{"ref":"OH-HSP-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets the administrative, physical and technical safeguards the Agency uses to protect electronic protected health information under the HIPAA Security Rule (45 CFR Part 164 Subpart C): the security official, risk analysis and risk management, workforce access, mobile devices used in patients' homes, email and texting, facility and device controls, audit logs, security incidents, the contingency plan, vendors and documentation, together with the Ohio electronic signature requirements of ORC 3701.75 and OAC 3701-19-23(E).","inShort":["Use only Agency devices or the approved app for patient information, and keep them locked with a PIN or password.","Never send patient information by ordinary text message or personal email.","Keep your device with you or locked out of sight in your vehicle; never leave it in a patient's home.","Report a lost or stolen device within one hour so it can be wiped.","Lock your screen when you step away and log off when you finish."],"primaryCitation":"45 CFR Part 164 Subpart C","citations":["OAC 3701-19-23(D)-(E)","ORC 3701.75","ORC 3798.03(A)(2)"],"federalCitations":["45 CFR §164.302-318","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["When did you last complete a security risk analysis, and what did you do about the risks it found?","What happens to a nurse's access to the electronic record on the day she leaves?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164 Subpart C; OAC 3701-19-23(D)-(E))","5. Security Official","6. Risk Analysis and Risk Management","7. Workforce Access","8. Devices Used in the Field","9. Email, Texting, Fax and Telehealth","10. Physical Safeguards","11. Technical Safeguards","12. Security Incidents","13. Contingency Plan","14. Vendors and Business Associates","15. Evaluation","16. Responsibilities","17. Records and Compliance Monitoring","18. Staff Training","19. References","20. Related Policies and Forms","21. Approval","22. Revision History"],"version":"1.0","sample":false,"pack":"oh-hospice","state":"Ohio","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}