ELECTRONIC PRIVACY AND SECURITY. 52.1. CONTRACTOR shall have a secure email system and send any email containing PII or PHI in a secure and encrypted manner. CONTRACTOR’S email transmissions shall display a warning banner stating that data is confidential, systems activities are monitored and logged for administrative and security purposes, systems use is for authorized users only, and that users are directed to log off the system if they do not agree with these requirements.
ELECTRONIC PRIVACY AND SECURITY. A. Contractor shall have a secure email system and send any email containing PII or PHI in a secure and encrypted manner. Contractor’s email transmissions shall display a warning banner stating that data is confidential, systems activities are monitored and logged for administrative and security purposes, systems use is for authorized users only, and that users are directed to log off the system if they do not agree with these requirements.
ELECTRONIC PRIVACY AND SECURITY. All workstations and laptops and/or other portable devices that store PHI or PII either directly or temporarily must be encrypted using a Federal Information Processing Standards (FIPS) 140-2 certified algorithm which is 128bit or higher, such as Advanced 15 42 CFR §§ 422.504(i)(2) & 423.505(i)(2); 22 CCR § 51476; Welf. & Inst. Code § 14124.1. Encryption Standard (AES). The encryption solution must be full disk unless approved by the ACBHD Information Systems Security Office. Contractors shall have a secure system for sending emails and, if applicable, facsimiles (faxes). Contractor shall send any email or fax containing PHI or PII in a secure and encrypted manner. Contractor’s email transmissions shall display a warning banner stating that data is confidential, systems activities are monitored and logged for administrative and security purposes, systems use is for authorized users only, and that users are directed to log off the system if they do not agree with these requirements. Contractor shall institute compliant identification and authentication management policies and procedures, which shall include but are not limited to procedures for biometrics and creating, changing, and safeguarding passwords. Any Electronic Health Records (EHRs) maintained by Contractor that contain any PHI or PII for clients served through this Agreement shall contain a warning banner regarding the PHI or PII contained within the EHR. Contractors that utilize an EHR shall maintain all parts of the clinical record that are not stored in the EHR, including but not limited to the following examples of client signed documents: client plan, discharge plan, informing materials, and health questionnaire. In addition, Contractor shall comply with the requirements of the 21st Century Cures Act – Information Blocking Rule. Contractors entering data into any ACBHD EHR shall ensure that staff members are appropriately trained to enter and maintain data within this system.
