{"ref":"DC-HSP-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out how the Agency protects electronic patient information under the HIPAA Security Rule: the security official, risk analysis and risk management, workforce access, training, incident response, contingency planning, physical and device safeguards for staff who work in patients’ homes, technical controls, business associates and documentation.","inShort":["Use only your own login and keep your password secret.","Keep patient information in the electronic record app, not on the phone or a USB drive.","Keep devices with you or locked away. Never leave them in a car overnight.","Report a lost or stolen device to the security official the same day.","Do not click links or open attachments in e-mails you were not expecting."],"primaryCitation":"45 CFR Part 164, Subpart C","citations":["D.C. Code §28-3852"],"federalCitations":["45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["Who is your security official? When did you last complete a security risk analysis?","How are laptops, tablets and phones that hold patient information protected if they are lost or stolen?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart C)","5. Risk Analysis and Risk Management","6. Workforce Access","7. Devices Used in Patients’ Homes and on the Road","8. Physical Safeguards","9. Technical Safeguards","10. Security Incidents","11. Contingency Plan","12. Business Associates and Vendors","13. Evaluation and Documentation","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"dc-hospice","state":"Washington, DC","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}