{"ref":"LA-HSP-PRV-02","title":"HIPAA Security and Electronic Records","category":"Privacy","summary":"Sets out how the Agency protects electronic patient information under the HIPAA Security Rule and Louisiana’s rule that electronic clinical records be password protected: the Security Official, annual risk analysis, workforce access, passwords and encrypted devices, secure email and messaging, physical and technical safeguards, backups and downtime procedures, security incidents and vendors.","inShort":["Use only your own log-in. Never share a password or let anyone use your device while you are signed in.","Lock your screen whenever you step away. Agency phones, tablets and laptops that hold patient information are encrypted.","Send patient information only from Agency accounts and the Agency’s secure messaging app. Never use ordinary texts, personal email or personal cloud storage.","Check a fax number before you send, and use the cover sheet.","If a device is lost or stolen, or you click a suspicious link, tell the Security Official at once."],"primaryCitation":"45 CFR Part 164, Subpart C","citations":["LAC 48:I §8233.E","LAC 48:I §8233.K","R.S. 51:3074(A)-(B)"],"federalCitations":["45 CFR Part 164, Subpart C","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["How are your electronic clinical records password protected, and does each staff member have a unique log-in?","Show me your most recent security risk analysis and what you have done about the risks it found."],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart C)","5. Security Management","6. Workforce Access","7. Passwords, Log-in and Devices","8. Email, Texting, Fax and Cloud Services","9. Physical Safeguards","10. Technical Safeguards","11. Contingency Plan and Downtime","12. Security Incidents","13. Business Associates and Vendors","14. Changes Under Consideration","15. Responsibilities","16. Records and Compliance Monitoring","17. Staff Training","18. References","19. Related Policies and Forms","20. Approval","21. Revision History"],"version":"1.0","sample":false,"pack":"la-hospice","state":"Louisiana","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}