[{"innerBlocks":[],"name":"core\/freeform","postId":127498,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"

The HHS Office for Civil Rights, which enforces the HIPAA privacy, security and breach notification rules, has new guidance to help healthcare organizations, including business associates, secure their data when an employee who has access to health data is terminated or otherwise leaves.<\/p><\/br><\/br>

8 steps for protecting health data when employees leave<\/h2>
The HHS Office for Civil Rights, which enforces the HIPAA privacy, security and breach notification rules, has new guidance to help healthcare organizations, including business associates, secure their data when an employee who has access to health data is terminated or otherwise leaves.<\/p>

1. Responsibility as soon as the employee leaves<\/h2>
When a workforce member is leaving the organization, it is important to ensure that the worker\u2019s access to protected health information is effectively terminated, according to OCR. Initial steps include making sure mobile phones, laptops and other devices are returned; approved PHI on personal phones or other devices are cleared or purged of electronic protected health information; and shutting down all accounts of the user\u2014including inactive accounts.<\/p>

2. Time to exit the building<\/h2>
Procedures to terminate access to ePHI should include termination of physical access to facilities. These could include changing combination locks, security codes, removing the person from access lists, asking for the reutn of keys, tokens, keycards, ID badges and any other physical items that could permit access.<\/p>

3. Standardize procedures<\/h2>
Organizations should have standard procedures for all action items to be completed when an individual leaves and incorporate the items in a checklist. These include notification to the IT department or specific security personnel about when an individual should no longer have access to ePHI when duties change or when the individual quits or is fired.<\/p>

4. Documentation<\/h2>
Use logs to document whenever access is granted physically or electronically, or privileges increased, and when equipment is given to individuals. These logs can be used to document the termination of worker\u2019s access to information and the return of physical equipment.<\/p>

5. Monitor account use<\/h2>
Consider having alerts in place to notify a department when an account has not been used for a specified number of days. These alerts may be helpful in identifying staff members\u2019 accounts that should be permanently terminated.<\/p>

6. Move fast<\/h2>
Terminate electronic and physical access as soon as possible. De-activate or delete user accounts, including disabling or changing user IDs and passwords.<\/p>

7. Audit procedures<\/h2>
Have appropriate audit procedures in place. Appropriate audit and review processes confirm that procedures actually being implemented are effective, and that individuals are not accessing ePHI when they shouldn\u2019t or after they leave.<\/p>

8. Additional steps<\/h2>
Terminate remote access capabilities, access to remote applications, services and websites such as accounts used to access third-party or cloud-based services. Change the passwords of any administrative or privileged accounts (like admin, root or system administrator) to which a former workforce member had access to.<\/p>

","saveContent":"
The HHS Office for Civil Rights, which enforces the HIPAA privacy, security and breach notification rules, has new guidance to help healthcare organizations, including business associates, secure their data when an employee who has access to health data is terminated or otherwise leaves.<\/p><\/br><\/br>