Sanctions for privacy and security violations

Purpose. HIPAA requires the practice to apply appropriate sanctions to workforce members who fail to comply with privacy and security policies, and to document them.

Levels. Sanctions are applied consistently according to the seriousness of the violation: coaching and retraining for an honest mistake, written warning for carelessness, and suspension or termination for deliberate or repeated violations.

Documentation. Every sanction is recorded by Human Resources with the date, the policy involved and the action taken, and kept for six years.

No retaliation. Nobody is sanctioned for reporting a suspected violation in good faith, including one they made themselves.