HIPAA Security
Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic patient information under the HIPAA Security Rule: the security official, risk analysis and risk management, workforce access, point-of-care devices and passwords, audit controls, transmission security, OASIS transmission, security incidents, contingency planning and backup, business associates, and six-year documentation.
About this policy
- Policy number
- MO-HH-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR §164.308
- Library
- Missouri home health · 57 policies
- Category
- Privacy
- Sections
- 20
In short
- Use only your own login and never share your password.
- Keep your tablet or phone locked, encrypted and with you. Never leave it visible in a car.
- Send patient information only through the record system or secure messaging.
- Report a lost or stolen device at once, even after hours, at (573) 555-0199.
- Watch for phishing. Do not click links or open attachments you did not expect.
What's inside
20 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164, Subpart C)
- 5. Risk Analysis and Risk Management
- 6. Workforce Access
- 7. Point-of-Care Devices, Passwords, and Email
- 8. Technical and Physical Safeguards
- 9. OASIS Transmission and EVV
- 10. Security Incidents
- 11. Contingency Plan and Backup
- 12. Business Associates
- 13. Responsibilities
- 14. Records and Compliance Monitoring
- 15. Staff Training
- 16. References
- 17. Related Policies and Forms
- 18. Approval
- 19. Revision History
An inspector may ask
- When did you last complete a security risk analysis, and what did you do about the risks you found?
- How do you protect the tablets and phones clinicians take into homes?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.