Skip to content

HIPAA Security and Location of Electronic Health Records

Sets the administrative, physical, and technical safeguards the HIPAA Security Rule requires for electronic patient information, including the risk analysis, security official, access control, audit, device and media rules, contingency plan, and security incident response; meets Florida's rule that electronic records be authenticated, protected from unauthorized access, and able to be reconstructed after a system breakdown; and keeps all offsite and cloud storage of patient information in the continental United States, its territories, or Canada, as the licensee attests to AHCA.

Preview: full text with a package
About this policy
Policy number
FL-HH-PRV-02
Version
1.0
Main rule
45 CFR Part 164, Subpart C
Library
Florida home health · 57 policies
Category
Privacy
Sections
21

In short

  • Use only your own login. Never share your password or leave a device unlocked.
  • Keep patient information only on Agency-approved, encrypted devices and systems.
  • Send patient information only through the Agency's secure e-mail, portal, or app, never from a personal e-mail account.
  • Patient records stored off site must stay in the continental United States, its territories, or Canada.
  • Report a lost or stolen device, or anything suspicious on a computer, to the office at once.

What's inside

21 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR Part 164, Subpart C)
  • 5. Security Management
  • 6. Access Control
  • 7. Devices and Media
  • 8. Audit Controls, Integrity, and Transmission
  • 9. Location of Stored Records
  • 10. Contingency Plan and Reconstruction of Records
  • 11. Security Incidents
  • 12. Business Associates and Vendors
  • 13. Security Awareness
  • 14. Responsibilities
  • 15. Records and Compliance Monitoring
  • 16. Staff Training
  • 17. References
  • 18. Related Policies and Forms
  • 19. Approval
  • 20. Revision History

An inspector may ask

  • When did you last do a security risk analysis? Show me the risk management plan.
  • Where is your electronic health record stored? Is any patient information stored outside the United States or Canada?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in