{"ref":"PA-HC-PRV-02","title":"HIPAA Security and Use of Mobile Devices","category":"Privacy","summary":"Protects the Agency’s electronic consumer information, including the scheduling, EVV and records systems that direct care workers reach from phones and tablets: a named security official, a written risk analysis reviewed each year, unique logins, strong passwords and multi-factor authentication, encryption, locked and wiped mobile devices, security incident reporting, backups and a contingency plan, and signed device and system user agreements.","inShort":["Use only your own login. Never share your password or codes.","Keep your phone locked and updated, and use only the Agency’s approved apps for consumer information.","Do not keep consumer photos, notes or documents in your phone’s gallery, notes or downloads.","Report a lost or stolen phone, or a suspicious message, to the office at once so access can be shut off.","When you leave the Agency, delete the Agency apps and return any Agency devices."],"primaryCitation":"45 CFR §164.308","citations":["55 Pa. Code §52.15(b)","55 Pa. Code §52.15(c)","73 P.S. §2305.1","73 P.S. §2305.2"],"federalCitations":["45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316"],"surveyorAsks":["When did you last complete your HIPAA security risk analysis, and what did you change because of it?","How do direct care workers log in to the EVV application on their phones? What happens if a phone is lost?"],"forms":[{"ref":"PA-HC-PRV-02-A","title":"Device and Electronic Visit System User Agreement"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.308)","5. Risk Analysis and Risk Management","6. Access Control","7. Phones, Tablets, and the EVV Application","8. Encryption, Email, and Transmission","9. Physical Safeguards","10. Security Incidents","11. Backup and Contingency Plan","12. Responsibilities","13. Records and Compliance Monitoring","14. Staff Training","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"pa-hca","state":"Pennsylvania","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}