HIPAA Sanctions Policy — EMStool / Cadence

1. Purpose

This policy establishes the sanctions that EMStool LLC ("the Organization") will apply to members of its workforce who fail to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), its implementing regulations (45 CFR Parts 160 and 164), and the Organization's HIPAA policies and procedures.

The HIPAA Security Rule (45 CFR §164.308(a)(1)(ii)(C)) requires covered entities and business associates to apply appropriate sanctions against workforce members who fail to comply with security policies and procedures.

2. Scope

This policy applies to all workforce members of EMStool LLC, including but not limited to:

Full-time and part-time employees
Contractors and consultants with access to Protected Health Information (PHI) or electronic PHI (ePHI)
Volunteers and interns
Officers, directors, and owners
Third-party users granted access to any Cadence deployment

3. Definitions

Term	Definition
PHI	Protected Health Information — individually identifiable health information transmitted or maintained in any form or medium.
ePHI	Electronic Protected Health Information — PHI stored or transmitted in electronic form.
Workforce Member	Employees, volunteers, trainees, and other persons whose conduct is under the direct control of the Organization.
Security Incident	The attempted or successful unauthorized access, use, disclosure, modification, or destruction of ePHI.
Sanctions	Disciplinary actions taken against workforce members who violate HIPAA policies.

4. Policy Statement

EMStool LLC is committed to protecting the privacy and security of all Protected Health Information. All workforce members are required to comply with HIPAA regulations and all related organizational policies. Violations will result in sanctions proportionate to the nature, severity, and circumstances of the violation.

Sanctions will be applied consistently regardless of the workforce member's position, tenure, or relationship to the Organization.

5. Violation Categories and Sanctions

Violations are classified into three tiers based on severity, intent, and impact.

Tier	Description	Examples	Sanctions
Tier 1 — Minor	First-time, unintentional violation with no evidence of bad intent and minimal or no patient harm.	Leaving a workstation unlocked briefly Discussing a patient in a semi-public area Accessing a patient record without documenting justification Sharing login credentials with a colleague once	Verbal warning Mandatory retraining on applicable HIPAA policy Documented in personnel file
Tier 2 — Moderate	Repeated or more serious violation, or a single violation with potential for patient harm or reputational damage.	Repeated Tier 1 violations after retraining Accessing records of patients not under your care Sending PHI to a personal email or unsecured device Failing to report a known security incident Sharing PHI verbally with unauthorized persons	Written warning placed in personnel file Mandatory HIPAA retraining Temporary suspension of PHI access privileges Supervisory monitoring for 90 days Potential suspension without pay (1–3 days)
Tier 3 — Severe	Intentional, malicious, or grossly negligent violation; violation resulting in confirmed patient harm; violation involving theft or sale of PHI.	Intentional unauthorized access or disclosure of PHI Selling, trading, or exploiting PHI for personal gain Deliberately sabotaging security systems or audit logs Repeated Tier 2 violations with no improvement Falsifying documentation related to a security incident Accessing a former patient's records for non-clinical purposes	Immediate suspension of all system access Termination of employment or contract Referral to law enforcement if criminal activity is suspected Civil and/or criminal liability may be pursued Notification to HHS Office for Civil Rights if required

6. Reporting Violations

All workforce members have an obligation to report known or suspected HIPAA violations. Reports may be made to:

Security Officer: Jacob Russell — [email protected]
Anonymous reporting: Written report delivered directly to Security Officer

Retaliation against any workforce member who reports a HIPAA violation in good faith is strictly prohibited and will itself be treated as a Tier 2 or Tier 3 violation depending on severity.

7. Investigation Procedure

Report received — Security Officer acknowledges receipt within 24 hours.
Preliminary review — Within 5 business days, Security Officer determines if a violation occurred and its initial tier classification.
Investigation — Security Officer reviews audit logs, interviews relevant parties, and documents findings. Completed within 15 business days.
Determination — Security Officer issues written findings and recommended sanctions.
Sanction applied — Sanctions imposed within 5 business days of determination.
Documentation — All findings and actions recorded and retained for minimum 6 years per HIPAA requirement.

8. Appeals Process

A workforce member who believes a sanction was applied unfairly may submit a written appeal to the Security Officer within 10 business days of receiving the sanction notice. The appeal must:

State the grounds for the appeal
Include any supporting documentation

The Security Officer will review the appeal and issue a written response within 15 business days. The Security Officer's decision is final.

9. Documentation and Retention

All sanctions, investigations, training records, and related documentation will be:

Maintained in a secure personnel file
Retained for a minimum of 6 years from the date of creation or the date it was last in effect, whichever is later (per 45 CFR §164.316(b)(2))
Available for review by HHS upon request

10. Policy Review

This policy will be reviewed annually and updated as necessary to reflect changes in law, regulation, or organizational operations. The Security Officer is responsible for maintaining and distributing this policy.

Security Officer Signature

Jacob Russell, Security Officer

Date

June 1, 2026

HIPAA Workforce Sanctions Policy