Skip to content

HIPAA Security, Devices, and System Access

Sets out the HIPAA Security Rule safeguards the Agency uses for electronic client information: an annual risk analysis, a security official, role-based access with unique logins, no shared passwords (also an LDH EVV rule), rules for phones and tablets, encryption, backups, ending access when staff leave, security incident reporting and secure disposal.

Preview: full text with a package
About this policy
Policy number
LA-HC-PRV-02
Version
1.0
Main rule
45 CFR Part 164, Subpart C
Library
Louisiana home care · 50 policies
Category
Privacy
Sections
22

In short

  • Your login is your signature: never share your password or log in as someone else, including in EVV.
  • Lock your phone with a passcode and keep client information only in Agency-approved apps.
  • Do not send client names or details by ordinary text message or personal email.
  • Report a lost or stolen phone, or a suspicious message you opened, to your supervisor the same day.
  • When you leave the Agency, sign out of all Agency apps and return any Agency device.

What's inside

22 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR Part 164, Subpart C)
  • 5. Security Official, Risk Analysis and Risk Management
  • 6. Access to Systems
  • 7. Passwords and Logins
  • 8. Phones and Tablets
  • 9. Email, Messaging and Sending Information
  • 10. Workstations and the Office
  • 11. Protecting Systems and Data
  • 12. Security Incidents
  • 13. Disposal and Re-use of Devices and Media
  • 14. Sanctions
  • 15. Responsibilities
  • 16. Records and Compliance Monitoring
  • 17. Staff Training
  • 18. References
  • 19. Related Policies and Forms
  • 20. Approval
  • 21. Revision History

An inspector may ask

  • How do you protect client records kept electronically? When did you last do a security risk analysis?
  • Does each worker have a unique login to the EVV and scheduling systems? What happens to access when a worker leaves?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in