We learned an employee accessed a customer's patient data without authorization

1. 1

   Suspend the employee's access immediately

   While facts are gathered, ensure they cannot access more data. Preserve audit logs before they rotate or expire.

2. 2

   Interview and document

   Find out what they viewed, how many patients were involved, and why. Document timestamps from system logs.

3. 3

   Notify your customer if required

   Your BAA likely requires you to inform covered entity customers of unauthorized access. Your counsel can help with timing and wording.

4. 4

   Complete sanctions and retraining

   Apply consistent disciplinary action and close gaps, such as stricter access reviews or alerts for unusual access patterns.

Not legal advice. Follow your organization's policies and consult counsel for legal questions.