HIPAA Sanctions Policy: How to Handle Staff Violations Fairly and Document Them

Sooner or later, almost every practice manager deals with it. A staff member looks up a neighbor’s chart, leaves a patient list on the printer, or emails PHI to the wrong address. What happens next is not only an HR decision. HIPAA requires you to have, and actually apply, a sanctions policy.

As you plan 2027 HIPAA training, now is a good time to review your sanctions policy. A clear policy, paired with good training, tells staff what is expected and what happens if they fall short. It also gives you a documented record if the Office for Civil Rights (OCR) ever reviews your compliance.

What HIPAA requires

The sanctions requirement appears in both the Privacy Rule and the Security Rule.

The Privacy Rule

A covered entity “must have and apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures” or the Privacy Rule’s requirements (45 CFR 164.530(e)(1)). The covered entity must also “document the sanctions that are applied, if any” (164.530(e)(2)).

The Security Rule

The Security Rule lists a sanction policy as a required part of the security management process. Covered entities and business associates must “apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures” (45 CFR 164.308(a)(1)(ii)(C)).

Two protected situations

The Privacy Rule says sanctions do not apply to certain protected actions. These include whistleblower disclosures that meet the conditions of 45 CFR 164.502(j) and filing a complaint with HHS or taking part in an investigation, which 164.530(g)(2) protects against retaliation. Your policy should say this explicitly.

Why sanctions and HIPAA training go together

A sanctions policy only works if staff know the rules they are being held to. That is why HIPAA training and sanctions are linked:

• Training explains the policies. The sanctions policy explains the consequences.
• Training records show that a workforce member was told the rules before a violation happened.
• After an incident, retraining is often part of the response.

The Privacy Rule requires training for all workforce members on your PHI policies and procedures (45 CFR 164.530(b)). The Security Rule requires a security awareness and training program for all workforce members, including management (45 CFR 164.308(a)(5)). Include your sanctions policy in that training so no one is surprised. (Not sure how often to retrain? See How Often Is HIPAA Training Required?)

How to build a practical sanctions policy

HIPAA does not prescribe specific penalties. It requires sanctions that are “appropriate.” Most practices use a tiered approach based on intent and harm. The tiers below are examples only. Work with your HR advisor or counsel to fit them to your employment policies and state law.

Tier 1: Unintentional, low-risk mistakes

Examples: leaving a screen unlocked, discussing a patient where others might overhear, or misdirecting a fax that is quickly recovered.

Typical response: coaching, a documented verbal warning, and targeted retraining.

Tier 2: Careless or repeated violations

Examples: repeated Tier 1 issues, sharing passwords, or sending PHI by unsecured email against policy.

Typical response: a written warning, required retraining, and closer monitoring.

Tier 3: Intentional violations without malice

Examples: “snooping” in the records of a coworker, family member, or well-known patient out of curiosity.

Typical response: final written warning, suspension, or termination, depending on the facts.

Tier 4: Intentional violations for personal gain or to cause harm

Examples: selling patient information or using PHI for identity theft or harassment.

Typical response: termination. Consider whether referral to law enforcement is appropriate, and assess breach notification duties.

Apply it consistently

Repeated security violations can also point to gaps your HIPAA risk analysis should capture. Whatever tiers you use, apply them the same way regardless of role. Physicians, managers, and owners are part of the workforce too. Inconsistent discipline undermines both your compliance program and your employment practices.

Documenting sanctions

The Privacy Rule requires you to document any sanctions applied. Required documentation must be kept for six years from the date it was created or last in effect, whichever is later (45 CFR 164.530(j)(2)). For each incident, record:

• Date and description of the violation
• The workforce member involved and their role
• How the incident was investigated
• The sanction applied and the policy tier
• Any retraining assigned, with completion date
• Whether the incident was assessed as a possible breach

Store sanctions records with your HIPAA documentation, not only in personnel files, so you can produce them in an audit.

Don’t forget the breach question

A workforce violation may also be a breach of unsecured PHI. Under the Breach Notification Rule, an impermissible use or disclosure is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI has been compromised (45 CFR 164.402). HHS explains the process on its Breach Notification Rule page. Handle discipline and breach assessment as two separate steps. Real enforcement outcomes are summarized in our HIPAA violations, settlements, and case studies post.

A year-end sanctions policy review

• Confirm you have a written sanctions policy covering both privacy and security
• Check that it protects whistleblowers and complainants
• Make sure it applies to every role, including leadership
• Add the policy to your 2027 HIPAA training and onboarding
• Review this year’s incidents. Were sanctions applied and documented?
• Confirm sanctions records are kept for six years
• Assign retraining to anyone involved in an incident this year

Make your HIPAA training the foundation

Evolve eLearning has provided healthcare compliance training since 2003. Enroll your whole team online, assign courses by role, and keep completion certificates for your records, with access valid for 365 days. Choose HIPAA Awareness ($15 per learner) for limited-PHI roles, or HIPAA for Covered Entities ($20 per learner) for staff who handle PHI daily. Volume discounts are available. Explore HIPAA privacy and security training.