement with the recipient in accordance with the SHIN-NY SOPs, unless the QE determines that:

• (a) such de-identified data is to be used to assist in marketing activities that would not comply with the HIPAA Privacy Rule, or
• (b) the proposed use of the de-identified data is not in keeping with the mission of the SHIN-NY as described in 10 N.Y.C.R.R. § 300.1.

Such mission allows for the use of data “to improve the quality, coordination and efficiency of patient care, reduce medical errors and carry out public health and health oversight activities, while protecting patient privacy and ensuring data security.” The de-identification of data, including by a HIN for its own use, solely for commercial purposes (e.g., selling that de-identified data to a third party for profit) is not consistent with the SHIN-NY’s mission.

Data may be de-identified for other non-commercial purposes for which HINs may charge fees, including in situations such as the following: fees charged by HINs to cover the costs and expenses involved in providing properly de-identified data to third parties (e.g., fees charged for the cost of staff time or other resources needed by the HIN to provide a properly de-identified data set) or fees charged by HINs to provide services to a third party (such as data analytics and reporting services provided by HINs to SHIN-NY Participants as value-added services) using properly de-identified data. In these situations, appropriate data use agreements are required by Section 1.6 of the Privacy and Security Policies and Procedures for Qualified Entities and their Participants (one of the SOPs).

Participants and HINs are welcome to propose changes to the SOPs (or new SOPs) to address issues related to commercial uses of de-identified data. NYeC recognizes the concerns raised and will propose SOPs and future amendments to the SCPA through the Statewide Collaboration Process to further address this issue.