Health Care Department Operations Manual

Cancel

Chapter 2 – Patients’ Entitlements and Responsibilities

Article 2 – Confidentiality and Privacy

View All Sections >

2.2.5 Safeguards for Protected Health Information and Personally Identifiable Information

  • Policy

    • California Correctional Health Care Services (CCHCS) shall safeguard Protected Health Information (PHI) and Personally Identifiable Information (PII) from the risk of unauthorized access, use, or disclosure in accordance with federal and state privacy laws and CCHCS privacy policies.

  • Safeguards

    • CCHCS workforce members shall:

      • Take all necessary precautions to safeguard PHI and PII pursuant to the State Health Information Policy Manual and the Statewide Information Management Manual Chapter 5300.

      • Apply administrative, technical, and physical safeguards to protect PHI when assigned job duties requiring the access, use, or disclosure of PHI.

    • Each CCHCS program shall:

      • Have information technology (IT) and information security controls to safeguard PHI and PII, including administrative, technical, and physical controls.

      • Conduct internal reviews periodically to evaluate the effectiveness of these safeguards.

  • Specific Safeguarding Procedures

    • Paper Practices

      • Each CCHCS program shall ensure:

        • Workforce members are educated on the risks of creating paper documents including how to use, handle, share, store, and destroy.

        • All paper documents including those awaiting destruction in locked desk-site containers, storage rooms, centralized waste and shred bins, or other storage devices are labeled, and secured through reasonable measures to prevent unauthorized access.

        • Shredding of paper documents is performed on a timely basis consistent with record retention requirements.

    • Verbal Practices

      • CCHCS workforce members shall:

        • Take reasonable steps to protect the privacy of all verbal exchanges or discussions of PHI and PII regardless of where the discussion occurs.

        • Provide only the minimally necessary verbal information to fulfill their job functions.

      • Each CCHCS program shall:

        • Use hard-walled offices or meeting rooms to verbally exchange PHI and PII, if available.

          • In open office environments, incidental use or disclosure is not considered a privacy violation if CCHCS workforce members have complied with the reasonable safeguards and minimum necessary requirements.

        • Ensure workforce members are educated on the potential for inadvertent verbal disclosure of PHI and PII.

    • Visual Practices

      • CCHCS programs and workforce members shall ensure PHI and PII are adequately shielded from unauthorized visual disclosure in any visual medium such as photos, videos, images, or documents displayed on computer screens to unauthorized persons.

    • Electronic Practices

      • The CCHCS Information Technology Services Division shall ensure safeguards are in place for the transmission of PHI and PII via electronic platforms (e.g., databases, email, phone, fax). 

      • CCHCS workforce members shall be provisioned access only to electronic platforms that allow the minimum necessary information to fulfill their job functions.

  • References

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.530(c)

    • California Civil Code, Sections 1798-1798.78, Information Practices Act of 1977

    • Department Operations Manual, Chapter 4, Information Technology, Article 1 through 66

    • Health Care Department Operations Manual, Chapter 2, Article 2, Section 2.2.4, Minimum Necessary Use and Disclosure of Protected Health Information

    • Health Care Department Operations Manual, Chapter 5, Article 3, Information Technology

    • Health Care Department Operations Manual, Chapter 5, Article 3, Section 5.3.25, Security and Privacy Awareness Training

    • State Administrative Manual, Chapter 5300, Information Technology-Office of Information Security

    • Statewide Health Information Policy Manual, Section 3.1.0, Administrative Safeguards

    • Statewide Health Information Policy Manual, Section 3.2.0, Physical Safeguards

    • Statewide Health Information Policy Manual, Section 3.3.0, Technical Safeguards

    • Statewide Health Information Policy Manual, Section 4.1.1, Policies and Procedures

    • Statewide Information Management Manual, SIMM 5305-A, Information Security Program Management Standard

    • Statewide Information Management Manual, SIMM 5300-B, Information Security Program Management Standard

  • Policy Control
    Executive Sponsor: Deputy Director, Policy and Risk Management Services
    Effective: 02/2012
    Revised: 07/26/2023, 08/05/2024, 12/23/2025, 10/28/2026