{"ref":"NC-HH-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic patient and employee information under the HIPAA Security Rule, with particular rules for the laptops, tablets and phones clinicians carry into homes (including electronic visit verification apps), OASIS transmission, security incidents, backup and contingency planning, business associates and disposal of devices.","inShort":["Use patient information only in the Agency’s approved apps: the electronic record, OASIS software, scheduling and EVV. Never in personal texts, personal email or personal cloud storage.","Lock every device with a PIN, password or fingerprint. Use only your own log-in and never let anyone else use a device while you are signed in.","Keep devices with you or out of sight. Never leave one in a patient’s home or where it can be seen in your car.","Use public Wi-Fi only through the Agency’s secure connection; otherwise use cellular data or work offline in the approved app.","Report a lost or stolen device, or a password someone else may know, at once: (919) 555-0100, or after hours (919) 555-0199.","Return every Agency device, key and badge on your last day."],"primaryCitation":"45 CFR §164.308","citations":["10A NCAC 13J .1401(c)","10A NCAC 13J .1001(a)(10)","G.S. 75-65","NC Medicaid Clinical Coverage Policy 3A"],"federalCitations":["45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","45 CFR §164.304","42 CFR §484.45(c)","42 CFR §484.102(b)(4)","42 CFR §484.110(d)"],"surveyorAsks":["When did you last do a security risk analysis, and what did you change because of it?","A nurse’s tablet was stolen from her car. Walk me through what happens."],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.302 to 164.318; 10A NCAC 13J .1401(c))","5. Risk Analysis and Risk Management","6. Security Measures","7. Laptops, Tablets, Phones and Passwords","8. OASIS Transmission","9. Security Incidents","10. Contingency Plan and Backup","11. Business Associates","12. Devices, Media and Disposal","13. Security Training and Reminders","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"nc-hha","state":"North Carolina","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}