{"ref":"MO-HSP-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out how the Agency protects electronic patient information under the HIPAA Security Rule: the security official, the yearly risk analysis and risk management plan, administrative, physical and technical safeguards, rules for phones, tablets and laptops used in homes and facilities, security incidents, backups and the contingency plan that keeps records available in an emergency, business associates, device disposal and documentation. It also meets the Missouri duty to safeguard the clinical record against loss, destruction and unauthorized use.","inShort":["Use only your own log-in and never share passwords or codes.","Keep Agency phones, tablets and laptops locked, encrypted and with you. Never leave them in view in a car.","Send patient information only through the record system, secure messaging or encrypted email.","Report a lost device, a suspicious email you clicked or anything odd in the system at once.","Know the downtime plan: how to see your patients' medications and plan of care if the system is down."],"primaryCitation":"45 CFR Part 164, Subpart C","citations":["19 CSR 30-35.010(2)(K)6","19 CSR 30-35.010(1)(J)2"],"federalCitations":["45 CFR §§164.302-164.318","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["When did you last complete a security risk analysis, and what did you change because of it?","What happens if a nurse loses a tablet with patient records on it?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart C)","5. Risk Analysis and Risk Management","6. Administrative Safeguards (45 CFR §164.308)","7. Physical Safeguards (45 CFR §164.310)","8. Technical Safeguards and Mobile Devices (45 CFR §164.312)","9. Security Incidents","10. Contingency Plan, Backups and Emergency Documentation","11. Business Associates","12. Staff Training","13. Responsibilities","14. Records and Compliance Monitoring","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"mo-hospice","state":"Missouri","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}