Sanctions, also known as penalties or disciplinary actions, are a common requirement when implementing regulatory requirements. HIPAA Rules specifically state that a Covered Entity (i.e., a medical or dental practice) must implement policies to prevent, detect, contain, and correct privacy and security violations and apply appropriate sanctions against members of their workforce who fail to comply with policies and procedures.<\/p>\n\n\n\n
The HIPAA definition of workforce<\/em> meansemployees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity.<\/p>\n\n\n\n A recent Eagle Associates News page article Preventing HIPPA Violations<\/em> referenced a practice that was fined $125,000 for unauthorized disclosures of PHI. Another reason for the civil monetary penalty was that the practice did not sanction the provider that made the disclosures. This draws attention to the fact that no member of the practices\u2019 workforce is exempt from sanctions when they are involved in a HIPAA-related violation<\/p>\n\n\n\n Covered entities must maintain a written policy establishing a set of disciplinary actions that may be imposed when a workforce member violates its Privacy or Security policies. The policy should explain that sanctions will be applied equally to any workforce member that is at fault regardless of title or length of employment (including management and officers). The policy should further outline that the actual sanction that is imposed for a given violation will be based on the risk to the patient\u2019s PHI, repeat offenses, intent, and actual impact on PHI. The authority for imposing sanctions lies with the practice\u2019s Privacy Manager, Security Officer, and management personnel. Having multiple persons involved ensures an appropriate review of circumstances and determination of the appropriate sanction to be imposed.<\/p>\n\n\n\n Workforce members must be provided notice of possible sanctions for violations. This can be easily communicated in a confidentiality agreement that outlines the workforce member\u2019s responsibilities, and consequences for failing to comply with practice policies. <\/p>\n\n\n\n The Security Officer, Privacy Manager and\/or Compliance Committee should impose the sanction(s) that they determine to be appropriate, considering the severity of the incident, the intent of the workforce member, and the number of prior incidents in which the individual has been involved. Following are examples of possible sanctions that may be imposed:<\/p>\n\n\n\n The written policy and sample sanctions should enable a practice to determine an appropriate sanction for the incident being addressed. Again, sanctions need to be applied to all workforce members that violate HIPAA policies and procedures. Perhaps the most difficult sanctions are those that need to be applied to providers and management personnel. Due to the sensitivity and possible resistance to sanctions for providers and management personnel, it is recommended to have a discussion with compliance officers and management before violations occur.<\/p>\n\n\n\n Sanctions, also known as penalties or disciplinary actions, are a common requirement when implementing regulatory requirements. HIPAA Rules specifically state that a Covered Entity (i.e., a medical or dental practice) must implement policies to prevent, detect, contain, and correct privacy and security violations and apply appropriate sanctions against members of their workforce who fail to… Continue reading Sanction Policy and Types<\/h3>\n\n\n\n
HIPAA Sanction Examples<\/em><\/h4>\n\n\n\n
Recommended Actions for Sanctions Compliance<\/strong><\/h3>\n\n\n\n