{"ref":"CA-HH-PRV-02","title":"Security of Electronic Health Information","category":"Privacy","summary":"Sets the Agency’s security program for electronic patient information: the security official, the risk analysis and risk management plan, access control with unique logins, role-based access, automatic logoff, encryption, audit logs that record every change or deletion (Cal. Civ. Code §56.101(b)), mobile device rules for staff in the field, backups and a contingency plan, security incident handling, and the documentation the HIPAA Security Rule requires (45 CFR §§164.308-164.316), so that computerized records are protected as 22 CCR §74731(i) requires.","inShort":["Use only your own login. Never share your password or let anyone use your device.","Keep patient information only in the approved app, not in your photos, texts, or personal email.","Lock your screen when you step away, and never leave a device in a patient’s home or in sight in your car.","If a device is lost or stolen, or you clicked a suspicious link, call the security official right away.","If the system is down, document on the paper downtime forms and enter the notes when it comes back."],"primaryCitation":"22 CCR §74731(i)","citations":["22 CCR §74731(i)","22 CCR §74731(b)","Cal. Health & Safety Code §1280.15(a)","Cal. Civ. Code §56.101"],"federalCitations":["45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §484.102(b)(4)"],"surveyorAsks":["Who is your security official? When did you last complete a security risk analysis?","How do staff log in to the electronic record in the field, and what happens if a tablet is lost?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (22 CCR §74731(i))","5. Security Official and Risk Analysis","6. Access Control","7. Audit Logs and Activity Review","8. Mobile Devices and Working in the Field","9. Office Workstations and Media","10. Email, Fax, and Transmission","11. Backups, Contingency Plan, and System Downtime","12. Security Incidents","13. Vendors","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"ca-hha","state":"California","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}