Skip to content

HIPAA Security

Sets out the administrative, physical and technical safeguards the Agency uses to protect electronic patient and employee information under the HIPAA Security Rule, with particular rules for the laptops, tablets and phones clinicians carry into homes (including electronic visit verification apps), OASIS transmission, security incidents, backup and contingency planning, business associates and disposal of devices.

Preview: full text with a package
About this policy
Policy number
NC-HH-PRV-02
Version
1.0
Main rule
45 CFR §164.308
Library
North Carolina home health · 57 policies
Category
Privacy
Sections
21

In short

  • Use patient information only in the Agency’s approved apps: the electronic record, OASIS software, scheduling and EVV. Never in personal texts, personal email or personal cloud storage.
  • Lock every device with a PIN, password or fingerprint. Use only your own log-in and never let anyone else use a device while you are signed in.
  • Keep devices with you or out of sight. Never leave one in a patient’s home or where it can be seen in your car.
  • Use public Wi-Fi only through the Agency’s secure connection; otherwise use cellular data or work offline in the approved app.
  • Report a lost or stolen device, or a password someone else may know, at once: (919) 555-0100, or after hours (919) 555-0199.
  • Return every Agency device, key and badge on your last day.

What's inside

21 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR §§164.302 to 164.318; 10A NCAC 13J .1401(c))
  • 5. Risk Analysis and Risk Management
  • 6. Security Measures
  • 7. Laptops, Tablets, Phones and Passwords
  • 8. OASIS Transmission
  • 9. Security Incidents
  • 10. Contingency Plan and Backup
  • 11. Business Associates
  • 12. Devices, Media and Disposal
  • 13. Security Training and Reminders
  • 14. Responsibilities
  • 15. Records and Compliance Monitoring
  • 16. Staff Training
  • 17. References
  • 18. Related Policies and Forms
  • 19. Approval
  • 20. Revision History

An inspector may ask

  • When did you last do a security risk analysis, and what did you change because of it?
  • A nurse’s tablet was stolen from her car. Walk me through what happens.

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in