OHIP Security and Privacy

The New York State (NYS) Division of Operations and Systems (DOS) Security and Privacy Bureau oversees and manages security and privacy practices and procedures for NYS Medicaid data and systems. Bureau staff - the security team and the privacy team - interact with stakeholders to ensure that relevant security and privacy requirements are met. Stakeholders include program areas across the Department of Health (NYSDOH), the Office of Health Insurance Programs (OHIP), OHIP contractors and vendors, other NYS agencies, and other Medicaid Confidential Data (MCD) requestors that support the NYS Medicaid program.

MCD includes but is not limited to: names and addresses of Medicaid applicants/recipients, medical services provided, social and economic conditions or circumstances, NYSDOH evaluation of personal information, medical data, including diagnosis and past history of disease and disability, any information regarding income eligibility and amount of Medicaid payment, income information and information regarding the identification of third parties. The NYS Medicaid program may only release this information for specific purposes that will administer the NYS Medicaid program. Federal and NYS law ensures that MCD may only be used to administer the Medicaid Program.

The security team assists OHIP to evaluate and mitigate information security risks associated with creating, storing, and sharing MCD. The privacy team works closely with the NYS Division of Legal Affairs (DLA) to ensure that accurate and appropriate legal documents and processes are in place to facilitate Medicaid data sharing.

Requesting MCD

OHIP is responsible for determining when, and with whom, MCD may be shared in accordance with federal and NYS laws and regulations.

To protect the confidentiality of Medicaid beneficiaries, OHIP has strict privacy and security standards that apply to MCD. OHIP may only share MCD to administer the NYS Medicaid program in accordance with established privacy and security requirements.

For more information on who can request MCD, click below:

Questions or comments: doh.sm.Medicaid.Data.Exchange@health.ny.gov