HIPAA Security and Use of Mobile Devices
Sets out how the Agency protects client information held electronically, as the HIPAA Security Rule requires: a named security official, a written risk analysis and risk management plan, role-based access with unique logins, prompt removal of access, security training, incident response, backup and emergency access, business associate agreements, and physical and technical safeguards. It sets clear rules for the phones and tablets workers use for EVV, scheduling and messages, including screen locks, approved apps only, no client information in personal texts, photos or social media, and reporting a lost device at once.
- Policy number
- NC-HC-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR Part 164 Subpart C
- Library
- North Carolina home care · 50 policies
- Category
- Privacy
- Sections
- 19
In short
- Use only Agency-approved apps for client information, including the EVV app.
- Lock your phone with a PIN or fingerprint, and keep it updated.
- Never put client names, details or photos in personal texts, email, your photo gallery or social media.
- Never share your login or use someone else's.
- Report a lost or stolen phone to the office right away, and no later than one hour after you notice.
What's inside
19 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164 Subpart C)
- 5. Security Management and Risk Analysis
- 6. Access to Systems
- 7. Phones, Tablets, and the EVV Application
- 8. Email, Fax, Messaging, and the Office
- 9. Backup, Devices and Media, and Disposal
- 10. Vendors and Business Associates
- 11. Security Incidents
- 12. Responsibilities
- 13. Records and Compliance Monitoring
- 14. Staff Training
- 15. References
- 16. Related Policies and Forms
- 17. Approval
- 18. Revision History
An inspector may ask
- Who is your security official, and when did you last complete a security risk analysis?
- How do aides use their phones for EVV, and what stops client information being stored on a personal phone?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.