{"ref":"LA-HH-PRV-02","title":"HIPAA Security and Electronic Records","category":"Privacy","summary":"Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic protected health information under the HIPAA Security Rule (45 CFR §§164.306 to 164.316): the security official, risk analysis and risk management, unique logins and electronic signatures that authenticate record entries under LAC 48:I §9129.A.2, mobile devices and encryption, audit controls, secure transmission (including OASIS transmission under 42 CFR §484.45(c)(2) if Medicare-certified), backups and downtime, security incidents, vendors, disposal, and documentation kept for six years.","inShort":["Use only your own login. Never share passwords or let anyone use your account.","Use only Agency-approved devices and apps for patient information.","Keep devices locked, with you or out of sight. Never leave one unlocked in a home.","Report a lost or stolen device, or a suspicious email you clicked, at once.","If the system is down, use downtime forms and enter them when it is back."],"primaryCitation":"45 CFR §164.308","citations":["LAC 48:I §9129.A.1","LAC 48:I §9129.A.2","LAC 48:I §9129.A.4","R.S. 40:1163.1","R.S. 51:3074"],"federalCitations":["45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.316","42 CFR §484.45(c)(2)","42 CFR §484.102(b)(4)"],"surveyorAsks":["When did you last complete a security risk analysis, and what did you do about the risks it found?","How does each nurse log in to the electronic record, and what stops two people from using the same login?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.308)","5. Security Official, Risk Analysis, and Risk Management","6. Access Control, Unique Logins, and Passwords","7. Electronic Signatures and Authentication of Record Entries","8. Mobile Devices, Encryption, and Working in the Field","9. Audit Controls and Information System Activity Review","10. Transmission Security: Email, Text, Fax, and OASIS","11. Contingency Plan, Backups, and Downtime","12. Security Awareness and Security Incidents","13. Business Associates and Vendors","14. Disposal and Re-use of Devices and Media","15. Responsibilities","16. Records and Compliance Monitoring","17. Staff Training","18. References","19. Related Policies and Forms","20. Approval","21. Revision History"],"version":"1.0","sample":false,"pack":"la-hha","state":"Louisiana","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}