Scenario B:

Employee Jane's manager called the Privacy Office at Health Facility A to report that Jane inadvertently faxed dermatology patient X's entire medical record to Health Facility A's endocrinology department. Patient X was not under the care of any of the endocrinology care team. Jane called the endocrinologist department to inform them of the misfax. The front desk associate at the endocrinologist department confirmed that they shredded patient X's medical record.

1. A list of questions you would like to ask the employee during your investigation.
2. Please answer and explain:
3. Did the employee violate the health facility's policy?
4. Did the employee violate HIPAA?
5. Did the employee violate any California privacy and/or security laws?
6. Was this a reportable breach to 1) OCR, 2) CDPH, and/or 3) patient(s) affected?
7. Fill out the data elements of the form and indicate:
8. The category determination of the employee's potential violation.
9. Sanction impacting factors.
10. Sanctions applied based on your assessment of the potential violation.