Standard Privacy/Information Security Sanctions Table - Employee Suspension orFinal Category or Verbal Warning and Written Warning Written Warning and Involuntary Termination Incident Type possible Privacy/IS Retraining and Required Privacy/IS Retraining Required Privacy/IS Retraining General Overview Use when incident appears Use when breaches of Privacy Use when breaches of Privacy Use when breaches of Privacy or unintentional, unknowing, and or Security result in low or no or Security result in significant Security results in personal gain, Column results in low or no harm to harm to patient or Hospital. harm to patient or Hospital. malicious intent, significant harm to description → patient. (may be unintentional) patient, high liability to , required reporting and/or notification Scenarios ↓ Physical Security Improper Improper disposal of PHI, no Willful neglect in disposal of PHI disposal of PHI possible harm to patient or low or no harm to patient or Hospital Hospital Failure to secure Failure to secure either Willful neglect in failure to Willful failure to secure non- ePHI (includes electronic or non-electronic secure either electronic or non- electronic PHI/Confidential unauthorized PHI/Confidential information PHI/Confidential information (significant harm to removal of PHI (low/no harm to information (low or no harm to patient/Hospital and/or breach from property) patient/Hospital and/or no patient/Hospital and/or no notification) breach notification) breach notification) Electronic Failing to sign off or lock a given Willful neglect in failing to sign Allowing another user to utilize the Security computer terminal when not in off or lock a given computer system via his/her access code use terminal when not in use (password) resulting in wrongful Failure to sign off (without access by another) access of PHI or highly or lock computer confidential employee / business information. Deliberately attempting to wrongfully access another employee’s email, files or any hospital system, including EHR. Failure to secure PHI Failure to secure electronic Willful neglect in failing to Failure to secure electronic (e.g. copied to PHI/confidential information (no secure electronic PHI/Confidential information mobile media, risk of harm to patient/Hospital PHI/Confidential information (significant harm to patient/Hospital not enabling and/or no breach notification) (low or no harm to patient and/or breach notification) proper access /hospital and/or no breach restrictions, etc.) notification)
Standard Privacy/Information Security Sanctions Table - Employee Category or Incident Type Verbal Warning and possible Privacy/IS Retraining Written Warning and Required Privacy/IS Retraining Suspension orFinal Written Warning and Required Privacy/IS Retraining Involuntary Termination General Overview Column description → Scenarios ↓ Use when incident appears unintentional, unknowing, and results in low or no harm to patient. Use when breaches of Privacy or Security result in low or no harm to patient or Hospital. Use when breaches of Privacy or Security result in significant harm to patient or Hospital. (may be unintentional) Use when breaches of Privacy or Security results in personal gain, malicious intent, significant harm to patient, high liability to , required reporting and/or notification Physical Security Improper disposal of PHI Improper disposal of PHI, no possible harm to patient or Hospital Willful neglect in disposal of PHI low or no harm to patient or Hospital Failure to secure ePHI (includes unauthorized removal of PHI from property) Failure to secure either electronic or non-electronic PHI/Confidential information (low/no harm to patient/Hospital and/or no breach notification) Willful neglect in failure to secure either electronic or PHI/Confidential information (low or no harm to patient/Hospital and/or no breach notification) Willful failure to secure PHI/Confidential information (significant harm to patient/Hospital and/or breach notification) Electronic Security Failure to sign off or lock computer Failing to sign off or lock a given computer terminal when not in use Willful neglect in failing to sign off or lock a given computer terminal when not in use (without access by another) Allowing another user to utilize the system via his/her access code (password) resulting in wrongful access of PHI or highly confidential employee / business information. Deliberately attempting to wrongfully access another employee’s email, files or any hospital system, including EHR. Failure to secure electronic PHI (e.g. copied to mobile media, not enabling proper access restrictions, etc.) Failure to secure electronic PHI/confidential information (no risk of harm to patient/Hospital and/or no breach notification) Willful neglect in failing to secure electronic PHI/Confidential information (low or no harm to patient /hospital and/or no breach notification) Failure to secure electronic PHI/Confidential information (significant harm to patient/Hospital and/or breach notification) non- non-