{"ref":"NC-HSP-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out how the Agency protects electronic health information under the HIPAA Security Rule: a named Security Official, a written risk analysis and risk management plan, role-based EHR access with unique logins, rules for laptops, tablets and phones used in patients' homes, encryption, audit-log review, security incident response, backup and disaster recovery tied to the emergency plan, and six-year retention of security documentation.","inShort":["Use only your own login. Never share passwords, and lock the screen when you step away.","Keep Agency devices with you or locked out of sight. Never leave them in a patient's home, a facility or in view in your car.","Report a lost or stolen device to the Security Official at once, and within one hour of noticing, so it can be wiped.","Send patient information only through Agency-approved secure apps, never by ordinary text, personal email or your phone's photo roll.","Report any suspicious email you clicked or strange computer behavior right away.","If the EHR is down, use your offline care plan and medication list and call the on-call nurse."],"primaryCitation":"45 CFR §164.308","citations":["10A NCAC 13K .0902(c)","10A NCAC 13K .0504(b)(4)"],"federalCitations":["45 CFR §§164.302-164.318","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["Who is responsible for security of your electronic records? When did you last do a risk analysis?","How do you remove a former employee's access to the EHR, and how quickly?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.308)","5. Security Management","6. Workforce Access","7. Passwords, Logins and Phishing","8. Mobile Devices in Homes and Facilities","9. Physical Safeguards","10. Technical Safeguards","11. Security Incidents","12. Backup, Disaster Recovery and Emergency Mode","13. Business Associates and Vendors","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"nc-hospice","state":"North Carolina","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}