LOS ANGELES COUNTY
DEPARTMENT OF MENTAL HEALTH
  Policy 506.02 - Privacy Sanctions
  PROCEDURES
  1. Report and Investigation of Allegations If a workforce member believes that another workforce member has committed a violation; he/she shall report such allegation to the designated Privacy Officer. The designated Privacy Officer and the Human Resources Department shall conduct a thorough and confidential investigation of allegations of violations. The designated Privacy Officer will be responsible for notifying and submitting a final report to the Chief Information Privacy Officer. The investigation shall be conducted in accordance with applicable Human Resources Department policies.
     
    1. Notification of Complaint When the investigation has been completed and a decision related to the allegations has been reached and implemented, the designated Privacy Officer shall notify the complainant that the allegation has been investigated and appropriate action has been taken.
       
  2. Imposition of Sanctions
     
    1. In the event that an investigation initiated pursuant to this policy results in a finding by the designated Privacy Officer and the Human Resources Bureau that a workforce member did commit a violation, sanctions will be imposed against such workforce member in accordance with relevant Human Resources Bureau policies and this policy. Such sanctions may include, but are not limited to suspension of employment or termination.
       
    2. In no event will a workforce member be subject to sanctions by DMH for making disclosures as a whistleblower who acts in accordance with whistleblower requirements under the HIPAA Privacy Rule.
       
    3. In no event will a workforce member be subject to sanctions by DMH for making disclosures as a crime victim, provided such disclosures are made in accordance with the following requirements:
       
      1. The workforce member is a victim of a crime
         
      2. The workforce member makes disclosures to a law enforcement official about the suspect who allegedly committed the crime against the workforce member; and
         
      3. The PHI disclosed about the suspect is limited to:
         
        1. Name and address
        2. Date and place of birth;
        3. Social Security number;
        4. ABO blood type and Rh factor;
        5. Type of injury;
        6. Date and time of treatment;
        7. Date and time of death, if applicable; and
        8. A description of distinguishing physical characteristics including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars and tattoos
           
    4. If the workforce member who is a victim of a crime discloses more than the above information or accesses PHI that he/she is not entitled to see, he/she may be subject to discipline.
       
  3. DMH will not discipline any workforce member for properly filing a complaint or exercising other rights under the HIPAA Privacy Rule with respect to alleged unlawful activity by the County.
     
    1. In no event will a workforce member be intimidated, threatened, coerced, discriminated against or subject to other retaliatory action by DMH for any conduct described in Sections B.2, B.3 and B.4. Any disclosure made pursuant to those Sections is not a violation of HIPAA and is not subject to sanctions.
       
    2. Bad Faith Allegations Any workforce member who knowingly falsely accuses another workforce member of a violation shall be subject to disciplinary action up to and including termination.
       
  4. The Human Resources Department is responsible for documenting the outcome of all investigations conducted under this policy, including the sanctions imposed.
     
  5. Levels of Discipline The degree of the imposed sanction will depend upon the severity of the privacy breach. Sanctions become more severe for repeated infractions of policy and procedure. This policy does not mandate the use of lesser sanctions before DMH terminates an employee. At the discretion of management, DMH may terminate the employee for the first breach of the Department’s privacy or security policies or individual policies if the seriousness of the offense warrants such action.
     
  6. Serious Offenses Resulting in Suspension or Termination A workforce member may be suspended or terminated for a willful or grossly negligent breach of confidentiality, willful or grossly negligent destruction of computer equipment or data, or a knowing or grossly negligent violation of HIPAA, its implementing regulations or any other federal or state law protecting the integrity and confidentiality of PHI. A workforce member may also be suspended or terminated for a negligent breach of the Department’s standards for protecting PHI. In addition to suspension or termination, willful and grossly negligent breaches may also result in criminal prosecution.
     
    1. Cooperation with Criminal Prosecution In the event that a violation of Department policies and standards for privacy and security of PHI constitutes a criminal offense under HIPAA or other federal or state laws, the violator should expect that DMH will provide information concerning the violation to appropriate law enforcement personnel and will cooperate with any law enforcement investigation or prosecution
       
    2. Involvement in Professional Discipline In the event that a violation of Department policies and standards for privacy and security of PHI constitutes a violation of professional ethics and is grounds for professional discipline, the violator should expect that DMH will report such violations to the appropriate licensure/accreditation agencies and to cooperate with any professional investigation or disciplinary proceedings.
       
  7. Less Serious Offenses For less serious offenses, management may impose a lesser sanction, such as a verbal or written warning, verbal or written reprimand, loss of access, suspension without pay, demotion or other sanction.

DOCUMENT RETENTION
  1. This policy shall be retained for a period of at least six (6) years from the date of its creation or the date when it was last in effect, whichever is later.