HIPAA Security
Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic protected health information under the HIPAA Security Rule (45 CFR Part 164, Subpart C): the Security Official, the yearly risk analysis and risk management plan, user accounts (including CHAMPS MILogin access and the EVV mobile application), passwords and multi-factor authentication, encryption of laptops, phones and email, mobile devices in the field, audit log review, security incident response, backups and the contingency plan, device and media disposal, business associates, and the yearly evaluation.
- Policy number
- MI-HH-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR Part 164, Subpart C
- Library
- Michigan home health · 57 policies
- Category
- Privacy
- Sections
- 23
In short
- Use only your own login. Never share passwords, and lock your screen whenever you step away.
- Use only Agency-approved, locked devices and apps for patient information, including the EVV app.
- Send patient information outside the Agency only by secure email or the secure messaging app, never by ordinary text.
- Take wound photos only in the approved app, never in your phone’s camera roll.
- Report a lost or stolen phone or laptop, or a suspicious email you opened, to the Security Official right away, and within one hour.
What's inside
23 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164, Subpart C)
- 5. Risk Analysis and Risk Management
- 6. User Accounts and Access
- 7. Passwords, Authentication and Screen Locks
- 8. Devices in the Field and the EVV Application
- 9. Email, Messaging, Fax and Telehealth
- 10. Malware, Updates and Activity Review
- 11. Security Incidents
- 12. Backups, Downtime and the Contingency Plan
- 13. Facility, Workstation, Device and Media Safeguards
- 14. Business Associates and Vendors
- 15. Yearly Evaluation and Documentation
- 16. Responsibilities
- 17. Records and Compliance Monitoring
- 18. Staff Training
- 19. References
- 20. Related Policies and Forms
- 21. Approval
- 22. Revision History
An inspector may ask
- Show me your most recent security risk analysis and the risk management plan that came out of it.
- Who is your security official, and how do you remove a former employee’s access to the EHR, EVV and CHAMPS?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.