Hixny for Patients: Everything you need to know about Hixny

Hixny: How it Works

Think of Hixny as an extension of your medical provider. Your doctors—including those in emergency room settings, urgent care centers and hospitals—have asked us to work on their behalf to help them get data from, and share your information with, other doctors you may see.

This seamless exchange of health data empowers your providers to make the right decisions concerning your health.

How Hixny works is best described with an example:

• Your primary care provider (PCP), who is connected to Hixny, sees you for a cough. They add notes about your visit to their electronic medical records (EMR) system.
• A month later, you visit urgent care with symptoms of a sinus infection.
• When the urgent care provider logs into their EMR system, the details from your PCP visit flow through Hixny from your PCP.
• The doctor at urgent care can now decide what tests to run and whether the cough and the sinus infection might be related.

Your consent only covers use of Hixny as a tool to see your records.

Denying consent to Hixny does not mean you can entirely restrict access to your health records. Federal and state law permit certain providers and organizations to access your records without your permission.

The following circumstances are the most common ways your healthcare data may be accessed, regardless of your Hixny consent status:

• Providers who are involved in your care can contact other members of your healthcare team directly to request your records be sent to them by mail, fax or email. Hixny is not involved in—nor made aware of—these requests.
• If you are in an emergency situation and are unable to communicate with medical staff, they may opt to access your records to ensure your safety, this is called “Breaking the Glass.” In every one of these circumstances, the access is documented and an audit initiated to ensure proper procedure was followed.
• You can see a full list of exceptions in the Consent section of the Privacy & Security Policies and Procedures for qualified entities of the Statewide Health Information Network for New York (SHIN-NY).

If you want to deny nearly all providers the ability to use Hixny to see your records, you may download and complete a Hixny-Wide Denial of Access Form. Please read the form in its entirety to understand the limitations that may still apply.

Hixny and HIPAA

Hixny is a non-profit organization enlisted by your providers to make your health information available electronically.

HIPAA stands for Health Insurance Portability and Accountability Act. Its goal is to allow for health information to flow freely between providers and patients to improve care. This includes allowing for information to flow from one provider to another if they are both involved in a shared patient’s care.

HIPAA has many parts to it. The most relevant to you as a patient are:

• The Privacy Rule. A piece of HIPAA set to ensure your Protected Health Information (PHI) is just that—protected—while still allowing data to flow. It allows the people who need it most (e.g., your providers) access to your health information, electronically or otherwise.
• The Security Rule. Another piece of HIPAA whose purpose is to ensure the protection of health information while it is being exchanged electronically.

Under HIPAA terms, Hixny is a “business associate.” A business associate can be hired by a covered entity to outsource key functions they don’t have the resources to complete internally. Your doctors are “covered entities.”

Both business associates and covered entities are subject to HIPAA’s Privacy Rule and Security Rule. HIPAA requires that specific contracts are in place between covered entities (e.g., your doctors) and business associates (e.g., Hixny) to ensure the data being exchanged is properly used, disclosed and protected.