Skip to content

HIPAA Security

Protects the Agency’s electronic patient information under the HIPAA Security Rule: a named security official, a written risk analysis and risk management plan, role-based access, unique logins, encryption of every device that holds patient information, audit log review, backup and disaster recovery, secure OASIS transmission, rules for phones and EVV devices in the field, and security incident response.

Preview: full text with a package
About this policy
Policy number
DC-HH-PRV-02
Version
1.0
Main rule
45 CFR §§164.302-164.318
Library
Washington, DC home health · 58 policies
Category
Privacy
Sections
22

In short

  • Never share your password or log in for someone else. Every login is yours alone.
  • Keep your phone or tablet locked with a passcode and with you during visits.
  • Do not save patient information to a personal device, personal email, or a USB drive.
  • Do not open unexpected links or attachments, and never give your password by phone or email.
  • Report a lost device, a suspicious email you clicked, or anything strange on a system to the security official at once.

What's inside

22 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR §§164.302-164.318)
  • 5. Security Official and Governance
  • 6. Risk Analysis and Risk Management
  • 7. Workforce Access
  • 8. Devices, Encryption, and Field Work
  • 9. Email, Messaging, and Transmission
  • 10. Audit Controls and Activity Review
  • 11. Backup, Contingency, and Emergency Operations
  • 12. Security Incidents
  • 13. Office Security and Paper
  • 14. Vendors
  • 15. Responsibilities
  • 16. Records and Compliance Monitoring
  • 17. Staff Training
  • 18. References
  • 19. Related Policies and Forms
  • 20. Approval
  • 21. Revision History

An inspector may ask

  • Show me your most recent security risk analysis and the risk management plan that came out of it.
  • Who is your security official?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in