b. First Offense, Willful Attend refresher training course within two – months. Additional sanctions ranging from letter of reprimand in personnel file to termination, based upon severity of offense. c. Subsequent Violations Combination of required attendance at refresher – training course and possible employee discipline ranging from letter of reprimand in file to termination of employment, based upon the number of previous violations, presence or lack of willfulness and other mitigating or aggravating circumstances. d. Each instance of workforce disciplinary action regarding the privacy of PHI is to be documented in a written or electronic record by the Privacy Official. The Sanctions log will contain the following information: i. Name of employee ii. Description of the violation iii. Level of breach or violation iv. Location of breach of violation v. Date and time of breach or violation vi. Disciplinary action taken This documentation must be retained for six years from the date of its creation or the date when it was last in effect, whichever is later. L. TERMINATION When an employee (or other member of the workforce) of the Lab leaves or is terminated, both physical and electronic access to PHI will be denied. The Lab will use appropriate safeguards to protect the privacy of PHI when an employee (or other member of the workforce) of the Lab leaves or is terminated. M. Mitigation
b. First Offense, Willful – Attend refresher training course within two months. Additional sanctions ranging from letter of reprimand in personnel file to termination, based upon severity of offense. c. Subsequent Violations – Combination of required attendance at refresher training course and possible employee discipline ranging from letter of reprimand in file to termination of employment, based upon the number of previous violations, presence or lack of willfulness and other mitigating or aggravating circumstances. d. Each instance of workforce disciplinary action regarding the privacy of PHI is to be documented in a written or electronic record by the Privacy Official. The Sanctions log will contain the following information: i. Name of employee ii. Description of the violation iii. Level of breach or violation iv. Location of breach of violation v. Date and time of breach or violation vi. Disciplinary action taken This documentation must be retained for six years from the date of its creation or the date when it was last in effect, whichever is later. L. TERMINATION When an employee (or other member of the workforce) of the Lab leaves or is terminated, both physical and electronic access to PHI will be denied. The Lab will use appropriate safeguards to protect the privacy of PHI when an employee (or other member of the workforce) of the Lab leaves or is terminated. M. Mitigation
TVCLD%20HIPAA%20Privacy%20Manual%20%20HITECH%20UpdateFINAL.docx