HIPAA Glossary · Security Rule concepts
Sanction policy
The required written policy for disciplining workforce members who violate privacy and security policies.
Context
Required by §164.308(a)(1)(ii)(C). The sanction policy must exist and must be applied when triggered — unapplied sanction policies in resolution agreements are a specific finding, because they signal that violations are tolerated. The policy must also be fair and consistent, not performative.
Related terms
- Workforce — Employees, volunteers, trainees, and others under the entity's direct control.
- Administrative safeguards — The management layer of the Security Rule — risk analysis, workforce security, training, incident procedures, contingency planning, evaluation.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.