When employees use a personal device for work, they should have no expectation of privacy in AIM business information that is stored on or transmitted through the device, AIM applications, or AIM systems. AIM may access, review, retain, or disclose that business information as permitted by law and organizational policy. This statement does not grant AIM access to unrelated personal content except as permitted by law and necessary to protect AIM information.

Employees must comply with all applicable laws regarding device use. Employees whose duties involve driving may not use a handheld electronic device while operating a vehicle. Any permitted hands-free use must comply with applicable law, AIM policy, and the requirements of the employee’s role. Employees are personally responsible for any violations, fines, or liabilities resulting from improper device use while driving.

Employees must immediately notify management if a work-related personal device is lost, stolen, damaged, hacked, or otherwise compromised. To protect agency information, AIM may require the removal of agency data or a factory reset of the device when necessary. AIM is not responsible for the loss of personal data, applications, or settings resulting from security measures taken to protect agency information.

Upon resignation, termination, or at AIM's request, employees must immediately remove or allow AIM to remove all agency information, applications, and accounts from personal devices.

This section supplements, and does not repeat, the general confidentiality requirements in Section V and the security requirements in Sections IX and X. It applies specifically to access to electronic health records, role-based permissions, secondary profiles or caseloads, and Electronic Visit Verification. Employees must follow the more restrictive requirement when system-specific instructions and a general handbook rule address the same activity.

Access to electronic health records is granted based on job responsibilities and operational need. By accessing the EHR, employees may have access to confidential information regarding the people we support, families, employees, and agency operations. This information must always be safeguarded. Employees are prohibited from accessing, using, disclosing, or sharing confidential information unless it is necessary to perform their assigned job duties.

Employees may only access records and information necessary to perform their assigned duties. Unauthorized access, review, or disclosure of records is strictly prohibited. Employees assigned multiple responsibilities or programs may be granted additional system access. By accessing a secondary profile or caseload, employees acknowledge that access is required for legitimate work purposes. Employees must return to their primary profile when additional access is no longer needed.

Certain services require Electronic Visit Verification (EVV) in accordance with Medicaid requirements. Employees assigned to services requiring EVV may be required to use a mobile application to record service-related information, including: