HIPAA Security
Sets out how the Agency protects electronic health information under the HIPAA Security Rule: a named Security Official, a written risk analysis and risk management plan, role-based EHR access with unique logins, rules for laptops, tablets and phones used in patients' homes, encryption, audit-log review, security incident response, backup and disaster recovery tied to the emergency plan, and six-year retention of security documentation.
About this policy
- Policy number
- NC-HSP-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR §164.308
- Library
- North Carolina hospice · 60 policies
- Category
- Privacy
- Sections
- 21
In short
- Use only your own login. Never share passwords, and lock the screen when you step away.
- Keep Agency devices with you or locked out of sight. Never leave them in a patient's home, a facility or in view in your car.
- Report a lost or stolen device to the Security Official at once, and within one hour of noticing, so it can be wiped.
- Send patient information only through Agency-approved secure apps, never by ordinary text, personal email or your phone's photo roll.
- Report any suspicious email you clicked or strange computer behavior right away.
- If the EHR is down, use your offline care plan and medication list and call the on-call nurse.
What's inside
21 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §164.308)
- 5. Security Management
- 6. Workforce Access
- 7. Passwords, Logins and Phishing
- 8. Mobile Devices in Homes and Facilities
- 9. Physical Safeguards
- 10. Technical Safeguards
- 11. Security Incidents
- 12. Backup, Disaster Recovery and Emergency Mode
- 13. Business Associates and Vendors
- 14. Responsibilities
- 15. Records and Compliance Monitoring
- 16. Staff Training
- 17. References
- 18. Related Policies and Forms
- 19. Approval
- 20. Revision History
An inspector may ask
- Who is responsible for security of your electronic records? When did you last do a risk analysis?
- How do you remove a former employee's access to the EHR, and how quickly?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.