I think a staff member at our practice violated HIPAA

1. 1

   Act immediately

   Do not wait. Interview the staff member, gather facts, and preserve any logs or records showing what was accessed. The 60-day breach reporting clock may be running.

2. 2

   Document the investigation

   Write down everything: what happened, when, whose information was involved, how many patients, and what action was taken.

3. 3

   Determine if it is a reportable breach

   Use our Breach Notification Checker tool or consult a HIPAA attorney. Not every violation is a reportable breach — but you must make this determination.

4. 4

   Take appropriate disciplinary action

   HIPAA requires you to apply sanctions to workforce members who violate policies. Document the disciplinary action taken.

5. 5

   Retrain and update policies if needed

   Identify why the violation happened and close the gap — whether through additional training, updated policies, or technical controls.

Not legal advice. Follow your organization's policies and consult counsel for legal questions.