Skip to content

HIPAA Security

Puts in place the HIPAA Security Rule’s administrative, physical and technical safeguards for electronic patient information, with particular attention to the laptops, tablets and phones clinicians carry into patients’ homes and the electronic visit verification apps Ohio Medicaid requires: risk analysis and risk management, access control, device rules, encryption, OASIS transmission, security incidents, backup and contingency planning, business associates and disposal.

Preview: full text with a package
About this policy
Policy number
OH-HH-PRV-02
Version
1.0
Main rule
45 CFR §164.308
Library
Ohio home health · 59 policies
Category
Privacy
Sections
21

In short

  • Use patient information only in the Agency’s approved apps, never in personal texts, email or cloud storage.
  • Lock your device every time it leaves your hand, and never share your password or let anyone use your log-in.
  • Check in and out on the visit verification app only for your own visits.
  • Keep devices with you or out of sight in the home and car, and never use public Wi-Fi without the Agency’s secure connection.
  • Report a lost device, a shared password or a suspicious email to the office at once, day or night.

What's inside

21 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR §164.308)
  • 5. Risk Analysis and Risk Management
  • 6. Security Measures
  • 7. Point-of-Care Devices, Computers, and Passwords
  • 8. OASIS Transmission
  • 9. Security Incidents
  • 10. Contingency Plan and Backup
  • 11. Business Associates
  • 12. Devices, Media, and Disposal
  • 13. Security Training and Reminders
  • 14. Responsibilities
  • 15. Records and Compliance Monitoring
  • 16. Staff Training
  • 17. References
  • 18. Related Policies and Forms
  • 19. Approval
  • 20. Revision History

An inspector may ask

  • Who is your Security Official? Show me your most recent risk analysis and your risk management plan.
  • How do you control which staff can see which patients’ records, and how quickly is access removed when someone leaves?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in