{"ref":"NC-HC-PRV-02","title":"HIPAA Security and Use of Mobile Devices","category":"Privacy","summary":"Sets out how the Agency protects client information held electronically, as the HIPAA Security Rule requires: a named security official, a written risk analysis and risk management plan, role-based access with unique logins, prompt removal of access, security training, incident response, backup and emergency access, business associate agreements, and physical and technical safeguards. It sets clear rules for the phones and tablets workers use for EVV, scheduling and messages, including screen locks, approved apps only, no client information in personal texts, photos or social media, and reporting a lost device at once.","inShort":["Use only Agency-approved apps for client information, including the EVV app.","Lock your phone with a PIN or fingerprint, and keep it updated.","Never put client names, details or photos in personal texts, email, your photo gallery or social media.","Never share your login or use someone else's.","Report a lost or stolen phone to the office right away, and no later than one hour after you notice."],"primaryCitation":"45 CFR Part 164 Subpart C","citations":["10A NCAC 13J .1001(a)(10)","10A NCAC 13J .1401(c)","NC Medicaid Clinical Coverage Policy 3L, §7.4"],"federalCitations":["45 CFR Part 164 Subpart C","45 CFR §164.304","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","45 CFR §164.502(e)","45 CFR §164.504(e)"],"surveyorAsks":["Who is your security official, and when did you last complete a security risk analysis?","How do aides use their phones for EVV, and what stops client information being stored on a personal phone?"],"forms":[{"ref":"NC-HC-PRV-02-A","title":"Mobile Device and System Access Agreement"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164 Subpart C)","5. Security Management and Risk Analysis","6. Access to Systems","7. Phones, Tablets, and the EVV Application","8. Email, Fax, Messaging, and the Office","9. Backup, Devices and Media, and Disposal","10. Vendors and Business Associates","11. Security Incidents","12. Responsibilities","13. Records and Compliance Monitoring","14. Staff Training","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"nc-hca","state":"North Carolina","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}