HIPAA Security
Explains how the Agency keeps electronic client records safe: passwords, locked phones and computers, who has access, backups, and what staff do when a device is lost or something looks wrong, applying the HIPAA Security Rule and the Georgia duty to keep client records secure.
About this policy
- Policy number
- GA-HC-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR §§164.302-164.318
- Library
- Georgia home care · 49 policies
- Category
- Privacy
- Sections
- 19
In short
- Use client information only in the Agency's approved apps, never in personal texts, email or photos.
- Lock your phone with a PIN or fingerprint and never share your password or log-in.
- Do not open unexpected links or attachments.
- Report a lost or stolen phone, or a password someone else may know, to the office at once.
- Return every Agency device, key and badge on your last day.
What's inside
19 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §§164.302-164.318)
- 5. Risk Analysis and Risk Management
- 6. Security Measures
- 7. Phones, Computers, and Passwords
- 8. Security Incidents
- 9. Contingency Plan and Backup
- 10. Business Associates
- 11. Devices, Media, and Disposal
- 12. Staff Training
- 13. Responsibilities
- 14. Records and Compliance Monitoring
- 15. References
- 16. Related Policies and Forms
- 17. Approval
- 18. Revision History
An inspector may ask
- Show me your most recent security risk analysis and the plan that came out of it.
- How do you remove a caregiver's access to your scheduling and EVV apps when the caregiver leaves?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.