{"ref":"MI-HH-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic protected health information under the HIPAA Security Rule (45 CFR Part 164, Subpart C): the Security Official, the yearly risk analysis and risk management plan, user accounts (including CHAMPS MILogin access and the EVV mobile application), passwords and multi-factor authentication, encryption of laptops, phones and email, mobile devices in the field, audit log review, security incident response, backups and the contingency plan, device and media disposal, business associates, and the yearly evaluation.","inShort":["Use only your own login. Never share passwords, and lock your screen whenever you step away.","Use only Agency-approved, locked devices and apps for patient information, including the EVV app.","Send patient information outside the Agency only by secure email or the secure messaging app, never by ordinary text.","Take wound photos only in the approved app, never in your phone’s camera roll.","Report a lost or stolen phone or laptop, or a suspicious email you opened, to the Security Official right away, and within one hour."],"primaryCitation":"45 CFR Part 164, Subpart C","citations":["Michigan Medicaid Provider Manual, General Information for Providers, Section 4.1","Michigan Medicaid Provider Manual, Electronic Visit Verification, Section 2.3.A"],"federalCitations":["45 CFR §§164.302 to 164.318","45 CFR §164.304","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §484.110(d)","42 CFR §484.45(c)(2)","42 CFR §484.102(b)(4)"],"surveyorAsks":["Show me your most recent security risk analysis and the risk management plan that came out of it.","Who is your security official, and how do you remove a former employee’s access to the EHR, EVV and CHAMPS?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart C)","5. Risk Analysis and Risk Management","6. User Accounts and Access","7. Passwords, Authentication and Screen Locks","8. Devices in the Field and the EVV Application","9. Email, Messaging, Fax and Telehealth","10. Malware, Updates and Activity Review","11. Security Incidents","12. Backups, Downtime and the Contingency Plan","13. Facility, Workstation, Device and Media Safeguards","14. Business Associates and Vendors","15. Yearly Evaluation and Documentation","16. Responsibilities","17. Records and Compliance Monitoring","18. Staff Training","19. References","20. Related Policies and Forms","21. Approval","22. Revision History"],"version":"1.0","sample":false,"pack":"mi-hha","state":"Michigan","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}