Sanction policy and sanction log

Granite City Family Dental — Sanction policy. Version 1.0. Effective November 1, 2026. Approved by Dr. Maria Lindqvist, Owner.

Authority: 45 CFR 164.308(a)(1)(ii)(C) (Security Rule sanctions); 45 CFR 164.530(e) (Privacy Rule sanctions); 45 CFR 164.530(g) (no retaliation); 45 CFR 164.502(j) (whistleblower protection).

1. Policy

Every workforce member of Granite City Family Dental who fails to follow the privacy and security policies in this binder is subject to sanctions. Sanctions are applied consistently, in proportion to the violation, and are documented. The purpose is not punishment for its own sake; it is to make clear that patient information is protected and that the policies are real.

2. Who is covered

This policy applies to every workforce member: employees, owners, providers, contractors, temporary staff, volunteers and students, whether full-time or part-time, on site or remote.

Owners and providers are held to the same standard as staff. Where an owner is the person who would ordinarily impose the sanction, the other owner(s), the practice's counsel, or the Privacy Officer with counsel determine the sanction, and the record is kept in the same log.

3. What counts as a violation

Examples (not a complete list): looking at a record without a work reason, including a family member's, a co-worker's or a public figure's record; sharing a password or using someone else's login; leaving PHI visible, unattended or in the trash; sending PHI to the wrong person by fax, email, text or mail; posting or responding about a patient on social media or a review site; taking PHI home or onto a personal device against policy; disabling antivirus, encryption or screen lock; failing to complete required training; failing to report a known incident; and any use or disclosure of PHI for personal gain, curiosity or malice.

4. Sanction ladder

Sanctions follow the ladder below. The step chosen depends on whether the act was accidental, careless or intentional, the harm caused, the number of patients affected, whether the person reported it promptly, and any prior violations. Repeated violations move up the ladder.

1. Verbal counseling with documented retraining.
2. Written warning placed in the personnel file.
3. Suspension without pay and removal of system access pending review.
4. Termination of employment or contract; referral to law enforcement or licensing board where required.

Intentional access or disclosure for personal gain, curiosity or malice skips to tier 4.

5. Who imposes sanctions

Sanctions are imposed by Privacy Officer with the owner's approval. Before a sanction is imposed the facts are established (system audit trail, witness accounts, the person's own account), the person is given a chance to respond, and the decision is written down. The Security Officer removes or suspends system access at the same time as a suspension or termination, the same day. Where a violation is also a possible breach, the breach notification policy runs in parallel and does not wait for the sanction decision.

6. No retaliation and no waiver

No one will be intimidated, threatened, coerced, discriminated against or otherwise retaliated against for exercising a HIPAA right, filing a complaint with the practice or with HHS, taking part in an investigation or review, or opposing in good faith an act they reasonably believe is unlawful (164.530(g)). Retaliation is itself a violation of this policy and is sanctioned. The practice never requires a patient to waive the right to complain as a condition of treatment or payment (164.530(h)).

A workforce member who, in good faith, reports a believed violation of law or professional standards to a health oversight agency, a public health authority, an attorney or a licensing body is protected under 164.502(j) and is not sanctioned for that report.

7. Documentation

Every sanction, including verbal counseling, is recorded in the log below and kept for six years. The record names the person, the date, the violation, the sanction, who imposed it and the person's acknowledgment. The count of sanctions imposed each year is reported at the annual review, where the committee also checks that like cases received like sanctions.

8. Workforce acknowledgment

Every workforce member signs the confidentiality agreement and policy acknowledgment in document 26 at hire and after each annual training; that signature confirms they have read this sanction policy.

9. Sanction log

10. Approval

Policy approver: Dr. Maria Lindqvist, Owner

Signature: ______________________________ Date: ______________

Owner / principal: Dr. Maria Lindqvist, Owner and Dentist

Signature: ______________________________ Date: ______________