Skip to content

Information Security, Devices, and Electronic Records

Sets how the Agency protects electronic client information and the devices that hold it: the security official, a written risk analysis, unique logins and strong passwords, automatic lock and encryption, rules for Agency and personal phones used for EVV and visit notes, electronic signatures that meet ORC 3701.75, email and texting, backups and an emergency plan for systems, device loss, disposal, and reporting security incidents.

Preview: full text with a package
About this policy
Policy number
OH-HC-PRV-02
Version
1.0
Main rule
45 CFR §164.308
Library
Ohio home care · 49 policies
Category
Privacy
Sections
22

In short

  • Use only your own login. Never share a password or let anyone use your EVV account.
  • Keep a screen lock on any phone you use for work, and keep client information only in the approved apps.
  • Do not text client names or health details on personal apps, and do not take photos of clients or their papers.
  • If your phone is lost or stolen, or you clicked a suspicious link, call the office right away.
  • Sign the device agreement before you use a phone or tablet for Agency work.

What's inside

22 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR §164.308)
  • 5. Risk Analysis and Risk Management
  • 6. User Access, Logins and Passwords
  • 7. Agency Devices and Office Computers
  • 8. Personal Phones Used for EVV and Visit Notes
  • 9. Electronic Signatures
  • 10. Email, Texting, Fax and Printing
  • 11. Backups, System Failures and Emergencies
  • 12. Disposal and Re-Use of Devices and Media
  • 13. Reporting and Responding to Security Incidents
  • 14. Sanctions
  • 15. Responsibilities
  • 16. Records and Compliance Monitoring
  • 17. Staff Training
  • 18. References
  • 19. Related Policies and Forms
  • 20. Approval
  • 21. Revision History

An inspector may ask

  • Who is responsible for information security, and when did you last complete a risk analysis?
  • If an aide uses her own phone for EVV, what protects client information on it?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in