Skip to content

HIPAA Security

Protects the Agency's electronic patient information under the HIPAA Security Rule and California's electronic health record rules: a written risk analysis and risk management plan, a named security official, access levels and prompt removal of access, unique identifiers, encryption of phones, tablets and laptops used in homes, audit logs, backups at least every 24 hours, a contingency and downtime plan, security incident response, business associate safeguards and safe disposal of devices.

Preview: full text with a package
About this policy
Policy number
CA-HSP-PRV-02
Version
1.0
Main rule
45 CFR Part 164, Subpart C
Library
California hospice · 60 policies
Category
Privacy
Sections
20

In short

  • Use only Agency devices or approved apps for patient information. Never text patient details from a personal phone.
  • Keep your device locked with a passcode and never leave it unattended in a home, facility or car.
  • Never share your password or login, and log off when you step away.
  • If a device is lost or stolen, call the on-call manager at once, day or night, so it can be wiped.
  • Report suspicious e-mails or anything odd in the system to the security official right away.

What's inside

20 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR Part 164, Subpart C; 22 CCR §74900)
  • 5. Risk Analysis and Risk Management (45 CFR §164.308(a)(1))
  • 6. Access to Systems (45 CFR §§164.308(a)(3)-(4), 164.312(a); 22 CCR §74900(a)(1))
  • 7. Phones, Tablets and Laptops in the Field
  • 8. Physical Safeguards (45 CFR §164.310)
  • 9. Technical Safeguards and the EHR (45 CFR §164.312; 22 CCR §74900)
  • 10. Contingency Plan, Backups and Downtime (45 CFR §164.308(a)(7); 22 CCR §74900(a)(3), (a)(5))
  • 11. Security Incidents (45 CFR §164.308(a)(6))
  • 12. Business Associates and Vendors (45 CFR §§164.308(b), 164.314)
  • 13. Responsibilities
  • 14. Records and Compliance Monitoring
  • 15. Staff Training
  • 16. References
  • 17. Related Policies and Forms
  • 18. Approval
  • 19. Revision History

An inspector may ask

  • Show me your most recent security risk analysis and what you did about the risks it found.
  • How do you make sure a nurse who leaves the Agency can no longer get into the EHR?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in