{"ref":"OH-HC-PRV-02","title":"Information Security, Devices, and Electronic Records","category":"Privacy","summary":"Sets how the Agency protects electronic client information and the devices that hold it: the security official, a written risk analysis, unique logins and strong passwords, automatic lock and encryption, rules for Agency and personal phones used for EVV and visit notes, electronic signatures that meet ORC 3701.75, email and texting, backups and an emergency plan for systems, device loss, disposal, and reporting security incidents.","inShort":["Use only your own login. Never share a password or let anyone use your EVV account.","Keep a screen lock on any phone you use for work, and keep client information only in the approved apps.","Do not text client names or health details on personal apps, and do not take photos of clients or their papers.","If your phone is lost or stolen, or you clicked a suspicious link, call the office right away.","Sign the device agreement before you use a phone or tablet for Agency work."],"primaryCitation":"45 CFR §164.308","citations":["ORC 3701.75","ORC 1349.19","OAC 173-39-01(B)","OAC 173-39-02(B)(4)","OAC 5160-32-02(B)(1)","OAC 5160-44-31(B)(12)"],"federalCitations":["45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316"],"surveyorAsks":["Who is responsible for information security, and when did you last complete a risk analysis?","If an aide uses her own phone for EVV, what protects client information on it?"],"forms":[{"ref":"OH-HC-PRV-02-A","title":"Device and System Access Agreement"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.308)","5. Risk Analysis and Risk Management","6. User Access, Logins and Passwords","7. Agency Devices and Office Computers","8. Personal Phones Used for EVV and Visit Notes","9. Electronic Signatures","10. Email, Texting, Fax and Printing","11. Backups, System Failures and Emergencies","12. Disposal and Re-Use of Devices and Media","13. Reporting and Responding to Security Incidents","14. Sanctions","15. Responsibilities","16. Records and Compliance Monitoring","17. Staff Training","18. References","19. Related Policies and Forms","20. Approval","21. Revision History"],"version":"1.0","sample":false,"pack":"oh-hca","state":"Ohio","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}