{"ref":"DC-HH-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Protects the Agency’s electronic patient information under the HIPAA Security Rule: a named security official, a written risk analysis and risk management plan, role-based access, unique logins, encryption of every device that holds patient information, audit log review, backup and disaster recovery, secure OASIS transmission, rules for phones and EVV devices in the field, and security incident response.","inShort":["Never share your password or log in for someone else. Every login is yours alone.","Keep your phone or tablet locked with a passcode and with you during visits.","Do not save patient information to a personal device, personal email, or a USB drive.","Do not open unexpected links or attachments, and never give your password by phone or email.","Report a lost device, a suspicious email you clicked, or anything strange on a system to the security official at once."],"primaryCitation":"45 CFR §§164.302-164.318","citations":["29 DCMR §5013.3","29 DCMR §4207.2","22-B DCMR §3910.1"],"federalCitations":["45 CFR §164.302","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §484.45(c)","42 CFR §484.102(b)(4)"],"surveyorAsks":["Show me your most recent security risk analysis and the risk management plan that came out of it.","Who is your security official?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.302-164.318)","5. Security Official and Governance","6. Risk Analysis and Risk Management","7. Workforce Access","8. Devices, Encryption, and Field Work","9. Email, Messaging, and Transmission","10. Audit Controls and Activity Review","11. Backup, Contingency, and Emergency Operations","12. Security Incidents","13. Office Security and Paper","14. Vendors","15. Responsibilities","16. Records and Compliance Monitoring","17. Staff Training","18. References","19. Related Policies and Forms","20. Approval","21. Revision History"],"version":"1.0","sample":false,"pack":"dc-hha","state":"Washington, DC","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}