HCS Users Must Ensure Security Email Address Populated

The Department of Health (DOH) has circulated the below message. All DOH-regulated Health Commerce System (HCS) users should review and ensure that you have populated the “Security Email” address as outlined in step 2, below. This email should be unique to you and not used by others. It is simple and quick to do, and many likely already have it populated.

DOH message:

To enhance security on the Health Commerce System (HCS), effective April 30, 2026, all HCS users will be required to use their "Security Email Address" populated and verified for Self Password Reset and Forgotten User ID features of the system. 

The "Security Email Address" is a unique email address assigned to an HCS account starting June 2024. Multiple users are not allowed to use the same "Security Email Address". 

Although a majority of HCS users have populated and verified their "Security Email Address", any users can set their "Security Email Address" by two ways:

1. Login to the HCS at https://commerce.health.state.ny.us with HCS username and password. You will be immediately prompted to set the email address. (This only occurs if you do not have one set.)
2. While logged in HCS, users can set the "Security Email Address" in HCS from the top bar by selecting, My Content -> Change my contact information... In the bottom section, type in the email address, confirm by typing it in again and then Submit. 

Please Note: The last step to complete this process will be receipt of a confirmation email that users will need to use to verify and confirm their email address. 

Users can also use their "Security Email Address" to receive verification codes in the HCS Multi-Factor Authorization (MFA). 

We appreciate your help in making HCS a safer, more secure environment!

Contact: Diane Darbyshire, ddarbyshire@leadingageny.org, 518-867-8828