Document Repository

Important: All NY Medicaid EHR Incentive Program forms are offered on the NY Medicaid EHR Incentive Program website in their required file format for submission. If you are having difficulty using one of the forms or need to request it in a different more accessible file format, please contact the NY Medicaid EHR Incentive Program at hit@health.ny.gov.

Important
  • The SRA must be conducted within the same calendar year of the EHR reporting period and prior to the date of attestation.
  • Effective payment year 2017, an EP must indicate the SRA completion date in MEIPASS.
  • Effective payment year 2019, an EP must indicate who completed the SRA and their relationship to the EP. Please refer to the following choices for relationship to the EP:
    • Self: is described as the person completing the SRA.
    • Independent Third-Party Consultant: is described as an individual employed by an entity outside of the EP´s practice
    • Other: is described as an individual who is not the EP or an independent third-party consultant. For example, an individual within the internal information technology (IT) department or "IT staff".
  • Effective payment year 2021, an EP has the ability to complete their SRA after submitting their Meaningful Use attestation. MEIPASS will allow providers to input a "Future Date" of completetion within the calendar year of 2021. Providers who utilize this option will need to complete their SRA by the end of the calendar year, and also retain detailed documentation related to it’s completetion.
  • Security Risk Assessment
  • Tip Sheet and Glossary for the ONC SRA Tool
  • SRA Webinar Presentation
  • SRA Tip Sheet for Small Practices (PDF)