{"ref":"FL-HC-PRV-02","title":"HIPAA Security and Electronic Records","category":"Privacy","summary":"Sets the administrative, physical and technical safeguards that protect electronic client information under the HIPAA Security Rule: the security official, risk analysis and risk management, workforce access, phones and computers, passwords, e-mail and messaging, electronic records and signatures, the Florida rule that client data stored offsite or in the cloud stays in the continental United States, its territories or Canada (with the licensure affidavit), security incidents, backup and contingency plans, disposal of devices, and six-year documentation.","inShort":["Use only your own login. Never share your password or EVV login with anyone, even a supervisor.","Keep your phone or tablet locked with a passcode, and keep its software up to date.","Do not take screenshots of client information or save it to your personal photos, e-mail or cloud.","If your phone or tablet is lost or stolen, call the office right away so it can be locked.","Never click links or open attachments in unexpected e-mails or texts asking for your password."],"primaryCitation":"45 CFR Part 164 Subpart C","citations":["s. 408.051(3), F.S.","s. 408.810(14), F.S.","Rule 59A-8.022(6)(b), F.A.C.","s. 501.171(2), (8), F.S."],"federalCitations":["45 CFR §§164.302-164.318","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316"],"surveyorAsks":["Where is your electronic client data stored, and how do you know it stays in the United States or Canada?","When did you last do a security risk analysis, and what did you change because of it?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164 Subpart C)","5. Security Official and Risk Analysis","6. Workforce Access","7. Phones, Tablets, and Computers","8. Passwords and Sign-In","9. E-mail, Messaging, and Fax","10. Electronic Records and Signatures","11. Where Client Data Is Stored and Vendors","12. Security Incidents, Backup, and Contingency Plan","13. Disposal and Re-use of Devices and Media","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"fl-hca","state":"Florida","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}