STATE EP News Alert 4.30.2026
HCS Security Update: Action Required by April 30, 2026
To enhance security on the Health Commerce System (HCS), all users must have a populated and verified “Security Email Address” to access the system’s Self Password Reset and Forgotten User ID functions, effective April 30, 2026.
Originally introduced in June 2024, the Security Email Address is now a required component of HCS access and account recovery. Each email address must be unique to an individual user—shared or group email addresses are not permitted.
What You Need to Do
Most users have already completed this step. If not, there are two ways to set your Security Email Address:
-
At Login:
If no Security Email Address is on file, you will be prompted to enter one immediately after logging into HCS. - Within HCS:
Navigate to:
My Content → Change my contact information
Enter and confirm your email address in the lower section, then select Submit.
Important:
You must complete the verification step by clicking the confirmation link sent to your email. Until verified, the Security Email Address will not be fully functional.
Additional Functionality
The Security Email Address may also be used to receive verification codes for HCS Multi-Factor Authentication (MFA), adding an extra layer of account security.
Keep Your HCS Information Current
The HCS remains the New York State Department of Health’s primary method for distributing time-sensitive and emergency communications to providers. Maintaining accurate and up-to-date contact information is not just best practice—it is a regulatory expectation.
Ongoing issues with outdated role assignments and contact details continue to create delays in urgent situations. To avoid disruptions:
- Ensure HCS Operator and Administrator roles include a 24/7 reachable phone number (no general office lines)
- Review and update contact information regularly
- Check HCS daily for alerts and notifications
- Align updates with routine processes, such as HERDS submissions
Five minutes now can save hours—or consequences—later.
