{"ref":"MI-HC-PRV-02","title":"HIPAA Security and Mobile Devices","category":"Privacy","summary":"Sets the HIPAA Security Rule program that protects clients' electronic information in the Agency's scheduling, billing and EVV systems and on phones, tablets and laptops: an assigned security official, a written risk analysis and risk management plan, workforce access controls and unique logins, security awareness training, incident response, backup and contingency plans, business associate agreements, physical and technical safeguards, and the rules every worker follows when using a personal or Agency phone for the EVV mobile application.","inShort":["Lock your phone with a passcode and keep the EVV app up to date.","Use only the EVV app and Agency channels for client information. No personal texts or photos.","Never share your login or let anyone else use your device for work.","If you work offline, connect to the internet by the end of the same day.","Lost your phone? Tell the office the same day so your EVV access can be shut off."],"primaryCitation":"45 CFR §164.308","citations":["MPM Electronic Visit Verification §2.3.A","MPM Electronic Visit Verification §2.1","MPM MI Choice Waiver §9.7","MPM Home Help §8.6"],"federalCitations":["45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316"],"surveyorAsks":["When did you last do a security risk analysis? Show me the risk management plan that came out of it.","How do you remove a worker's access to the EVV system on the day she leaves?"],"forms":[{"ref":"MI-HC-PRV-02-A","title":"Mobile Device and EVV App Agreement"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.308)","5. Risk Analysis and Risk Management","6. Access Control: Who Can Get In","7. Phones, Tablets and the EVV Mobile Application","8. Office and Physical Safeguards","9. Security Awareness Training","10. Security Incidents","11. Backup and Contingency Plan","12. Business Associates and Vendors","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"mi-hca","state":"Michigan","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}