Confidentiality and Computer Security Policies for Ohio DD Boards
County boards of developmental disabilities answer to HIPAA, FERPA, IDEA, the Ohio Revised Code, and the Ohio Administrative Code. One set of policies covers all of them.
Built by the firm that has served more than 60 Ohio boards.
Ohio DD Boards are subject to multiple regulations covering privacy, confidentiality, computer security, and individuals’ access to their records, including the federal HIPAA, FERPA, and IDEA regulations, the Ohio Revised Code, and the Ohio Administrative Code.
Eagle Consulting Partners has served more than 60 of Ohio’s County Boards over the last 20 years, and offers a comprehensive set of policies so boards can comply with all of these regulations at once. Appendices include a customizable Notice of Privacy Practices, a sample Business Associate Agreement, and employee agreements.
Boards that prefer to purchase by purchase order can call (216) 503-0333. We will send the templates once your PO is received.
What changed in the current version.
Eagle continually updates these policies as the rules that affect Ohio DD Boards change. The current version, updated January 2021, includes:
- Policies and technical controls for employees working from home and using video conferencing
- New security risk management procedures, for full compliance with the OCR audit protocol
- Updates based on changes to the ORC and OAC relating to confidentiality
- Comprehensive mobile device management policies, including employee BYOD agreements
- Password policy changes based on NIST SP 800-63B
- An optional Data Governance policy for larger boards with distributed responsibilities
- Social media policy updates for evolving platforms
- Numerous updates for clarity and consistent terminology
School and early intervention programs are covered.
FERPA governs the schools operated by DD boards, as well as any other board program that receives funds from the U.S. Department of Education. Its confidentiality rules are similar to HIPAA, with a number of key differences, and these templates reflect the current FERPA regulations.
IDEA governs the rights of parents and students with disabilities from birth to age 21 (age 18 in Ohio, the age of legal majority). Its requirements largely mirror FERPA, with differences that include Early Intervention programs. The Eagle policies provide full compliance with IDEA’s confidentiality and access provisions.
What’s included.
99 pages in Microsoft Word, with hyperlinked citations to the relevant regulations and reference materials.
Confidentiality policies for all staff
- 1000Confidentiality, Privacy and Computer Security Definitions
- 1010Confidentiality: General Rules
- 1020Minimum Necessary Policy
- 1030Confidentiality Safeguards (Oral and Written)
- 1040Speaking with the Family and Friends of an Individual Receiving Services
- 1050Authorizations
- 1060Verification
- 1070Minors, Personal Representatives and Deceased Individuals
- 1080Duty to Report Violations and Security Incidents
- 1090Disclosures that do not Require an Authorization
Individual rights
- 1200Individual’s Right to Access Records
- 1210Individual’s Right to Request Amendment of Records
- 1220Individual’s Right to Receive an Accounting of Disclosures
- 1230Individual’s Right to Request Additional Restrictions
- 1240Individual’s Right to Request Confidential Communications
- 1250Individual’s Right to Notice of Privacy Practices
Confidentiality policies for supervisors
- 1300Business Associate Contracts
- 1320Non-intimidation and Non-retaliation
- 1330HIPAA Assignments and Documentation
- 1340Privacy Complaints
- 1350Policy Updating and Staff Training
Executive management and HIPAA Security Officer
- 3000Security Management Process
- 3005Data Backup
- 3010Disaster Recovery Plan and Emergency Mode Operation
- 3015Facility Security and Access Control
- 3020Annual Security Evaluation
- 3025Audit Control and Activity Review
- 3030Malicious Software Protection
- 3035Breach Reporting
- 3040Security Awareness Program
- 3050Device and Media Disposal and Re-Use
- 3060Technical Safeguards
- 3062Technical Controls for Mobile Devices
- 3065Mitigation
- 3070Electronic Signatures
HR staff and supervisors
- 3075Employee System Access and Termination Procedures
Security policies for all staff
- 3080Computer Usage
- 3082Social Media Use
- 3085Portable Computing Devices
- 3087Employee Work at Home
- 3090Security Incident Response and Reporting
Appendices
- Appendix A: Identifying Business Associates
- Appendix B: Sample HIPAA Business Associate Agreement
- Appendix B2: Sample Service Provider Agreement
- Appendix C: Sample Privacy and Security Officer Job Descriptions
- Appendix D: Facility Security and Access Plans
- Appendix E: Minimum Necessary: Workforce, Disclosures and Requests
- Appendix F: Miscellaneous
Forms
- Authorization Form
- Notice of Privacy Practices
- Employee-Owned Mobile Device Agreement
- Agency-Owned Mobile Device Agreement
- Disclosure Log
- Acknowledgement of Confidentiality and Computer Security Policies and Procedures
Keeping your Board secure.
Want a copy of Eagle’s guide to keeping your DD Board secure? Enter your details and we will send it over.
Confidentiality and Computer Security Policies for Ohio DD Boards
Instant download in Microsoft Word. Perpetual license for a single organization. Satisfaction guaranteed.
Save 20% ($100) with code Save-20 at checkout
Need policies built around your organization?
Eagle can tailor any template to your risk assessment, or write custom policies from the ground up. Call us, or send a note and we will follow up.
Talk to Eagle