HIPAA Security
Sets the administrative, physical and technical safeguards the Agency uses to protect electronic protected health information under the HIPAA Security Rule (45 CFR Part 164 Subpart C): the security official, risk analysis and risk management, workforce access, mobile devices used in patients' homes, email and texting, facility and device controls, audit logs, security incidents, the contingency plan, vendors and documentation, together with the Ohio electronic signature requirements of ORC 3701.75 and OAC 3701-19-23(E).
About this policy
- Policy number
- OH-HSP-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR Part 164 Subpart C
- Library
- Ohio hospice · 60 policies
- Category
- Privacy
- Sections
- 23
In short
- Use only Agency devices or the approved app for patient information, and keep them locked with a PIN or password.
- Never send patient information by ordinary text message or personal email.
- Keep your device with you or locked out of sight in your vehicle; never leave it in a patient's home.
- Report a lost or stolen device within one hour so it can be wiped.
- Lock your screen when you step away and log off when you finish.
What's inside
23 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164 Subpart C; OAC 3701-19-23(D)-(E))
- 5. Security Official
- 6. Risk Analysis and Risk Management
- 7. Workforce Access
- 8. Devices Used in the Field
- 9. Email, Texting, Fax and Telehealth
- 10. Physical Safeguards
- 11. Technical Safeguards
- 12. Security Incidents
- 13. Contingency Plan
- 14. Vendors and Business Associates
- 15. Evaluation
- 16. Responsibilities
- 17. Records and Compliance Monitoring
- 18. Staff Training
- 19. References
- 20. Related Policies and Forms
- 21. Approval
- 22. Revision History
An inspector may ask
- When did you last complete a security risk analysis, and what did you do about the risks it found?
- What happens to a nurse's access to the electronic record on the day she leaves?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.