Weekly Privacy & Security Monitoring Log

  • Weekly Privacy & Security Monitoring Log

    Weekly privacy and security monitoring checklist to be completed by the onsite designee and reviewed by the Privacy/Security Officer.

  • General Information

  • Date of Inspection*
     - -

  • Workstation & EHR Security

  • All workstations require unique user IDs and passwords.*
  • Automatic screen lock is enabled (15 minutes or less of inactivity).*
  • No passwords are written or visible near workstations.*
  • EHR access is limited to authorized staff only.*
  • Shared workstations (hallway/reception) are configured to lock when unattended.*

  • Reception / Public Areas

  • Computer screens in reception/waiting areas cannot be read by the public.*
  • Printed PHI is not left on counters or in public view.*
  • Sign-in sheets (if used) do not reveal diagnosis, SUD status, or detailed PHI.*

  • Fax / Printer / E-Mail/ Physical Records

  • Fax machines and printers used for PHI are in staff-only or supervised areas.*
  • Incoming faxes with PHI are promptly removed and not left unattended or received privately via e-mail.*
  • Outgoing faxes and e-mails containing medical information for disclosure include required HIPAA and 42 CFR Part 2 confidentiality notices.*
  • Paper records with PHI are stored in locked cabinets/rooms when not in use.*

  • 42 CFR Part 2 – SUD-Specific Controls

  • Part 2 consent forms are current, complete, and stored securely.*
  • Redisclosure warnings are included on all Part 2 disclosures.*
  • SUD/Part 2 records are clearly flagged in the EHR/records system as such.*
  • Only staff who need the information to perform their job duties may access SUD/Part 2 records.*

  • Physical & Environmental Safeguards

  • Office doors and records rooms are locked when not in use.*
  • Shred bins or secure disposal methods are used for PHI.*
  • No unattended PHI is left on desks at the end of the day (spot check).*

  • Incidents, Concerns, and Corrective Actions

  • Any privacy or security incidents observed this week?*
  • Corrective actions needed or requested?*

  • Certification by Onsite Designee

  • I certify that I completed this checklist for the week indicated and that the above answers are accurate to the best of my knowledge.
  • Designee Signature Date*
     - -
  • Should be Empty: