I think a staff member at our practice violated HIPAA
Investigate promptly. Document everything. Determine if it is a reportable breach.
- 1
Act immediately
Do not wait. Interview the staff member, gather facts, and preserve any logs or records showing what was accessed. The 60-day breach reporting clock may be running.
- 2
Document the investigation
Write down everything: what happened, when, whose information was involved, how many patients, and what action was taken.
- 3
Determine if it is a reportable breach
Use our Breach Notification Checker tool or consult a HIPAA attorney. Not every violation is a reportable breach, but you must make this determination.
- 4
Take appropriate disciplinary action
HIPAA requires you to apply sanctions to workforce members who violate policies. Document the disciplinary action taken.
- 5
Retrain and update policies if needed
Identify why the violation happened and close the gap, whether through additional training, updated policies, or technical controls.
Important
If this involves a significant number of patients or sensitive circumstances, consult a HIPAA attorney before taking action.
Related
Not legal advice. Follow your organization's policies and consult counsel for legal questions.