The Rising Public Health Leviathan: New York's Shiny New SHIN-NY

The state is bringing everyone's personal health information under one roof, making room to store more detailed data about our lives, and creating a whole new health information ecosystem.

Pro tip: To save yourself from an attack of TLDR, you can use Substack’s automatic text-to-speech reader to listen to articles. It’s available in the Substack app for smartphones. Open an article in the app and look for the play icon at the top of the screen.

Remember when Facebook was shiny and new? What a great way to stay in touch with far-flung friends and family! You could share all your news and photos with them, catch up on current events, or link up with a whole new crowd of like-minded people. Awesome!

As we all know, there have also been some downsides to the social media era launched by Facebook. New kinds of social strife and dangers emerged, and social media companies built on data brokering became a massive surveillance machine, churning out detailed consumer data that anyone who wants to sell us anything can buy.

Social media and all of the data-collecting digital businesses became useful to government agencies, too—but only up to a point. Intelligence services can monitor social media groups, law enforcement can glean information on criminal suspects, and governments benefit from anonymized digital consumer data for research purposes, just like everyone else.

But there are well-known limits on government use of personal information from private sources, whether they’re social media platforms, shopping behemoths like Amazon, or personal communication tools like smartphones, text messages, and email. When government agencies want to get information from these sources, they have to navigate a tangle of warrants and subpoenas and privacy laws.

Go about it the wrong way, and someone might sue them for a Fourth Amendment infringement. Try to use privately owned social media platforms to enforce government policies and preferences, and they might wind up at the Supreme Court.

The government can only go so far in dipping into and making use of the sea of personal data available today, because it doesn’t own the databases and it doesn’t have citizens’ consent to access all their data.

That could change.

New York’s SHIN-NY New Health Information Infrastructure

Last month, I reported on a proposal to give New York State’s health data infrastructure a major upgrade. The proposed changes will amend the state’s public health regulations to centralize and standardize the Statewide Health Information Network for New York, known as the SHIN-NY (pronounced “shiny”), and create a statewide consent system whereby patients will sign a single form to make their personal health information accessible to any entity participating in the SHIN-NY system.

At first glance, it looks like a typical tech upgrade. The changes will make the system more efficient and ensure that patients’ medical records travel with them wherever they go for health care.

The SHIN-NY was designed to help health care providers—from urgent care clinics and hospitals to doctors and EMTs—share vital information about patients’ conditions, procedures, and medications. Improving the system promises to reduce medical errors and emergencies that can cost people their lives.

But there’s more to this overhaul than a tech upgrade—a lot more. It’s part of a wholesale change to our health care system that expands the definition of health care to encompass just about every aspect of human life, and is building a centralized government system capable of tracking a detailed catalog of personal information about each individual.

How the SHIN-NY Works Now

The SHIN-NY is overseen by the New York State Department of Health, but it’s run by a nonprofit organization called the New York eHealth Collaborative (NYeC, pronounced “nice”).

You can get a basic overview of how the SHIN-NY works now, from a patient perspective, by watching this snappy promo video put out by NYeC:

For more detailed information, check out this webinar:

And if you’d like a more technical explanation of how the SHIN-NY back end works, click through this slideshow from 2015, when the system was first being set up.

Basically, the SHIN-NY uses regional data hubs called Regional Health Information Organizations (RHIOs, also known as Qualified Entities or QEs) to connect health care providers so that they can easily share medical records from their internal patient information systems.

Patients sign consent forms to give providers permission to share and access their information, so that they’re all up to speed when they treat you. According to NYeC, using the system results in a “50% reduction in hospital readmissions,” a “26% reduction in emergency department visits,” and a “35% reduction in rate of repeat imaging procedures.”

When you sign the consent form, your medical records are uploaded to a RHIO. It stores the records from all of the health care providers you’ve given consent to, and matches them with your identity. Then when, say, your doctor searches for you in the system’s clinical viewer, all of your medical documents from other providers get pulled down from the RHIO.

How the New SHIN-NY System Will Work

Under the new regulatory amendments, health care providers will be able to contract directly with the SHINY-NY as participants, instead of going through a RHIO.

The infrastructure will also get a couple important additions:

• A statewide data repository will be added, and will store all of the information that’s accessible through the SHIN-NY system. It will consolidate all of the data stored on the RHIOs.

• A group of Health Equity Regional Organizations (HEROs) will be added. Like the RHIOs, they will collect data from specific regions of the state. But the HEROs will be focused on aggregating and analyzing data from social services and community organizations, which are being brought under the SHIN-NY umbrella. I’ll have more to say about that in another article.

As I’ve mentioned, the SHIN-NY will get a new statewide consent system, whereby individuals will sign a single form to give all SHIN-NY participants in the state access to their health information.

The New York State Department of Health is one of those participants, and authorized DOH staff have access to health information through a Web-based clinical viewer.

That raises two questions for me: What can the DOH do with the new SHIN-NY system, and what is it allowed to do? Especially:

• Can the DOH generate a statewide report on specific criteria?

• Is information on large numbers of people that the DOH can pull from the statewide repository and the SHIN-NY in general de-identified? (That is, has it been made anonymous so that it can be used as data for public health studies and statistics?)

I believe the answer to the first question has only recently become yes. In the past, if someone at the Department of Health or a RHIO, or even just a hospital, wanted to output a list of say, the latest A1C lab results or blood pressure readings for a large group of patients, the system was just too clunky to generate such granular reports.

But then came the FHIR. That’s pronounced “fire,” and it stands for Fast Healthcare Interoperability Resources. It’s a healthcare data exchange protocol that does what it says: It makes interoperability fast.

The SHIN-NY started transitioning to a FHIR framework around 2019. I can’t be sure, because NYeC won’t answer my questions, but I assume the SHIN-NY is fully on FHIR by now. (Read that last sentence out loud and you’ll get a feel for how ridiculous reading a lot of technical and regulatory documents can get.)

In a presentation at the 2020 DevDays virtual conference, NYeC Senior Director of Services Management Luke Doles talked about the FHIR implementation and explained that it allowed exactly the use cases I described above: pulling up all the A1C or blood pressure data for a given group of patients.

Doles went on to explain: “Now we’re planning to build on the initial FHIR framework over the next year to support these public health use cases for things like COVID-19 reporting and flu surveillance. This will be a centralized pool of data that will be aggregated and delivered to the DOH for public health.”

In other words: Want to generate a list of people who have tested positive for COVID-19 or the flu—or people who have received a vaccine for them? The SHIN-NY has enough tech muscle to do that now. Having a central repository to pull data from should make the process of generating such granular reports from statewide data even faster and more efficient.

If you want to nerd out, you can watch the 2020 presentation yourself:

So that brings us to the next question: Is the Department of Health legally allowed to do something like spit out a list of every New Yorker in the SHIN-NY system who got a COVID-19 vaccine, names and all?

The answer gets complicated, but I’d say it’s a qualified yes. Here are a few reasons why:

1. The SHIN-NY amendments include this change to the existing regulations:

“Each qualified entity shall . . . submit data, including patient information, using the statewide data infrastructure, to the New York State Department of Health or its designated contractor, according to specifications provided by the New York State Department of Health”

“Patient information” is defined in the document as:

“health information that is created or received by a . . . SHIN-NY participant and relates to the past, present, or future physical or mental health or condition of an individual or the provision of health care to an individual, and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.”

2. The SHIN-NY is governed by a lengthy Privacy and Security Policies and Procedures guide, which was last updated in January 2023. It specifies that:

“A QE may Disclose Protected Health Information to a Public Health Agency without Affirmative Consent for public health activities authorized by law, including . . .”

A very inclusive list of 17 items follows, which you can see for yourself on page 12 of the guide. Note that the information can be disclosed for public health purposes even if you don’t consent to it, and “Protected Health Information means individually identifiable health information . . . of the type that is protected under the HIPAA Privacy Rule.”

In fact, the federal HIPAA law itself provides broad exceptions to privacy rules when it comes to public health. HIPAA may keep the guy next door from seeing your medical records, but it probably won’t stop the government.

3. There are some subtle references to the SHIN-NY in a State Senate bill that’s currently in committee, S1531. (It’s one of the bills that medical freedom advocates are lobbying against.)
   
   The bill requires anyone who gives an adult a vaccination to report it to the health department or “A REGIONAL HEALTH INFORMATION ORGANIZATION.” That’s a RHIO, one of the SHIN-NY’s regional data hubs. From there, the vaccination gets reported to a state or city immunization registry. The bill also removes the requirement to get consent for the reporting.
   
   So with the new SHIN-NY rules, the process could work like this: You go to the dentist for a toothache. Your dentist is a SHIN-NY participant and asks you to sign the statewide consent form, which you do. The next year you get a flu vaccine at the pharmacy, also a SHIN-NY participant, and because you’ve already signed the statewide consent, your flu vaccination automatically gets reported to a RHIO and from there goes to the DOH and the state immunization registry.

   The main point of the registry is to track the vaccination status of individuals for school requirements and such, so identifying information will not be removed. It will stay with the vaccination data as it travels from the point of entry into the SHIN-NY system to the Department of Health and on to the entity enforcing vaccination requirements.

   
   You might ask why this bill exists, if vaccinations can just be reported through the SHIN-NY. Not every provider that administers vaccines is a participant in the SHIN-NY yet, and until the amendments take effect, participants aren’t required to supply patient information to the system. When those things change, I could see the separate state and city immunization registries becoming redundant and being phased out. That makes the bill look like an interim measure to me.

I could go on, but I won’t. You’re probably already feeling the TLDR on that topic, and I don’t want to give you the impression that this is just about immunization tracking. That’s just one use case, as they say, for the robust health information infrastructure being built.

New York’s New Health Information Ecosystem

I think the most important thing to understand about the revamped SHIN-NY is that it isn’t just software or a data-sharing service. It’s an infrastructure that makes a whole new information ecosystem possible.

That ecosystem will include expanded telehealth services that are already in the works. It will be able to apply artificial intelligence tools to analyze huge quantities of statewide health data—and individual health information too. It will have the capacity to support apps, smart health devices, and health information from third-party sources.

If you don’t know what I mean with that last one, think Experian or another major consumer data source. You might think of health information as the stuff that has always been in your medical records: illnesses, medications, surgeries, blood pressure readings—information about your body that your health care providers get from examining you or asking you questions. But what “health information” means is changing.

Are you broke? Do you have a car or public transportation nearby? How about your friends? Do you see them much? Do you get along with your neighbors? The answers to these questions can be considered health information in our quickly evolving ecosystem. Don’t believe me? Your neighbor problem can go into the database as ICD-10-CM code Z59.2: Discord with neighbors, lodgers and landlord.

I’ll get into the expansion of health care and the meaning of “health information” in the next article. For now, let me leave you with this thought about why it’s important to pay attention to the health care system overhaul.

The Consent of the Governed

Facebook is not the government. Amazon, X, Apple, Google, and plenty of other gargantuan corporations may have oodles of information about you stashed away. You’ve probably signed a gazillion terms of service agreements with a click and forked over a pile of personal consumer data in the process. But none of those companies are the government. Their boards of directors don’t pass or enforce laws (massive lobbying notwithstanding).

That’s not the case with the SHIN-NY and its statewide repository. Those are government systems, even if they function through partnerships with nonprofits. When your personal health information goes into that database, the state can use it for a very broadly defined set of public health purposes, often even if you haven’t consented to the use. In a declared state of emergency, I’d put my money on the definition of public health purposes being “whatever the government thinks is best.”

The health care overhaul promises to improve the quality and coordination of care and help solve serious problems, just like Facebook brought us some things we really like. But now is the time to take a close look at the system being built, the rules and legal protections that should be set to limit its power, and the consent we may be giving to our government to use a potentially extensive set of information about us, just by going to the doctor.

Coming next in this series: Health Information Gets Social

Go back to The Rising Public Health Leviathan: Intro

Postscript on my questions for NYeC

I’ve mentioned that NYeC, the nonprofit organization that runs the SHIN-NY, has refused to answer my questions. I am publishing my correspondence with them here for anyone who wants to take a look. NYeC may not value transparency, but I do!

The SHIN-NY is funded by New Yorkers, stores our personal information, and was created to serve our needs. NYeC should answer questions about how the SHIN-NY works not just from journalists but from anyone who lives in the state of New York.