{"ref":"MI-HSP-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic patient information under the HIPAA Security Rule and the Michigan records rules: the security risk analysis, the Security Official, access control, devices used in the field, passwords and authentication, encryption, audit logs, backups and contingency plans, disposal of devices and media, and how security incidents are reported.","inShort":["Use only your own login. Never share passwords, and lock your screen when you step away.","Keep patient information only in Agency systems: not in personal texts, email, photos or cloud storage.","Keep devices with you or locked out of sight. Report a lost or stolen device to the Security Official at once.","Do not click links or attachments you did not expect. Report suspicious emails right away.","If the system is down, use the downtime copies and enter the information as soon as it is back."],"primaryCitation":"45 CFR Part 164, Subpart C","citations":["Mich. Admin. Code R 325.45203(2)","MCL 333.20175(3), (5)","Mich. Admin. Code R 325.45151(2)(b)","Mich. Admin. Code R 325.45153(2)(f)"],"federalCitations":["45 CFR Part 164, Subpart C","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["Show me your most recent security risk analysis and the plan that came out of it.","How do you take away a former employee's access to the electronic record, and how fast?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.306; Mich. Admin. Code R 325.45203(2))","5. Security Management","6. Workforce Access","7. Mobile Devices and Working in the Field","8. Technical Safeguards","9. Physical Safeguards","10. Contingency Plan","11. Business Associates and Vendors","12. Security Incidents","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"mi-hospice","state":"Michigan","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}