R6-6-1407. Monitoring, Training, and Policy

A. An Operator who installs, oversees, and monitors or engages with a third-party vendor to install, oversee, and monitor an Electronic Monitoring Device in a Group Home, Nursing-supported Group Home, or Intermediate Care Facility shall: 1. Monitor each Electronic Monitoring Device at least quarterly to ensure the Electronic Monitoring Device is: a. Functioning properly; b. Secure from access by unauthorized persons; and c. Used in compliance with this Article. 2. Ensure that the Operator’s personnel adhere to this Article and applicable policies and promptly address non- compliance. 3. Maintain a log of all monitoring of Electronic Monitoring Devices, including: a. The date of the monitoring; b. The name of the individual who performed the monitoring; c. Each deficiency identified with the Electronic Monitoring Device during the monitoring; and d. The method and date by which a deficiency identified during the monitoring was remedied and by whom the deficiency was remedied. 4. Respond immediately upon identifying any risk or breach involving an Electronic Monitoring Device or Electronic Monitoring Record. 5. Maintain a log of each identified risk or breach, which shall include: a. The date of the identified risk or breach; b. The name of the individual who identified the risk or breach; c. Each risk or breach identified with the Electronic Monitoring Device or Electronic Monitoring Record; d. Whether notice of the breach was provided to affected individuals; and e. The method and date by which the risk or breach identified was remedied and by whom the risk or breach was remedied. 6. Report any data breach in compliance with the HIPAA Privacy Rule, HIPAA Security Rule, A.R.S. § 36-568.01, and other applicable federal and state laws addressing confidentiality. B. The Operator shall develop and provide training to all Operator’s personnel who have access to the Electronic Monitoring Records described in R6-6-1406(B) prior to the Operator’s personnel being provided access to the Electronic Monitoring Records. Training shall include: 1. The requirements of this Article related to disclosure of Electronic Monitoring Records; 2. The requirements of the HIPAA Privacy Rule, HIPAA Security Rule, A.R.S. § 36-568.01, and other applicable federal and state confidentiality and privacy laws related to the Electronic Monitoring Records; 3. The maintenance and operation of the Electronic Monitoring Device and any associated storage devices; 4. The methods used to secure the Electronic Monitoring Records; 5. A list of all individuals the Operator may allow to access the Electronic Monitoring Records; 6. The reporting method required in the event of any breach in the security of the Electronic Monitoring Records or misuse of the Electronic Monitoring Device; and 7. All policies related to the installation, oversight, and monitoring of an Electronic Monitoring Device. C. The Operator shall provide the training described in subsection (B) to all Operator’s personnel who have access to Electronic Monitoring Records created by the Electronic Monitoring Devices on an annual basis. D. The Operator shall require all of the Operator’s personnel who receive the training described in subsection (B) to sign an acknowledgment of completion of the training, which shall be maintained in the official training file for each Operator’s personnel who received the training. E. The Operator shall develop and implement policies for the Operator’s personnel who have access to an Electronic Monitoring Record that: 1. Include the topics of disclosure, confidentiality, maintenance, monitoring, and training provisions of this Article; 2. Identify training the Operator shall provide to ensure that the Operator’s personnel use Electronic Monitoring Devices as required under this Article and other applicable federal and state laws; 3. Explain how the maintenance and disclosure of Electronic Monitoring Records shall comply with this Article; and 4. Detail how the Operator or the Operator’s designee shall monitor each Electronic Monitoring Device at least quarterly. F. The Operator shall make all policies, training records, training acknowledgments, evaluations, and monitoring logs available to the Division in compliance with the Operator’s contracts and regular Division monitoring schedules. G. The Division shall ensure that an Operator who uses an Electronic Monitoring Device complies with all requirements of this Article during all routine monitoring inspections.