HIPAA Security
Sets out how the Agency protects electronic patient information on the record system, phones, tablets and laptops that staff carry into homes and facilities: the security official, risk analysis, the security measures register, device and password rules, incident response, backups and downtime, business associates, and disposal.
About this policy
- Policy number
- PA-HSP-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR Part 164 Subpart C
- Library
- Pennsylvania hospice · 60 policies
- Category
- Privacy
- Sections
- 19
In short
- Use patient information only in the Agency's approved apps and systems. Never in personal texts, personal email or personal cloud storage.
- Lock your phone, tablet and laptop, use only your own log-in, and never share your password.
- Do not save patient photos, documents or screenshots to your device.
- Never leave a device in sight in your car or unattended in a home or facility.
- Report a lost or stolen device, a suspicious email you clicked, or a password someone may know at once to (717) 555-0100 or after hours to (717) 555-0199.
What's inside
19 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164 Subpart C)
- 5. Risk Analysis and Risk Management
- 6. Security Measures Register
- 7. Phones, Tablets, Computers and Passwords
- 8. Security Incidents
- 9. Contingency Plan, Backup and Downtime
- 10. Business Associates
- 11. Devices, Media and Disposal
- 12. Responsibilities
- 13. Records and Compliance Monitoring
- 14. Staff Training
- 15. References
- 16. Related Policies and Forms
- 17. Approval
- 18. Revision History
An inspector may ask
- Who is your security official? When did you last complete a security risk analysis?
- A nurse loses a tablet. What happens next?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.