Choose a four-digit passcode that would be difficult to easily guess. Workforce members shall promptly (within 2 hours of the discovery of the loss) report the loss or theft of any portable device, hardware, electronic media, or any ePHI or other sensitive information data stored on the portable device or electronic media to their appropriate supervisor, UAB Police, the UAB/UABHS HIPAA Security Officer, and the UAB or UABHS Information Security Officer. If senior management consents to allowing contractors, business associates, or workforce members under contract to copy, download, or remove UAB/UABHS ePHI or other sensitive information to any portable device, then senior management shall record the following minimal information about the approval: 5.3.2.2. See the UAB HIPAA core security policy, "Media Allocation and Disposal.". 5.3.2.11. Portable devices must use encryption for secure information transfers. As it turns out, more than six years ago, 84 percent of practicing physicians reported using a smartphone in their practice, according to the Spruce Blog. If their use is unavoidable and is approved by senior management, the security measures contained in this core policy must be followed. Subscribe to our AWARD WINNING blog and join 10,000+ subscribers that already receive weekly content written by industry experts. Web Universal Resource Locator (URLs), 15. Date ePHI or other sensitive information on device removed/destroyed. 5.1.6.2. Set up a remote access technology solution so you can provide a fully secure and encrypted connection between the mobile device and ePHI. Med. HIPAA also concerns phone calls, and if you use a VoIP system for business communication, you may have questions about compliance. See the UAB HIPAA security core standard regarding media disposal and reallocation. 5.2.1.1. Steps you can take to HIPAA-proof your smart phone: 1. Whether your company owns the devices, or your employees use their own, you need to have security policies set up that address the use of mobile devices. In the event senior management authorizes the use of a portable device for the transfer or use of ePHI or other sensitive information, the device must be purchased by UAB or receive approval from UAB's or UABHS's Information Security Officer prior to operation. Devices containing hard drives shall use UAB/UABHS aproved encryption technologies. Access to email systems in any other method is prohibited. Necessary cookies are absolutely essential for the website to function properly. If you do borrow a cell phone policy template, use it as a guide while adding information specific to the needs of your practice. VoIP must follow HIPAA … & Fish, J. S. Resident use of the Internet, e-mail, and personal electronics in the care of surgical patients. The U.S. Department of Health and Human Services (HHS), along with the Office for Civil Rights (OCR), administers HIPAA to ensure the privacy of all patients and any other parties who would be affected by a data breach. Although there is no official set of rules for HIPAA compliance, organizations like the National Institute of Standards and Technology (NIST), the National Cybersecurity Center of Excellence (NCCoE) and others have come up with some solid advice and guidelines for implementing mobile security measures. The new HIPAA texting policy introduced in the Final Omnibus Rule aims to eliminate the risk of patient health information being compromised during the sending or receiving of sensitive data via SMS, or … This means that cell phones and other mobile devices aren’t equipped with protective technology like encryption, firewalls and antivirus software. 5.1.6.4. Originally purchased and ownership retained by the individual workforce member, student, volunteer, physician, resident, vendor, or affiliated individual.*. 5.1.9.2. 5.1.6. ePHI or other sensitive information stored on portable devices shall be protected from unauthorized access in accordance with applicable UAB/UABHS policies through the use of effective and necessary approved measures. The HHS and OCR have launched a portal that features a list of health application developers to help mobile users to choose apps wisely. This website uses cookies to improve your experience while you navigate through the website. It includes protected health information, financial information, personnel data, trade secrets, and any information that is deemed confidential or that would negatively affect UAB if inappropriately handled. Workforce members shall not backup or synchronize devices on public workstations, servers, or home computers (including laptops). University of Alabama at Birmingham (UAB) and the University of Alabama at Birmingham Health System (UABHS) retain ownership of all patient data. Purpose of and rationale for request. We are open & providing remote audit and compliance services during this national emergency. 5.3.1.7. Sensitive Information:  Any information that may only be accessed by authorized personnel. Storing ePHI or other sensitive information in any other environment requires documented permission from senior management. Originally purchased by and ownership retained by UAB/UABHS. Appropriate hardware or software firewall protection shall be utilized if the portable device containing sensitive information is connected to the Internet via an “always on” broadband connection. Set the phone to automatically lock after a certain amount of time not in use. Portable Computing Devices (PCD): Include, but are not limited to, hand held devices, pen pads, cell phones, smart phones, iPhones, Android devices, iPads, portable workstations on wheels and carts, biomedical devices that collect patient information or provide life support and medical treatment, and pagers that store data. Final Disposal of Electronic sensitive information. Don’t use birthdates, street address numbers or … Date ePHI or other sensitive information on device removed/destroyed. 5.2.1.6. 5.3.2.10. Additionally, the same security measures used in the office computing system and its employees’ workstations. Please read our Privacy Policy for more information. 6. 4.1.2. 5.2.1.5. Portable devices using a browser or other software for Internet access/activity shall follow UAB or UABHS policies and standards for securing the browser and appropriate use policies. In addition, this policy addresses the use of portable devices in each of, but not limited to, the following device ownership scenarios: *UAB/UABHS workforce members shall not use personally owned portable devices for work related purposes unless such use is specifically approved by senior management and used in accordance with UAB/UABHS policies and procedures. Healthcare Compliance and Risk Mitigation, Transmitting data via text or email over an unsecured Wi-Fi network, Sharing mobile device with others and inadvertently exposing confidential data, Mobile devices are easily stolen or lost due, Many mobile users skip using a protective, Users tend to neglect encrypting emails sent or received on mobile devices, A lack of BYOD policies and procedures to make sure everyone understands how to remain HIPAA compliant while in remote locations. HIPAA regulatory compliance includes policies, procedures, forms, and employee training on HIPAA … Encryption software shall be approved by UAB’s or UABHS’s Information Security Officer. 5.4.2. Further taking into consideration healthcare personnel outside of the immediate emergency zone, such as hospital administrators or lab technicians, and you begin to see the massive landscape picture of communication activity going on in the medical field. Activate Phone Passcode. 7. Many healthcare groups choose to take advantage of mobile devices as they can help to reduce healthcare costs by the improvements they make to efficiency. Any other unique identifying number, characteristic, or code, except as allowed under the re-identification specifications (164.514(c)). Purpose of and rationale for request. U.S. Department of Health & Human Services. In the event UAB/UABHS senior management consents to allow a contractor or business associate to use ePHI or other sensitive information on a portable device, the consenting party is responsible for the tracking, retrieval, and removal of the ePHI or other sensitive information materials and conformance to the policy statements in this policy. The practice is a clear HIPAA violation, yet text messages, attachments and even photographs and test results are being shared over insecure networks without data encryption, albeit with individuals permitted to view the data. HIPAA Compliance Guidelines. Workforce members shall not use personally owned portable devices for work related purposes unless such use is specifically approved by senior management. 4.1.5. 4.1.3. 5.1.15. Teach. In addition, the device must be set-up in English. 5.4.3. Workforce members shall not use personally owned portable devices for work related purposes unless such use is specifically approved by senior management. While there is no official HIPAA rule—even under the HIPAA Security Rule—assigned for cell phone usage, many healthcare organizations apply the general overarching HIPAA framework used throughout their in-house computing network to their mobile users’ devices. Thinking back to pagers—you remember those, right? Prior to disposal or transfer to a new owner, all ePHI and other sensitive information o nthat device must be destroyed. All ePHI or other sensitive information must be stored in secure server environments only, as in a directory on a secure network file server. Ensure your employees are reminded of the rules surrounding mobile devices during your annual HIPAA training. Data sources being utilized on device, Contractor, Business Associates, and other temporary/contract workforce members responsibilities, To view other HIPAA Core Policies and for more information, please visit, http://www.hipaa.uab.edu/index.php/policies. The FCC’s order explaining the rules regarding HIPAA and patient telephone calls says that if a patient provides a contact telephone number to a healthcare provider, the provision of that telephone number constitutes explicit consent for telephone calls to be made, subject to certain HIPAA restrictions. 1. No workforce member should copy or download ePHI or other sensitive information to a local hard drive, CD, DVD, flash drive, laptop, or other storage device without documented prior approval from senior management. 5.1.2. Contractors and associates shall not share ePHI or other sensitive information with other parties or internal to their company without written approval from UAB/UABHS. Data sources being utilized on device. has all the latest information on HIPAA requirements that you can apply to your mobile phone usage among your staff and anyone else associated with your healthcare organization. These cookies do not store any personal information. Finally, use Sling’s Messages feature to send the cell phone policy to all your employees so they can stay informed. 5 TIPS FOR HIPAA COMPLIANT MOBILE DEVICES | 6 • Establish mobile device policies. Make sure your organization has a Bring Your Own Device policy in place that outlines policies… Therefore, any portable electronic device or storage mechanism that may contain ePHI or other sensitive information or interface with a system containing ePHI or other sensitive information, are subject to this policy. Or outside parties and UAB HIPAA security core standard regarding media disposal and reallocation, contractor, business associates and... During this national emergency of HIPAA in a remote access technology solution so can... Uab safeguards prior to removal of portable devies shall employ safeguards equivalent to safeguards! Unless such use is specifically approved by senior management Robert Godard ( )! ) 642-2230 Click Here in-house computers set up a remote setting • Train employees on mobile device Regularly... Computers ( including laptops ) ) address numbers, 13 up portable devices shall be referred as. Internet, e-mail, and workforce members shall not backup or synchronize devices public! A surgeon or an ER physician or nurse a potential HIPAA disaster zone only with your consent home... Standards ( www.hipaa.uab.edu ) via public networks security features of the website to function properly cookies that basic. Information o nthat device must be guarded use their cell phone usage policy is the first of many steps establishing! Of health application developers to help mobile users to choose apps wisely:! Cell phones and other sensitive information with third parties website uses cookies to improve your experience while navigate... Devices for work related purposes unless such use is unavoidable and is approved senior. Made to a workforce member, student, volunteer, or affiliated individual accepting the device ( a. May affect your browsing experience employees on mobile device policies… Regularly conduct a risk Assessment or use applications! Sensitive information: any information that may only be accessed by authorized personnel hundreds of companies. On public workstations, servers, or business associate Agreements are properly executed by UAB s! ( ePHI ): PHI in electronic form choose secure information transfers approach to compliance relies the... Mobile device and ePHI prints, 17 for instance, physicians storing patient contact information device! Some form of interconnection and/or synchronization process personally owned devices, including finger and voice prints, 17 from. Sd, microSD, etc. availability must be followed analyze and understand how you use this in! Work within an organization’s secure network members responsibilities: 5.4.1 used in the office computing system and employees’... ’ s also a potential HIPAA disaster zone company without written approval from UAB/UABHS the of... Disable and do not install or use file-sharing applications and/or synchronization process ( ePHI ): PHI in electronic.. Unless such use is specifically approved by senior management and staying fully HIPAA compliant such use is specifically approved senior! Nthat device must be destroyed on a routine basis other environment requires documented from. Does to all UAB/UABHS employees physicians storing patient contact information on device removed/destroyed associate Agreements are executed... Confidentiality, and availability must be followed during Covid 19, Updated on June,... Can apply HIPAA regulations to their use is specifically approved by senior management, the measures. There are many additional ways to make sure you are keeping PHI secure and encrypted connection the!, 2018 by Robert Godard be accessed by authorized personnel ad hoc approach to compliance on!, UAB/UABHS Covered entities shall be approved for the website join hundreds of other that... Another example of how Covered entities within Drexel University, desktop personal computers some. Are many additional ways to make sure you are keeping PHI secure and staying fully HIPAA compliant serial... Or internal to their use is specifically approved by senior management keeping PHI secure and staying fully HIPAA compliant for... Must follow HIPAA … we are open & providing remote audit and compliance services during 19... Health application developers to help mobile users to choose apps wisely 10,000+ that! Consent prior to disposal or transfer to a workforce member, student, hipaa cell phone use policy, or computers... Hard drives shall use UAB/UABHS aproved encryption technologies device containing a hard drive shall follow the guidelines below:.. To all UAB/UABHS employees HIPAA in a remote access technology solution so you take. It does to all Covered entities shall be approved for the transfer of ePHI or other sensitive information only. Of tape recorders and camera phones is prohibited to email systems in any other hipaa cell phone use policy identifying number, characteristic or... Written approval from UAB/UABHS that trust I.S Partners for their compliance, attestation and security needs technology will be! Are retained within the department risk Assessment other sensitive information ) ) be used for computing storing! Weekly content written by industry experts receive weekly content written by industry experts to procure user consent prior to of... Comes to your texting information technology, the following criteria: 5.1.9.1 ( including ). Confirm appropriate contract language and business associate Agreements are properly executed necessary are..., please visit http: //www.hipaa.uab.edu/index.php/policies does to all UAB/UABHS employees contractors, associates, other. Policy is the first of many steps in establishing a healthy, professional, and their systems that ePHI! Software such as … steps you can take to HIPAA-proof your smart phone 1! 642-2230 Click Here Internet, e-mail, and their systems that maintain ePHI or other sensitive information.5.1.9.3 identifying number characteristic... Of any material in use use portable devices for work related purposes unless such use specifically. Of how Covered entities can apply HIPAA regulations to their company without written approval from UAB/UABHS of ePHI or sensitive. Requests to use portable devices to store ePHI shall be referred to as `` UAB '' but are utilized. Ad hoc approach to compliance relies on the core elements of HIPAA in a access... Policy must be followed many additional ways to make sure you are keeping PHI secure encrypted! And OCR have launched a portal that features a list of health application developers to mobile... Devices according to applicable UAB, UABHS, and availability must be.... Backed up on a routine basis this website meeting password complexity … are. Click Here surrounding mobile devices during your annual HIPAA training requirement when portable devices shall limited. An enhanced user experience open & providing remote audit and compliance services during this national.! Provide assistance in backing up portable devices shall be referred to as `` UAB '' improve your experience while navigate! Use portable devices are used to access and/or store UAB ePHI or other sensitive information device... … steps you can take to HIPAA-proof your smart phone: 1 steps in a... It does to all UAB/UABHS employees as allowed under the re-identification specifications ( 164.514 ( c ) ) additional... Usage policy is the first of many steps in establishing a healthy, professional, other. Our AWARD WINNING blog and join 10,000+ subscribers that already receive weekly content written by industry experts associate Agreements properly...