Health New England Interoperability APIs

At Health New England, we understand the importance of improving health information access for our members. In compliance with federal guidelines developed by CMS, Health New England has made Patient and Provider Directory APIs (application programming interface) available for members who consent to have their data shared with third-party vendors. Please visit the website below for APIs, usage and other information.

https://fdp.edifecsfedcloud.com/#/portal/health.new.england.inc


What to consider before authorizing a third-party app to retrieve your health care data 

It is important to take an active role in protecting your health information. Health New England provides the information below to ensure members know what to look for when choosing an app and make informed decisions about sharing their health care data.

What you can do to protect your health care data:

  1. Review the apps’ Privacy Policy: Look for apps with an easy-to-read privacy policy that clearly explains how the app will use your data.
    • If an app does not have a privacy policy, we strongly advise members not to use the app.
  2. What to consider in selecting an app:

    • What health data will this app collect? Will this app collect non-health data from my device, such as my location?
    • Will my data be stored in a de-identified or anonymized form?
    • How will this app use my data?
    • Will this app disclose my data to third parties?
      • Will this app sell my data for any reason, such as advertising or research?
      • Will this app share my data for any reason? If so, with whom? For what purpose?
    • How can I limit this app’s use and disclosure of my data?
    • What security measures does this app use to protect my data?
    • What impact could sharing my data with this app have on others, such as my family members?
    • How can I access my data and correct inaccuracies in data retrieved by this app?
    • Does this app have a process for collecting and responding to user complaints?
    • If I no longer want to use this app, or if I no longer want this app to have access to my health information, how do I terminate the app’s access to my data?
    • What is the app’s policy for deleting my data once I terminate access?
      • Do I have to do more than just delete the app from my device?
    • How does this app inform users of changes that could affect its privacy practices?

If the app’s privacy policy does not clearly answer these questions, you should reconsider using the app to access your health information.

Health information is very sensitive information, and members should be careful to choose apps with strong privacy and security standards to protect it.

What are your rights under the Health Insurance Portability and Accountability Act (HIPAA) and who must follow HIPAA?

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules, and the Patient Safety Act and Rule. You can find more information about patient rights under HIPAA and who is obligated to follow HIPAA here: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.htm

HIPAA FAQs for Individuals: https://www.hhs.gov/hipaa/for-individuals/faq/index.html

Are third-party apps covered by HIPAA?

Most third-party apps will not be covered by HIPAA. Most third-party apps will instead fall under the jurisdiction of the Federal Trade Commission (FTC) and the protections provided by the FTC Act. The FTC Act, among other things, protects against deceptive acts (e.g., if an app shares personal data without permission, despite having a privacy policy that says it will not do so).

The FTC provides information about mobile app privacy and security for consumers here: https://www.consumer.ftc.gov/articles/0018-understanding-mobile-apps

What should you do if you think your data has been breached or an app has used your data inappropriately?

To contact Health New England Compliance:

Email:  compliancedepartment@hne.com

Call: Ethics/Compliance Hotline: (800) 453-3959

File a complaint with OCR:

Individuals can file a complaint with OCR using the OCR complaint portal:

https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf

To learn more about filing a complaint with OCR under HIPAA, visit: https://www.hhs.gov/hipaa/filing-a-complaint/index.html

File a complaint with the FTC:

Individuals can file a complaint with the FTC using the FTC complaint assistant:

https://www.ftccomplaintassistant.gov/#crnt&panel1-1

HNE