Incident Response & Operations
Sanction Policy
A HIPAA-required policy for disciplining workforce members who violate security policies.
A Sanction Policy is a HIPAA Security Rule administrative safeguard requiring organizations to apply appropriate disciplinary measures against workforce members who fail to comply with security policies and procedures.
Documented, consistently enforced sanctions signal that safeguarding ePHI is taken seriously, and they work hand in hand with workforce training to reinforce a culture of compliance. It is one of the documents OCR asks for alongside the HIPAA risk analysis.