NYP Citrix Remote Access: Login Guide, Setup, and Troubleshooting

The NYP Citrix portal—commonly accessed through the NewYork-Presbyterian myAccess gateway—provides secure, HIPAA-compliant virtual desktop and application streaming for medical staff, physicians, and administrative employees. Users log in using their Center-Wide ID (CWID), enterprise password, and Duo Multi-Factor Authentication (MFA) to access electronic medical records like Epic, internal email, and clinical systems remotely.

Understanding the NYP Citrix Platform (myAccess Gateway)

NewYork-Presbyterian (NYP) relies on Citrix virtual application and desktop virtualization (VDI) technology to deliver secure remote computing capabilities to thousands of healthcare professionals across Columbia University Irving Medical Center, Weill Cornell Medicine, and regional hospital network sites. Known internally as NYP myAccess or the NYP Enterprise Citrix Portal, this platform acts as an encrypted bridge between personal or remote computing hardware and NYP’s internal network infrastructure.

Through the Citrix interface, authorized users gain access to mission-critical applications without storing protected health information (PHI) locally on personal hardware. The virtualized architecture processes all computations, clinical data extractions, and file modifications on high-availability server clusters housed inside NYP data centers. This zero-trust architecture ensures that patient records in Epic Hyperspace, laboratory diagnostic tools, radiological viewing applications, and administrative enterprise resource systems remain strictly within the hospital network boundary.

Remote workforce support via Citrix encompasses several core healthcare and operational workloads:

• Electronic Medical Record (EMR) Access: Streaming native clinical instances of Epic, Cerner, and specialized charting tools directly to ambulatory devices, home workstations, and call rooms.
• Internal Communication Suites: Accessing secure Microsoft Outlook email instances, intranet resources (Infonet), and internal HR/payroll tools without requiring full virtual private network (VPN) tunneling.
• Radiology and Imaging Tools: Viewing high-resolution PACS and diagnostic software under standardized bandwidth optimization configurations.
• Administrative Operations: Executing revenue cycle applications, scheduling databases, and departmental shared network drives securely outside physical hospital facilities.

System Requirements and Technical Prerequisites

Before attempting to access the NYP Citrix Gateway, workstations and mobile devices must satisfy strict security baseline requirements established by the NYP Information Technology and Security Department. Failing to meet these standards will prevent session initialization or cause immediate connection failure during the multi-factor handshake.

Secure session establishment requires an active network connection with a minimum downstream bandwidth of 5 Mbps for basic application streaming, while diagnostic imaging and multi-monitor clinical VDI sessions require 15 Mbps or higher for uninterrupted frame rendering.

Hardware and OS Compatibility

Supported operating systems include modern builds of Windows 10 and 11 (Enterprise and Home editions), macOS 12 Monterey or higher, iOS/iPadOS 16+, and Android 12+. Legacy operating systems such as Windows 7, Windows 8.1, or outdated macOS distributions are blocked by the gateway web application firewall (WAF) to prevent system vulnerabilities.

Required Software Components

1. Citrix Workspace App: The dedicated native client application (which superseded Citrix Receiver) must be installed on the local device for full session support, peripheral pass-through, and multi-monitor setup. While HTML5 fallback web rendering exists, the native app is strongly recommended for EMR operations.
2. Duo Mobile Authenticator: NYP utilizes Duo Security as its primary multi-factor authentication mechanism. The Duo Mobile app must be registered and configured on an active smartphone or tablet connected to the user's CWID account.
3. Supported Web Browsers: The web entry point operates optimally on updated instances of Google Chrome, Microsoft Edge, or Apple Safari. Mozilla Firefox is supported, provided third-party cookies and pop-up redirections for NYP domains are allowed.

Step-by-Step Guide: Logging Into NYP Citrix (myAccess)

Connecting to the NYP Citrix portal requires completing a structured authentication pipeline designed to verify credential validity, secondary device ownership, and endpoint compliance.

Step 1: Download and Install Citrix Workspace

If accessing the portal from a non-managed personal device, navigate to the official Citrix website and download the latest release of Citrix Workspace App corresponding to your operating system. Run the installer using default settings. When prompted to "Add Account" or enter a server URL during the initial software wizard, you may skip this step and close the installer box, as connection routing will occur via your web browser.

Step 2: Navigate to the Official Gateway

Launch your web browser and navigate directly to the official NYP myAccess web address (myaccess.nyp.org). Verify that the URL bar displays a valid SSL/TLS lock icon issued to NewYork-Presbyterian Hospital. Do not log in through third-party search engine landing pages or unverified external links.

Step 3: Input Enterprise Credentials

On the central authentication page, input your assigned Center-Wide ID (CWID) in lowercase letters along with your standard NYP network domain password. Select the appropriate domain dropdown (e.g., NYP, Enterprise, or affiliated clinical domain) if requested by the prompt.

Step 4: Complete Duo Multi-Factor Authentication (MFA)

Upon entering valid primary credentials, the portal triggers a Duo Security MFA request. Depending on your account preferences, you will receive:

• Duo Push: A push notification sent to your registered mobile phone. Tap "Approve" on your mobile device to complete authentication.
• Passcode Verification: A time-based one-time password generated inside the Duo Mobile app, entered directly into the secondary authentication field on your workstation screen.

Step 5: Select and Launch Applications

Once verified, the Citrix StoreFront dashboard displays your authorized application matrix. Click any icon—such as Epic Hyperspace or NYP Remote Desktop—to download or launch the corresponding .ica session file. The installed Citrix Workspace App will automatically intercept this launch file and render your secure virtual session.

Platform Features & Access Comparison

The table below details the performance capabilities, features, and operational limitations across various connection methods available to NYP staff.

Common Troubleshooting Protocols for NYP Citrix Issues

Technical friction during remote Citrix access typically stems from expired authentication tokens, misconfigured local browser handlers, outdated Workspace clients, or local network restrictions. Use the following diagnostic workflows to resolve connection failures.

Issue 1: Citrix App Prompt Loop or ICA File Fails to Open

• Symptom: Clicking an application icon in the myAccess portal repeatedly prompts you to install Citrix Workspace, or downloads an .ica file that does not launch automatically.
• Resolution: Navigate to the browser download folder, right-click the .ica file, select "Open With," and set Citrix Workspace Launcher as the default application for .ica file extensions. Alternatively, open the myAccess portal settings menu (top-right corner under your username), select Account Settings, and switch the launch method from "Detect Client" to "Use Web Browser / HTML5" as a temporary workaround.

Issue 2: Duo Push Notifications Not Arriving

• Symptom: The login portal hangs on the authentication screen, but your mobile phone never receives the push request.
• Resolution: Ensure your mobile phone has an active internet connection (Wi-Fi or cellular data). If push notifications fail due to background battery-saver features, open the Duo Mobile application manually to pull pending requests, or select "Enter a Passcode" on the login screen to use the offline numeric generator from the app.

Issue 3: Session Freezing or Unexpected Epic Disconnections

• Symptom: The virtual desktop interface freezes mid-charting, displaying a "Reconnecting..." banner or dropping entirely.
• Resolution: This occurs when local Wi-Fi drops packets or switches access points. Switch to a wired Ethernet connection where possible. If connected over Wi-Fi, disable bandwidth-heavy local activities (such as media streaming or cloud back-ups) running concurrently on your personal network. The NYP Citrix server preserves your active session state for a predetermined grace period; reconnecting within 10 to 15 minutes restores your open workspace without data loss.

Issue 4: SSL Certificate or Gateway Security Errors

• Symptom: Browsers display an SSL_ERROR_HANDSHAKE_FAILURE or "Your Connection Is Not Private" notification when visiting myaccess.nyp.org.
• Resolution: Verify your local system clock is set to automatic time synchronization. Out-of-sync local clocks break TLS handshake validation. Clear your web browser cache, disable third-party security software network interception (such as local SSL scanning features in personal antivirus software), and verify you are not operating behind an unauthorized public Wi-Fi network filtering port 443 traffic.

Information Security, HIPAA Compliance, and Usage Policy

Utilizing the NYP Citrix platform binds users to NewYork-Presbyterian Hospital's enterprise IT usage policies and federal Health Insurance Portability and Accountability Act (HIPAA) mandates. Remotely accessing hospital systems introduces risks that must be managed through individual compliance practices.

Saving patient data, taking screen captures, recording video of virtual sessions, or allowing unauthorized individuals to view active clinical displays on personal devices violates hospital policy and federal privacy laws.

Always adhere to these core security protocols while connected to NYP myAccess:

• Screen Privacy: Position personal screens away from public view, family members, or open windows when accessing clinical systems or EMR records.
• Session Termination: Always use the explicit "Log Off" button within the Citrix Start menu or StoreFront dashboard when completing tasks. Closing the browser tab without logging off leaves your virtual session active and vulnerable to unauthorized access.
• Device Ownership: Never save CWID credentials or passwords in personal browser auto-fill vaults. Use personal devices only when they are secured with active device lock passwords or biometric security.
• Unsecured Networks: Avoid operating NYP Citrix sessions over open, non-password-protected public Wi-Fi access points (such as coffee shops or airport terminals) without an active, institutionally approved endpoint protection mechanism.

Frequently Asked Questions

How do I reset my NYP CWID password if I am locked out of Citrix?

Navigate to the official NYP Password Self-Service Portal online or contact the NYP IT Helpdesk directly. Password resets cannot be processed inside the Citrix login interface itself once an account is locked due to repeated incorrect password attempts.

Can I access NYP Citrix on an iPad or Personal Mac?

Yes, NYP Citrix is fully accessible on macOS and iPadOS. Install the Citrix Workspace App from the Mac App Store or iOS App Store, navigate to myaccess.nyp.org in Safari, and complete the Duo MFA login process to launch your applications.

What is the difference between NYP Citrix (myAccess) and NYP VPN?

NYP Citrix streams individual virtual applications and desktops within a secure, isolated container without connecting your entire physical computer to the hospital network. NYP VPN creates a direct network tunnel between your device and the NYP internal network, typically restricted to managed institutional laptops and specialized IT administrative roles.

Why does my Epic session disconnect after a period of inactivity?

To maintain HIPAA compliance and protect patient records, NYP Citrix enforces automated session timeouts. Inactive sessions lock after a set threshold (typically 15 to 30 minutes of no mouse or keyboard input). Logging back in restores your active clinical workspace within the server grace period.

Do I need to install Citrix Workspace if I only need to check my NYP email?

No, you can select the web browser HTML5 fallback client inside the myAccess portal settings, allowing you to view web applications directly inside Chrome, Edge, or Safari without installing software. However, for full functionality in clinical tools like Epic, installing the native Citrix Workspace App is recommended.

Need Additional Assistance?

If technical issues persist after applying the troubleshooting steps above, contact the institutional support resources below:

• NYP IT Service Desk: Contact the internal helpdesk by phone at the dedicated support extensions provided on the NYP Infonet or back of your employee ID badge.
• Duo MFA Enrollment: Visit the self-service security portal on the NYP internal network to re-register replacement mobile devices or update phone numbers for MFA pushes.
• Columbia & Weill Cornell Liaisons: Affiliated university faculty and fellows may also seek credential synchronization assistance through their respective campus IT support desks (CUIMC IT or WCM ITS).