For any offense, a preliminary investigation will precede assignment of level of violation. Level of Violation Examples Minimum Disciplinary/Corrective Action Level I Misdirected faxes & emails First offense: written counseling by Program Failing to log-off, close or Director and notification of secure a computer with PHI DIO. displayed Second offense within one Leaving a copy of PHI in a year: written warning by non-secure area Program Director with Dictating or discussing PHI in copy to DIO and GMEC. a non-secure area (lobby, Notify Privacy Officer of hallway, cafeteria, elevator, all incidents. etc.) Failing to redact or patient information for operational/business uses Transmission of PHI using an unsecured method, Leaving detailed PHI on an answering machine. Improper disposal of PHI. Level II Requesting another individual First offense: written to inappropriately access warning by Program patient information Director with copy to DIO. Inappropriate sharing of ID/ Written warning plus password with another corrective action plan by worker or encouraging DIO and copy to Chair and worker to share ID/password President of Staff. Failure to secure data on mobile devices through Notify Privacy Officer of encryption/password all incidents. protection. Level III Releasing aggregate patient Written notification of data without facility approval probation by Program for research, studies, Director, or Department publications, etc. Chair, or DIO (See GME Policy Manual), with Accessing or allowing access notification of President of to PHI without having a Medical-Dental Staff; or legitimate reason President of Giving an individual access to Staff appoints ad your electronic signature hoc group for investigation, Accessing patient information potential disciplinary due to curiosity or concern,
For any offense, a preliminary investigation will precede assignment of level of violation. Level of Violation Examples Minimum Disciplinary/Corrective Action Level I Misdirected faxes & emails Failing to log-off, close or secure a computer with PHI displayed Leaving a copy of PHI in a non-secure area Dictating or discussing PHI in a non-secure area (lobby, hallway, cafeteria, elevator, etc.) Failing to redact or patient information for operational/business uses Transmission of PHI using an unsecured method, Leaving detailed PHI on an answering machine. Improper disposal of PHI. First offense: written counseling by Program Director and notification of DIO. Second offense within one year: written warning by Program Director with copy to DIO and GMEC. Notify Privacy Officer of all incidents. Level II Requesting another individual to inappropriately access patient information Inappropriate sharing of ID/ password with another or encouraging to share ID/password Failure to secure data on mobile devices through encryption/password protection. First offense: written warning by Program Director with copy to DIO. Written warning plus corrective action plan by DIO and copy to Chair and President of Staff. Notify Privacy Officer of all incidents. Level III Releasing aggregate patient data without facility approval for research, studies, publications, etc. Accessing or allowing access to PHI without having a legitimate reason Giving an individual access to your electronic signature Accessing patient information due to curiosity or concern, Written notification of probation by Program Director, or Department Chair, or DIO (See GME Policy Manual), with notification of President of Medical-Dental Staff; or President of Staff appoints ad hoc group for investigation, potential disciplinary worker worker
2015HSManualFINAL.docx