{"ref":"FL-HSP-PRV-02","title":"HIPAA Security and Electronic Health Records","category":"Privacy","summary":"Sets how the Agency protects electronic patient information under the HIPAA Security Rule and Florida law: the security official, annual risk analysis, access controls, encryption of laptops, tablets and phones, secure messaging, audit logs, backups and downtime procedures, business associate safeguards, the Florida rule that offsite and cloud storage stay in the continental United States, its territories or Canada (s. 408.051(3), F.S.) with the affidavit at each license application, and safe disposal.","inShort":["Never share your log-in. Lock your screen when you step away.","Use only Agency-approved devices and apps for patient information, and send it only by secure messaging or the health record.","Never leave a laptop, tablet or phone in your car or in a patient’s home.","Report a lost or stolen device at once so it can be wiped.","If the system is down, use the paper downtime forms and enter them later.","Report suspicious emails and anything odd on your device to the security official right away."],"primaryCitation":"45 CFR Part 164 Subpart C","citations":["s. 408.051(3)-(4), F.S.","s. 408.810(14), F.S.","s. 501.171(2), (8), F.S.","Rule 59A-38.006(5)(f), F.A.C."],"federalCitations":["45 CFR Part 164 Subpart C","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["Who is your security official? When did you last complete a security risk analysis?","How are field staff devices protected if they are lost or stolen?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164 Subpart C; s. 408.051(3), F.S.)","5. Risk Analysis and Risk Management","6. Access Controls","7. Devices, Messaging and Working in the Field","8. Physical Safeguards","9. Offsite Storage, Cloud Services and Business Associates","10. Contingency Plan, Backups and Downtime","11. Security Incidents","12. Responsibilities","13. Records and Compliance Monitoring","14. Staff Training","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"fl-hospice","state":"Florida","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}