NYC Health + Hospitals Employee Login: Secure Access Guide For ESS, Webmail, And EHR (2026)

This comprehensive access guide is specifically authored for active NYC Health + Hospitals (NYCHHC) employees, clinical staff, administrators, and authorized contractors requiring internal system credentials. If you are a patient seeking your personal medical records, test results, or appointment scheduling, please access the NYC Health + Hospitals MyChart patient portal instead of the internal staff applications detailed below.

Navigating the enterprise network of the largest municipal healthcare system in the United States requires strict adherence to authentication protocols and platform-specific access points. NYC Health + Hospitals operates an integrated digital infrastructure serving eleven acute care hospitals, dozens of Gotham Health community centers, long-term care facilities, and MetroPlusHealth administration. Whether managing biweekly payroll details through Employee Self-Service (ESS), reviewing clinical schedules via Microsoft 365 OWA, or placing orders in Epic Hyperspace remotely, maintaining seamless access to these secure platforms is essential for operational continuity and high-quality patient care across New York City.

Navigating the NYC Health + Hospitals Enterprise Digital Infrastructure

The public healthcare system relies on a multi-tiered portal network to segregate human resources administration, internal corporate communications, and HIPAA-protected electronic health records (EHR). Understanding which system governs your immediate administrative or clinical task prevents credential locking and reduces downtime.

Enterprise Employee Self-Service (ESS) and PeopleSoft HR

The Employee Self-Service portal serves as the centralized human resources gateway for all municipal health system staff. Powered by Oracle PeopleSoft, the ESS system enables employees to review real-time personnel data, update emergency contacts, and download tax documentation.

Key functionalities available within the ESS environment include:

• Accessing biweekly direct deposit advice slips and full pay stubs.
• Downloading annual W-2 tax forms and 1095-C health coverage statements.
• Reviewing accurate accrued Paid Time Off (PTO), sick leave balances, and compensatory time.
• Modifying federal, state, and local tax withholding elections (W-4 updates).
• Submitting yearly open-enrollment benefit changes, medical plan selections, and flexible spending account (FSA) information.

Corporate Email and Microsoft 365 Communications (OWA)

Official enterprise communication across Bellevue, Jacobi, Elmhurst, Kings County, Lincoln, Harlem, Metropolitan, Woodhull, Queens, South Brooklyn Health, and Coney Island facilities is managed through Microsoft 365 enterprise webmail. Staff members can access their exchange accounts off-network using Outlook Web App (OWA).

The OWA platform enforces strict encrypted data policies to prevent sensitive administrative transmission leaks. Access requires an official active network address ending in @nychhc.org or assigned system aliases, coupled with secondary authentication. Personal webmail forwarding is strictly prohibited under network security guidelines.

Remote Clinical Access via Citrix StoreFront and Epic Hyperspace

Clinicians, attending physicians, residents, registered nurses, and allied health professionals needing remote access to patient records utilize the secure Citrix Virtual Apps infrastructure to launch Epic Hyperspace.

Because Epic handles Protected Health Information (PHI), accessing clinical charting, e-prescribing, order entry, and diagnostic results outside physical hospital premises requires elevated secure socket layer (SSL) encrypted tunnels and active multi-factor authentication (MFA).

Step-by-Step Instructions for Remote Portal Authentication

Logging into NYC Health + Hospitals internal portals from a non-network device or home workstation requires a synchronized security verification routine. System security updates mandate mandatory zero-trust verification across all remote access nodes.

1. Verify Network Prerequisites: Ensure your personal computer or mobile device runs an updated operating system (Windows 11 or macOS Sequoia) with an active enterprise-grade web browser such as Google Chrome or Microsoft Edge.
2. Initialize Identity Authenticator: Keep your registered smartphone or hardware security key ready. The health system utilizes enterprise MFA tokens through applications such as Microsoft Authenticator or Duo Security.
3. Navigate to the Correct Gateway: Launch your browser and navigate directly to the official enterprise endpoint (e.g., the primary ESS login, OWA Microsoft portal, or internal Remote Access Gateway).
4. Input User Credentials: Enter your standardized network User ID (typically structured as the first letter of your first name, last name, or assigned HHC network handle) and your current network password.
5. Complete Secondary Authentication: Accept the push notification sent to your mobile device, enter the six-digit TOTP code generated by your authenticator app, or approve the biometric verification prompt.
6. Launch Required Virtual Environment: If accessing Epic or internal clinical databases, click the appropriate application icon inside the Citrix StoreFront dashboard to initialize a virtual desktop session.

Security Compliance Reminder: Never share your network credentials, MFA push approvals, or token codes with anyone, including IT support personnel. NYC Health + Hospitals Enterprise IT will never ask for your password over the phone, via email, or through unverified chat services.

Technical System Specifications & Access Protocols Matrix

The table below outlines the core enterprise login portals, their administrative purpose, standard authentication requirements, and standard support escalation paths for system users.

Resolving Portal Authentication Errors and Security Protocols

System login failures generally result from expired passwords, out-of-sync multi-factor authentication devices, or cached browser credential conflicts. Recognizing specific error codes accelerates resolution.

Common Failure Modes and Solutions

Password Expiration and Account Lockouts

Network passwords expire periodically to maintain HIPAA and cybersecurity standards. If you enter an incorrect password three consecutive times, the domain controller temporarily locks your account for security protection.

• Resolution: Wait 15 minutes for automatic account unlocking, or utilize the Self-Service Password Reset (SSPR) portal from a verified network device. If locked out indefinitely, contact the Central IT Service Desk to verify your identity and request a temporary unlock token.

Multi-Factor Authentication Push Failure

If you do not receive the MFA approval notification on your mobile device when attempting to log in remotely:

• Resolution: Verify that your mobile device has an active Wi-Fi or cellular data connection. Open your authenticator application directly and check for pending offline approval codes. If you have changed mobile devices or phone numbers, you must contact IT security to re-register your authentication device.

Citrix Launcher and Workspace App Errors

When accessing Epic Hyperspace remotely, clicking the virtual application icon may stall or download a raw .ica file without opening the EHR application.

• Resolution: Download and install the latest Citrix Workspace app version compatible with your operating system. Clear your browser cache and cookies, then set your browser preferences to automatically launch .ica files using the Citrix Workspace client.

Security Guidelines: Remote Work vs. On-Premises Network Rules

Accessing NYC Health + Hospitals internal databases remotely introduces operational security risks that differ from working within a secure, physical facility network behind corporate firewalls.

[Employee Computer / Mobile Device] │ ▼ [Multi-Factor Authentication (MFA Check)] │ ▼ [Secure SSL Encrypted Tunnel / Firewall] │ ▼ [NYC HHC Enterprise Network & Epic / ESS / OWA]

On-Premises Network Environment

When connected directly to physical hospital networks (via wired Ethernet connections or encrypted internal Wi-Fi networks like HHC-Secure), single sign-on (SSO) protocols streamline application movement. Smart card badge tapping (e.g., Imprivata OneSign) enables quick context switching between patient rooms without re-entering primary passwords continuously.

Remote & Off-Site Access Environment

When accessing system portals from home or remote clinical locations, zero-trust rules govern the session:

• Mandatory MFA verification is required for every new session initialization.
• Auto-logout timers are shortened to protect patient privacy on unattended non-network devices.
• Screen capturing, local saving of patient documents, and remote printing are strictly restricted or blocked entirely within Citrix sessions.
• System usage is logged and audited continuous to maintain HIPAA compliance standards across all municipal health centers.

Frequently Asked Questions About NYC HHC Staff Portals

How do I reset my NYC Health + Hospitals employee network password remotely?

You can reset your password using the official Self-Service Password Reset (SSPR) web tool if you have previously registered security questions or a secondary authentication device. If you are locked out completely, call the centralized IT Service Desk at 212-323-2300 to verify your identity and receive a temporary reset code.

Can I access Epic EHR from a personal laptop or non-network computer?

Yes, clinicians can access Epic remotely using the web-based Citrix StoreFront gateway. You must have the Citrix Workspace application installed on your computer, along with an active Duo or Microsoft Authenticator MFA configuration registered to your HHC user account.

Where can I view my W-2 forms and biweekly pay stubs online?

Biweekly pay stubs, tax statements (W-2 forms), and accrued time-off balances are accessible online via the PeopleSoft Employee Self-Service (ESS) portal. Citywide payroll selections, pension documentation, and direct deposit banking modifications are managed through the NYCAPS Employee Self-Service portal.

What should I do if my MFA push notifications are not reaching my phone?

First, ensure your phone is connected to cellular data or Wi-Fi. If push notifications do not appear, open your MFA authenticator app manually to retrieve the static 6-digit verification code, and enter it into the login prompt. If you recently changed your smartphone, contact the IT Service Desk to reset your MFA pairing.

How do new employees complete their initial account activation?

New employees receive temporary account credentials and an initial activation link during onboarding from Human Resources or their department onboarding coordinator. Upon first access, new users must immediately establish a unique password, register security verification questions, and enroll their smartphone in the enterprise MFA solution.

Enterprise IT Technical Support and Escalation

If you experience persistent authentication issues, system outages, or permission errors that cannot be resolved through self-service portals, contact the enterprise technical support infrastructure immediately.

When contacting the help desk, prepare your 8-digit Employee ID number, facility location, specific portal name, and exact error messages encountered to ensure prompt troubleshooting.

• Centralized IT Service Desk Phone: 212-323-2300
• System Operations Availability: 24/7/365 Technical Support for Urgent Clinical Access Issues
• Self-Service Support Portal: Accessible via internal network intranet nodes