Margaret found herself facing a tough situation. Her babysitter called and cancelled 10 minutes before she needed to leave for work. She had a meeting with her manager that she could not miss. She brought her 12-year-old daughter, Molly, with her to work. Margaret sat Molly down in front of the computer in the office, telling her to play solitaire and surf the Internet until she returned. After the meeting, they went home.

Three days later, the chief privacy officer (CPO) confronted Margaret about her access of patient information. Several patients had received phone calls telling them that they had avian flu. The patients had all panicked. Margaret was the only user who had access to all of the patient accounts. She denied the accusations, but then realized that her daughter had had access to her computer. She relayed the story to her CPO.

What actions should be taken as a CPO?

What could have been done to prevent this situation from happening?