Skip to content

HIPAA Security and Electronic Health Records

Sets how the Agency protects electronic patient information under the HIPAA Security Rule and Florida law: the security official, annual risk analysis, access controls, encryption of laptops, tablets and phones, secure messaging, audit logs, backups and downtime procedures, business associate safeguards, the Florida rule that offsite and cloud storage stay in the continental United States, its territories or Canada (s. 408.051(3), F.S.) with the affidavit at each license application, and safe disposal.

Preview: full text with a package
About this policy
Policy number
FL-HSP-PRV-02
Version
1.0
Main rule
45 CFR Part 164 Subpart C
Library
Florida hospice · 60 policies
Category
Privacy
Sections
19

In short

  • Never share your log-in. Lock your screen when you step away.
  • Use only Agency-approved devices and apps for patient information, and send it only by secure messaging or the health record.
  • Never leave a laptop, tablet or phone in your car or in a patient’s home.
  • Report a lost or stolen device at once so it can be wiped.
  • If the system is down, use the paper downtime forms and enter them later.
  • Report suspicious emails and anything odd on your device to the security official right away.

What's inside

19 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR Part 164 Subpart C; s. 408.051(3), F.S.)
  • 5. Risk Analysis and Risk Management
  • 6. Access Controls
  • 7. Devices, Messaging and Working in the Field
  • 8. Physical Safeguards
  • 9. Offsite Storage, Cloud Services and Business Associates
  • 10. Contingency Plan, Backups and Downtime
  • 11. Security Incidents
  • 12. Responsibilities
  • 13. Records and Compliance Monitoring
  • 14. Staff Training
  • 15. References
  • 16. Related Policies and Forms
  • 17. Approval
  • 18. Revision History

An inspector may ask

  • Who is your security official? When did you last complete a security risk analysis?
  • How are field staff devices protected if they are lost or stolen?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in