{"ref":"PA-HH-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out how the Agency protects electronic patient information under the HIPAA Security Rule: a named security official, a documented risk analysis and risk management plan, safeguards for laptops, tablets and phones used in patients’ homes, access controls, audit review, backup and contingency plans, business associate agreements, and secure OASIS transmission, supporting the Pennsylvania duty to safeguard clinical record information \"against loss or unauthorized use\" (28 Pa. Code §601.36(c)).","inShort":["Use only Agency-approved devices and apps for patient information. Never use personal email or ordinary text messages.","Lock your tablet or phone whenever it is out of your hands, and never share your password or log-in.","Keep devices and paper out of sight and locked in the car, and never leave them in the car overnight.","Report a lost or stolen device, or a suspicious email you clicked, to the office at once.","If the system is down, use the printed patient list and downtime forms and enter the notes later."],"primaryCitation":"45 CFR §§164.302-164.318","citations":["28 Pa. Code §601.36(c)"],"federalCitations":["45 CFR §164.302","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §484.45(c)","42 CFR §484.102(b)(4)"],"surveyorAsks":["When did you last complete a security risk analysis, and what did it find?","What happens if a nurse loses a tablet with patient records on it?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.302-164.318)","5. Risk Analysis and Risk Management","6. Administrative Safeguards","7. Point-of-Care Devices, Computers, and Passwords","8. Technical and Physical Safeguards","9. OASIS Transmission","10. Security Incidents","11. Contingency Plan and Backup","12. Responsibilities","13. Records and Compliance Monitoring","14. Staff Training","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"pa-hha","state":"Pennsylvania","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}