0 of 16

0 of 9

Devices that leave the office

Full-disk encryption on every laptop.RulePractice164.312(a)(2)(iv), addressable; "every" is practice
Encryption and a screen lock on every phone and tablet that opens a chart.RulePractice164.312(a)(2)(iv), addressable; "every" is practice
Automatic lock after inactivity.RulePractice164.312(a)(2)(iii), addressable; 5 minutes on a phone and 15 on a laptop is practice
Remote wipe for lost or stolen devices.Practice
Agency-owned devices, or a written BYOD policy the risk analysis covers.Practice
A disposal procedure for old devices and media.Rule164.310(d)(2)(i), required

Physical spaces

Office areas and servers that hold PHI physically restricted.Rule164.310(a)
Workstations placed and secured so only authorized users can see them.Rule164.310(b), (c)
Paper charts locked away, a shredding policy, printouts retrieved promptly.RulePractice164.530(c) sets the standard; the specifics are practice

0 of 12

HIPAA Checklist for Home Health Agencies