Qualified Health Information Network Remote Work Policy Checklist

Use this checklist to establish consistent remote-work controls for Qualified Health Information Network (QHIN) staff who may work remotely and access sensitive information or systems from home. Adapt each item to your organization’s risk analysis, workforce roles, and applicable QHIN policies.

Authorize Remote Work

Require written approval before an employee performs QHIN work remotely. The manager and appropriate privacy, security, or IT personnel should confirm that the role can be performed remotely and that the employee’s location, duties, and access needs are suitable.

• Record the employee, approved work location, job duties, systems needed, and approval date.
• Set an approval period and require review when the employee’s role, location, or access needs change.
• Confirm that the arrangement follows organizational policies, applicable agreements, and any QHIN-specific requirements.
• Define how employees request exceptions, report changes, or end a remote-work arrangement.

Complete Teleworking Guidelines

Provide written teleworking guidelines before remote access begins. Explain how employees must handle information, devices, communications, and security incidents outside the office.

• Specify approved work locations and whether work from public or shared spaces is prohibited or restricted.
• Explain rules for printing, downloading, storing, discussing, and disposing of sensitive information.
• Require employees to report lost devices, suspected phishing, misdirected communications, and other security concerns promptly.
• Document expectations for work hours, support requests, equipment returns, and temporary interruptions to secure access.

Document Permitted Work Activities

List the tasks employees may perform remotely and the systems they may use for each task. Apply access control safeguards so employees can access only the information and functions needed for their assigned work.

• Identify permitted applications, records, communication tools, and data-handling activities.
• Restrict activities that require an in-office environment or additional supervision.
• Prohibit use of personal email, unapproved file-sharing services, and unauthorized storage devices for QHIN information.
• Review permissions when duties change and remove access promptly when it is no longer required.

Secure The Home Workspace

Require a private work area that reduces the chance of unauthorized viewing, listening, or handling of information. Physical workstation security is an important part of protecting information when work takes place at home.

• Position screens away from household members, visitors, and windows visible from outside.
• Use a privacy screen where the work setting creates a risk of visual exposure.
• Lock the workstation when unattended and configure automatic screen locking.
• Secure paper records and approved devices when they are not in use; avoid printing unless authorized.
• Keep work conversations and calls private, and use a headset when appropriate.

Configure VPN And Network Access

Provide remote access through organization-approved tools and settings. Virtual private network access can help protect a connection, but it should be combined with strong authentication, managed devices, and appropriately limited permissions.

• Require the approved VPN or other authorized secure connection for remote access to internal systems.
• Use unique user accounts and multi-factor authentication where configured by the organization.
• Keep operating systems, security software, and approved applications current.
• Prohibit access over unsecured public Wi-Fi unless an approved protective connection is active.
• Apply transmission security measures to protect sensitive information sent over electronic networks.
• Log access and review alerts or unusual activity according to organizational procedures.

The HIPAA Security Rule includes technical and physical safeguards relevant to remote access, including access controls, workstation security, and transmission security. Apply the measures appropriate to your organization’s risk analysis and remote-work environment.

Complete Privacy And Security Training

Require workforce security awareness training before granting remote access, then provide refreshers as policies, threats, or job duties change. Training should explain how employees can protect information and what to do when something goes wrong.

• Cover phishing, social engineering, password protection, authentication, and safe use of remote connections.
• Explain how to recognize and report a possible exposure, lost device, or unauthorized access.
• Review privacy expectations for conversations, screens, documents, and communications in a home setting.
• Document completion, assessment results when applicable, and any required follow-up.

HIPAA-regulated organizations must address security awareness and training for workforce members; tailor the program to remote-work risks and the employee’s responsibilities.

Use Approved Equipment And Systems

Issue or approve the equipment and services employees need to work remotely. Organization-managed devices make it easier to apply consistent safeguards and support secure access to QHIN systems.

• Use approved computers, phones, headsets, and software for work involving sensitive information.
• Enable required encryption, endpoint protection, screen locking, and device-management settings.
• Do not share work devices or credentials with household members or other unauthorized users.
• Use approved collaboration and messaging systems; verify recipients before sending sensitive information.
• Set procedures for device repair, loss, replacement, return, and secure disposal.

Before approving remote work, confirm that authorization, permitted activities, workspace protections, secure access, training, and approved equipment are all in place. Review the checklist periodically and update it when roles, risks, or organizational requirements change.

FAQs.

What approvals are required before QHIN staff work remotely?

Require written approval from the employee’s manager and any privacy, security, or IT reviewers designated by your organization. Record the approved location, duties, systems, access level, and review period, and confirm alignment with applicable organizational and QHIN-specific requirements.

What should a remote-work checklist cover to protect protected health information?

It should cover authorization, permitted tasks, access limits, a private workspace, secure connections, workforce security awareness training, approved equipment, incident reporting, and secure handling of paper and electronic information. Include review procedures for changes to an employee’s role, location, or access.

How should QHIN employees secure remote network access?

Employees should use only organization-approved remote access tools, such as an approved VPN where required, and follow the organization’s authentication and device-security settings. They should avoid unsecured networks, keep approved devices updated, protect their credentials, and report suspicious activity promptly.

What training must employees complete before working remotely?

Require the organization’s applicable privacy and security training before granting remote access. Include guidance on phishing, secure network use, protecting screens and conversations, handling sensitive information, and reporting suspected incidents; document completion and provide refreshers as needed.