HIPAA Security
Explains how the Agency keeps electronic patient information safe: the risk analysis, who has access, passwords and locked devices, the phones and tablets staff carry, backups and the emergency medical documentation system, business associate agreements, and what staff do when a device is lost or something looks wrong.
About this policy
- Policy number
- GA-HSP-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR Part 164 Subpart C
- Library
- Georgia hospice · 60 policies
- Category
- Privacy
- Sections
- 19
In short
- Use patient information only in approved Agency apps, never in personal texts or email.
- Lock your phone and tablet, and never share your password or log-in.
- Never leave a device in sight in your car or alone in a patient’s home.
- Report a lost or stolen device at once: (404) 555-0100, or after hours (404) 555-0199.
- If the system is down, the disaster coordinator has an offline copy of key patient information.
What's inside
19 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164 Subpart C)
- 5. Risk Analysis and Risk Management
- 6. Security Measures
- 7. Phones, Tablets, Computers and Passwords
- 8. Security Incidents
- 9. Contingency Plan, Backup and Emergency Documentation
- 10. Business Associates
- 11. Devices, Media and Disposal
- 12. Responsibilities
- 13. Records and Compliance Monitoring
- 14. Staff Training
- 15. References
- 16. Related Policies and Forms
- 17. Approval
- 18. Revision History
An inspector may ask
- Show me your most recent security risk analysis and the plan that came out of it.
- How do you remove a nurse’s access to the electronic record on the day she leaves?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.