{"ref":"LA-HC-PRV-02","title":"HIPAA Security, Devices, and System Access","category":"Privacy","summary":"Sets out the HIPAA Security Rule safeguards the Agency uses for electronic client information: an annual risk analysis, a security official, role-based access with unique logins, no shared passwords (also an LDH EVV rule), rules for phones and tablets, encryption, backups, ending access when staff leave, security incident reporting and secure disposal.","inShort":["Your login is your signature: never share your password or log in as someone else, including in EVV.","Lock your phone with a passcode and keep client information only in Agency-approved apps.","Do not send client names or details by ordinary text message or personal email.","Report a lost or stolen phone, or a suspicious message you opened, to your supervisor the same day.","When you leave the Agency, sign out of all Agency apps and return any Agency device."],"primaryCitation":"45 CFR Part 164, Subpart C","citations":["LAC 48:I.5029.B.2","LAC 48:I.5031.D.6","Medicaid Services Manual, Chapter 30, §30.8","LDH EVV Policy and Procedures (OAAS-ADM-23-001 / OCDD-A-23-005)","La. R.S. 51:3074"],"federalCitations":["45 CFR Part 164, Subpart C","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316"],"surveyorAsks":["How do you protect client records kept electronically? When did you last do a security risk analysis?","Does each worker have a unique login to the EVV and scheduling systems? What happens to access when a worker leaves?"],"forms":[{"ref":"LA-HC-PRV-02-A","title":"Mobile Device and System Access Agreement"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart C)","5. Security Official, Risk Analysis and Risk Management","6. Access to Systems","7. Passwords and Logins","8. Phones and Tablets","9. Email, Messaging and Sending Information","10. Workstations and the Office","11. Protecting Systems and Data","12. Security Incidents","13. Disposal and Re-use of Devices and Media","14. Sanctions","15. Responsibilities","16. Records and Compliance Monitoring","17. Staff Training","18. References","19. Related Policies and Forms","20. Approval","21. Revision History"],"version":"1.0","sample":false,"pack":"la-hca","state":"Louisiana","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}