HIPAA Security
Sets out how the Agency protects electronic patient information under the HIPAA Security Rule: the security official, risk analysis and risk management, workforce access, training, incident response, contingency planning, physical and device safeguards for staff who work in patients’ homes, technical controls, business associates and documentation.
About this policy
- Policy number
- DC-HSP-PRV-02
- Version
- 1.0
- Main rule
- 45 CFR Part 164, Subpart C
- Library
- Washington, DC hospice · 60 policies
- Category
- Privacy
- Sections
- 21
In short
- Use only your own login and keep your password secret.
- Keep patient information in the electronic record app, not on the phone or a USB drive.
- Keep devices with you or locked away. Never leave them in a car overnight.
- Report a lost or stolen device to the security official the same day.
- Do not click links or open attachments in e-mails you were not expecting.
What's inside
21 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164, Subpart C)
- 5. Risk Analysis and Risk Management
- 6. Workforce Access
- 7. Devices Used in Patients’ Homes and on the Road
- 8. Physical Safeguards
- 9. Technical Safeguards
- 10. Security Incidents
- 11. Contingency Plan
- 12. Business Associates and Vendors
- 13. Evaluation and Documentation
- 14. Responsibilities
- 15. Records and Compliance Monitoring
- 16. Staff Training
- 17. References
- 18. Related Policies and Forms
- 19. Approval
- 20. Revision History
An inspector may ask
- Who is your security official? When did you last complete a security risk analysis?
- How are laptops, tablets and phones that hold patient information protected if they are lost or stolen?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.