{"ref":"MO-HC-PRV-02","title":"HIPAA Security, Devices, and Electronic Records","category":"Privacy","summary":"How the Agency protects electronic participant information under the HIPAA Security Rule and its business associate duties to the state agency: the security official, the annual risk analysis, administrative, physical and technical safeguards, encryption of portable devices and transmissions, rules for phones and the EVV application, e-mail, text and fax, backups and system outages, security incidents, and documentation.","inShort":["Lock your phone with a PIN, password or fingerprint, and keep the automatic screen lock on.","Never share your EVV log-in or let anyone else record a visit for you.","Keep participant information only in the EVV app and Agency systems, not in your personal notes, photos or messages.","If your phone is lost or stolen, call the office immediately, and before your next visit.","Do not open links or attachments you do not expect. Report anything suspicious to the office."],"primaryCitation":"45 CFR §164.308","citations":["MMAC In-Home Services Program Requirements 6.3.b, 6.3.c, 6.3.d, 6.3.i","13 CSR 70-3.320(2)(F), (G)","13 CSR 70-3.320(3)(I), (K), (M)7","19 CSR 15-7.021(24)","RSMo 407.1500.1(4)"],"federalCitations":["45 CFR §§164.302 to 164.318","45 CFR §164.304","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316"],"surveyorAsks":["When did you last do a security risk analysis, and what did you change because of it?","Show me how a worker's access to the EVV system is removed when the worker leaves."],"forms":[{"ref":"MO-HC-PRV-02-A","title":"Device and System Access Agreement"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.308)","5. Security Official and Risk Analysis","6. Administrative Safeguards","7. Physical Safeguards","8. Technical Safeguards","9. Phones, the EVV Application and Personal Devices","10. E-mail, Text, Fax and Paper Outside the Office","11. Backups, Outages and Emergency Mode","12. Security Incidents","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"mo-hca","state":"Missouri","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}