Protected Health Information (PHI) Handling Policy

Electronic Visit Verification (EVV) System
Last Updated: {{Insert Date}}

1. Purpose

This PHI Handling Policy outlines the administrative, technical, and physical safeguards used to protect Protected Health Information (PHI) within the EVV System (“the System”).
It ensures compliance with:

  • HIPAA Privacy Rule
  • HIPAA Security Rule
  • 21st Century Cures Act
  • Minnesota DHS 245D
  • Applicable BAAs
  • State retention statutes

2. Scope

This policy applies to:

  • All employees, contractors, and vendors
  • All EVV system components (web, mobile, APIs, databases)
  • PHI in any form (electronic, paper, or verbal)
  • DHS aggregator exports and integrations

3. Definition of PHI

PHI includes individually identifiable information such as:

  • Client name
  • Visit timestamps
  • GPS location (EVV-required)
  • Caregiver identity
  • Service types
  • Documentation or care notes
  • Contact details
  • Any combination of identifying data elements

4. Roles & Responsibilities

4.1 System Owner

Ensures safeguards are implemented, documented, and audited.

4.2 Administrators

Manage access, permissions, authentication, logs, and backups.

4.3 Developers

Follow secure coding standards; PHI is never used in dev/test without anonymization.

4.4 Customer Agencies

Ensure proper user management and HIPAA‑compliant usage.

4.5 Third-Party Vendors

Must operate under a HIPAA-compliant BAA.

5. PHI Access Controls

5.1 RBAC

Access is granted using least‑privilege, job‑based permissions.

5.2 Authentication Requirements

  • Strong passwords
  • MFA where applicable
  • Session timeouts
  • Suspicious activity monitoring
  • Immediate revocation upon termination

5.3 Prohibited Access

  • Shared logins
  • Unauthorized PHI viewing
  • Bypassing authentication controls

6. Minimum Necessary Standard

Only the minimum required PHI is accessed or disclosed.
Support, audit, or integration operations use restricted and logged access pathways.

7. PHI Collection Practices

Collected only for:

  • EVV verification
  • Billing, audit, and DHS aggregator compliance
  • Care documentation

Never collected for:

  • Marketing
  • Resale
  • Third‑party analytics

8. PHI Storage

8.1 Encryption

  • At rest: AES‑256
  • In transit: TLS 1.2+
  • Keys: Stored in secure KMS

8.2 Segregation

No PHI stored in dev/staging environments unless anonymized.

8.3 Backups

Encrypted and access‑controlled, with retention policies matching HIPAA/state requirements.

9. PHI Transmission

All PHI:

  • Sent only over encrypted channels
  • Logged when transmitted to DHS aggregators
  • Never sent via email or unsecured channels

10. PHI Logging & Monitoring

The System logs:

  • Access to PHI
  • Administrative changes
  • Export events
  • Failed login attempts
  • GPS and visit‑entry actions

Logs are:

  • Tamper‑resistant
  • Retained for minimum 6 years
  • Routinely reviewed for anomalies

11. PHI Use & Disclosure

Permitted uses:

  • EVV documentation
  • Billing and audits
  • DHS aggregator transmissions
  • Care‑plan support

Prohibited uses:

  • Marketing
  • Personal benefit
  • Any non‑authorized disclosure

All disclosures outside normal operations require documentation.

12. Device & Workstation Security

Users accessing PHI must ensure:

  • Screen lock policies
  • No PHI downloaded locally unless approved
  • No storage on personal devices
  • Encrypted devices for mobile access

13. Third‑Party Vendor Requirements

Vendors with PHI access must:

  • Sign a BAA
  • Use encryption and access controls
  • Follow HIPAA‑compliant development and handling practices

Annual security review is required.

14. Breach Notification & Incident Response

A potential breach includes:

  • Unauthorized PHI access
  • PHI loss or theft
  • Malware or intrusion targeting PHI systems

Actions:

  1. Immediate containment
  2. Investigation and documentation
  3. Notification in compliance with HIPAA Breach Notification Rule
  4. Corrective action

15. Data Retention & Destruction

15.1 Retention

  • EVV visit records: 7–10 years
  • Audit logs: 6+ years
  • Billing records: 7 years

15.2 Destruction

Upon expiration, PHI is destroyed using NIST‑approved methods:

  • Cryptographic erasure
  • Secure deletion
  • Destruction of physical media

16. User Rights

Users may:

  • Request corrections
  • Request access logs
  • Access their own PHI record (via agency admin)

Users may not delete EVV‑required PHI or audit logs.

17. Training

All personnel undergo:

  • HIPAA training
  • Security awareness
  • PHI handling and incident reporting

18. Policy Enforcement

Violations may result in:

  • Access removal
  • Disciplinary action
  • Contract termination
  • Legal consequences depending on severity

19. Contact Information

Privacy & Security Office
{{Your Company Name}}
{{Address}}
{{Email}}
{{Phone}}