{"ref":"GA-HC-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Explains how the Agency keeps electronic client records safe: passwords, locked phones and computers, who has access, backups, and what staff do when a device is lost or something looks wrong, applying the HIPAA Security Rule and the Georgia duty to keep client records secure.","inShort":["Use client information only in the Agency's approved apps, never in personal texts, email or photos.","Lock your phone with a PIN or fingerprint and never share your password or log-in.","Do not open unexpected links or attachments.","Report a lost or stolen phone, or a password someone else may know, to the office at once.","Return every Agency device, key and badge on your last day."],"primaryCitation":"45 CFR §§164.302-164.318","citations":["Ga. Comp. R. & Regs. 111-8-65-.09(4)(b)"],"federalCitations":["45 CFR §§164.302-164.318","45 CFR §164.304","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316"],"surveyorAsks":["Show me your most recent security risk analysis and the plan that came out of it.","How do you remove a caregiver's access to your scheduling and EVV apps when the caregiver leaves?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.302-164.318)","5. Risk Analysis and Risk Management","6. Security Measures","7. Phones, Computers, and Passwords","8. Security Incidents","9. Contingency Plan and Backup","10. Business Associates","11. Devices, Media, and Disposal","12. Staff Training","13. Responsibilities","14. Records and Compliance Monitoring","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"ga-phc","state":"Georgia","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}