How to Maintain a HIPAA Sanctions Log in Practice

When OCR investigates a covered entity, investigators routinely ask for the sanctions log. The most common response from small clinics is a folder containing only the sanctions policy, with no documented enforcement actions at all.

That gap is a finding. It does not mean violations were never addressed — it means the clinic cannot prove they were, which in an investigation amounts to the same thing.

What the requirement actually says

Two separate HIPAA rules impose sanctions obligations.

The Privacy Rule (45 CFR § 164.530(e)) requires covered entities to apply appropriate sanctions against workforce members who fail to comply with privacy policies or the Privacy Rule, and to document each sanction. The Security Rule (45 CFR § 164.308(a)(1)(ii)(C)) imposes a parallel requirement as part of the security management process.

Neither rule prescribes the severity of sanctions, the number of tiers in the policy, or the format of the log. Both require that sanctions be applied — not just defined — and that the application be documented.

What counts as a sanction in a small clinic

The sanctions spectrum is wider than most small clinics realize.

Sanction Type	When Typically Used
Documented verbal warning	First-time, minor, unintentional policy lapse
Written warning	Repeated minor violations or a single incident with limited PHI exposure
Mandatory retraining	Any violation where knowledge gap is identified as a contributing factor
Role reassignment	When the workforce member’s current role creates ongoing access risk
Access restriction	When the violation involved unauthorized access to PHI outside the scope of duty
Suspension	Serious violations, willful non-compliance, or repeat violations after written warning
Termination	Severe violations, malicious misuse of PHI, or failure to respond to prior sanctions

A clinic that has never documented any sanction other than a termination is showing that only the most extreme violations receive a formal response — which leaves the entire middle of the spectrum unmanaged.

What the sanctions log must contain

The log does not need to be a complex database. A controlled document — a spreadsheet with restricted access, a section of the compliance management system, or a locked binder — is sufficient. What matters is that each entry contains the required information.

Each entry in the sanctions log should include:

• Date of incident — when the violation or policy breach occurred, not when it was discovered (note both if they differ)
• Date reported or discovered — when the Privacy Officer or supervisor became aware
• Workforce member role — the job title or function of the person involved; the log should use roles rather than names to limit PHI exposure within the log itself, though an internal cross-reference to the full investigation file is acceptable
• Policy or rule violated — cite the specific clinic policy or regulatory provision (for example, “Minimum Necessary Access Policy” or “45 CFR § 164.502(b)”)
• Brief description of the incident — factual and specific, without including PHI
• Investigation steps taken — what was reviewed, who was interviewed, and what evidence was gathered
• Sanction applied — the specific sanction, including any conditions (completion of retraining, probation period, access restrictions)
• Date sanction communicated — when the workforce member was notified
• Workforce member acknowledgment — note whether the member signed an acknowledgment, declined, or the outcome of any HR meeting
• Privacy Officer sign-off — name and date; if an alternate decision-maker handled the case, note that here
• Follow-up date — any scheduled check-in or confirmation that retraining was completed

The log entry is a summary. The investigation file holds the supporting documentation. Linking them allows production of either document without producing everything.

What not to include in the log

The sanctions log is a compliance record, not a complete HR record. Including more personal information about the workforce member than necessary creates a PHI risk inside the log itself.

Do not include: the workforce member’s full name in the primary log (use the role and an internal case number), the content of the PHI that was accessed or disclosed, details about the workforce member’s personal circumstances, or unrelated HR matters that surfaced during the investigation.

The full name and detailed facts belong in the investigation file, which is stored separately and controlled by the Privacy Officer.

The question of personnel files

State employment law governs what can be placed in a personnel file and how long it must be retained. Some states give employees the right to review and respond to items in their personnel file; some restrict what types of records can be combined. Before copying a sanctions log entry to a personnel file, confirm that your state’s employment law permits the combination and that doing so does not create disclosure obligations you are not prepared to meet.

The safest approach for most small clinics is to maintain the compliance sanctions log as a separate controlled document and to note in the personnel file only that a compliance-related corrective action was taken on a given date, with a cross-reference to the compliance file for details.

First-time versus recurring violations

Every sanctions policy needs an escalation path. The challenge for small clinics is applying that path when the workforce is small enough that every enforcement decision feels personal.

For a first-time, unintentional violation, a documented verbal warning paired with retraining is proportionate. The log entry should note that the incident was investigated, that no malicious intent was identified, and that corrective steps were taken.

For a second violation by the same person — even a minor one — the response should escalate. The log entry should reference the first incident by case number, document that the escalation was applied because of the prior violation, and specify what additional steps are required.

The escalation rationale belongs in the log. An auditor reviewing the sanctions history must be able to follow the decision-making without requesting a separate explanation.

The special case: when the Privacy Officer is the subject

Small clinics sometimes have a Privacy Officer who is also the practice administrator — or a physician who also handles administrative functions. When that person commits the violation, the clinic needs a documented alternate decision-maker.

The sanctions policy should identify who steps in when the Privacy Officer is the subject of an investigation. In a solo-physician practice, that may be the physician. In a small group, it may be a designated deputy or an outside compliance consultant.

When the alternate is used, the sanctions log entry must note:

• That the Privacy Officer was recused and why
• Who served as the alternate decision-maker
• That the alternate reviewed the investigation file and made the sanctioning decision independently

The alternate’s sign-off goes on the entry in place of the Privacy Officer’s. The documentation of the recusal is what makes the process defensible — it shows the clinic has thought through the conflict-of-interest scenario in advance.

Practical maintenance

Three habits keep the log current without significant administrative burden.

Open a log entry at the same time you open an investigation. Even if the investigation has not concluded, creating the entry immediately captures the incident date and initial facts while they are fresh. The entry stays “open” until the sanction is finalized.

Review the log at every quarterly compliance meeting. Confirm that all open entries have been closed, follow-up steps completed, and the log reflects the current state of each case.

Store the log with the evidence binder, not with general administrative files. OCR audit requests for enforcement documentation typically carry a 10-business-day response window. Knowing exactly where the log is matters under that pressure.

What the log demonstrates

A policy says what should happen. The log proves what did happen. Investigators look for the gap between documented policy and documented practice. A complete, consistent sanctions log — even one with entries for minor violations handled with a verbal warning — is evidence that the program is active, that policy is enforced, and that the clinic takes compliance seriously as an operational matter rather than a paper exercise.