{"ref":"MO-HH-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic patient information under the HIPAA Security Rule: the security official, risk analysis and risk management, workforce access, point-of-care devices and passwords, audit controls, transmission security, OASIS transmission, security incidents, contingency planning and backup, business associates, and six-year documentation.","inShort":["Use only your own login and never share your password.","Keep your tablet or phone locked, encrypted and with you. Never leave it visible in a car.","Send patient information only through the record system or secure messaging.","Report a lost or stolen device at once, even after hours, at (573) 555-0199.","Watch for phishing. Do not click links or open attachments you did not expect."],"primaryCitation":"45 CFR §164.308","citations":["19 CSR 30-26.010(1)(A)","13 CSR 70-3.030(3)(A)16","13 CSR 70-3.320"],"federalCitations":["45 CFR Part 164, Subpart C","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §484.45(c)(2)","42 CFR §484.102(b)(4)","42 CFR §484.110(d)"],"surveyorAsks":["When did you last complete a security risk analysis, and what did you do about the risks you found?","How do you protect the tablets and phones clinicians take into homes?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart C)","5. Risk Analysis and Risk Management","6. Workforce Access","7. Point-of-Care Devices, Passwords, and Email","8. Technical and Physical Safeguards","9. OASIS Transmission and EVV","10. Security Incidents","11. Contingency Plan and Backup","12. Business Associates","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"mo-hha","state":"Missouri","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}