{"ref":"PA-HSP-PRV-02","title":"HIPAA Security","category":"Privacy","summary":"Sets out how the Agency protects electronic patient information on the record system, phones, tablets and laptops that staff carry into homes and facilities: the security official, risk analysis, the security measures register, device and password rules, incident response, backups and downtime, business associates, and disposal.","inShort":["Use patient information only in the Agency's approved apps and systems. Never in personal texts, personal email or personal cloud storage.","Lock your phone, tablet and laptop, use only your own log-in, and never share your password.","Do not save patient photos, documents or screenshots to your device.","Never leave a device in sight in your car or unattended in a home or facility.","Report a lost or stolen device, a suspicious email you clicked, or a password someone may know at once to (717) 555-0100 or after hours to (717) 555-0199."],"primaryCitation":"45 CFR Part 164 Subpart C","citations":["73 P.S. §2301 et seq.","35 P.S. §448.806(g)(2)"],"federalCitations":["45 CFR Part 164 Subpart C","45 CFR §164.304","45 CFR §164.306","45 CFR §164.308","45 CFR §164.310","45 CFR §164.312","45 CFR §164.314","45 CFR §164.316","42 CFR §418.104(c)","42 CFR §418.113(b)(3)"],"surveyorAsks":["Who is your security official? When did you last complete a security risk analysis?","A nurse loses a tablet. What happens next?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164 Subpart C)","5. Risk Analysis and Risk Management","6. Security Measures Register","7. Phones, Tablets, Computers and Passwords","8. Security Incidents","9. Contingency Plan, Backup and Downtime","10. Business Associates","11. Devices, Media and Disposal","12. Responsibilities","13. Records and Compliance Monitoring","14. Staff Training","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"pa-hospice","state":"Pennsylvania","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}