{"ref":"OH-HH-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Puts in place the HIPAA Security Rule’s administrative, physical and technical safeguards for electronic patient information, with particular attention to the laptops, tablets and phones clinicians carry into patients’ homes and the electronic visit verification apps Ohio Medicaid requires: risk analysis and risk management, access control, device rules, encryption, OASIS transmission, security incidents, backup and contingency planning, business associates and disposal.","inShort":["Use patient information only in the Agency’s approved apps, never in personal texts, email or cloud storage.","Lock your device every time it leaves your hand, and never share your password or let anyone use your log-in.","Check in and out on the visit verification app only for your own visits.","Keep devices with you or out of sight in the home and car, and never use public Wi-Fi without the Agency’s secure connection.","Report a lost device, a shared password or a suspicious email to the office at once, day or night."],"primaryCitation":"45 CFR §164.308","citations":["OAC 5160-1-17.2(K)","OAC 5160-32-02"],"federalCitations":["45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.316","45 CFR §164.402","42 CFR §484.45(c)(2)","42 CFR §484.102(b)(4)","42 CFR §484.110(d)"],"surveyorAsks":["Who is your Security Official? Show me your most recent risk analysis and your risk management plan.","How do you control which staff can see which patients’ records, and how quickly is access removed when someone leaves?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.308)","5. Risk Analysis and Risk Management","6. Security Measures","7. Point-of-Care Devices, Computers, and Passwords","8. OASIS Transmission","9. Security Incidents","10. Contingency Plan and Backup","11. Business Associates","12. Devices, Media, and Disposal","13. Security Training and Reminders","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"oh-hha","state":"Ohio","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}