{"ref":"FL-HH-PRV-02","title":"HIPAA Security and Location of Electronic Health Records","category":"Privacy","summary":"Sets the administrative, physical, and technical safeguards the HIPAA Security Rule requires for electronic patient information, including the risk analysis, security official, access control, audit, device and media rules, contingency plan, and security incident response; meets Florida's rule that electronic records be authenticated, protected from unauthorized access, and able to be reconstructed after a system breakdown; and keeps all offsite and cloud storage of patient information in the continental United States, its territories, or Canada, as the licensee attests to AHCA.","inShort":["Use only your own login. Never share your password or leave a device unlocked.","Keep patient information only on Agency-approved, encrypted devices and systems.","Send patient information only through the Agency's secure e-mail, portal, or app, never from a personal e-mail account.","Patient records stored off site must stay in the continental United States, its territories, or Canada.","Report a lost or stolen device, or anything suspicious on a computer, to the office at once."],"primaryCitation":"45 CFR Part 164, Subpart C","citations":["s. 408.051(3), F.S.","s. 408.810(14), F.S.","Rule 59A-8.022(6)(b), F.A.C.","s. 501.171(2), F.S.","s. 501.171(8), F.S."],"federalCitations":["45 CFR Part 164, Subpart C","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §484.110(d)","42 CFR §484.102(b)(4)"],"surveyorAsks":["When did you last do a security risk analysis? Show me the risk management plan.","Where is your electronic health record stored? Is any patient information stored outside the United States or Canada?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart C)","5. Security Management","6. Access Control","7. Devices and Media","8. Audit Controls, Integrity, and Transmission","9. Location of Stored Records","10. Contingency Plan and Reconstruction of Records","11. Security Incidents","12. Business Associates and Vendors","13. Security Awareness","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"fl-hha","state":"Florida","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}