2005-030 - Laserfiche WebLink

Home Browse Search

Procedures to Safeguard PHI Physical Security. Physical security of PHI will be maintained through various means as follows : • PHI is to be maintained in separate file area of the office or enclosed room where access is limited to those County employees who have access according to the terms of the Privacy Policy. File cabinets should have locks . To the extent feasible, file cabinets should be kept locked . • If PHI is stored in a desk, the desk should have a lock . Desks containing PHI should be locked when unattended . PHI is not to be left unattended on desktops , countertops or worktables . • Departments that maintain PHI should ensure that visitors to the office are escorted to their .contact person and not left unattended . • Incoming mail should be delivered unopened to the person to whom it is addressed . • If an employee receives PHI and the employee is not designated as being permitted to have access to PHI, the employee should redirect .the PHI as soon as possible to an appropriate person who does have access to PHI . • Fax machines should be kept in an enclosed area or room to limit access to incoming communications that may contain PHI . Employees should exercise reasonable care to keep incoming fax messages secure and limit access by other County employees . • Address outgoing mail and fax communications only to the specific person at the organization who the organization has confirmed has access to PHI . Send PHI to a secure fax number verified by the intended receiver . Mark outgoing mail containing PHI "Personal & Confidential ." Verbal Security. • Employees shall take reasonable steps in verbally discussing PHI to ensure that PHI is not discussed with any employee , individual or third party who does not have access to PHI pursuant to the terms of the County ' s Privacy Policy. • PHI should not be discussed on speakerphone , unless necessary. If a speakerphone is used while discussing PHI, the door to the employee ' s office should be kept closed . • When discussing PHI by telephone, employees should take reasonable care that the party to whom they are speaking is permitted to have access to PHI . • Employees should not discuss PHI in public areas such as elevators and lunch rooms or at social gatherings . Supervisors should monitor physical and verbal security and access to PHI. Employees must report any violations of security to the Privacy Official as soon as possible . 37 _