Question: Assume your facility has completed the necessary steps for the Seven-Step Approach for implementing a security management process already. Your facility has policies and procedures in place that address employee misconduct in relation to privacy, security and confidentiality. All of the employees at the facility have read the policies and procedures and have signed a document stating that they understand and will abide by these standards. Read the following scenario and apply your knowledge to provide in- depth responses. Lisa, the Coding Supervisor at Davenport University Hospital, was to attend a mandatory meeting with her supervisor on Tuesday; however, she found herself without child care. Lisa brought her 10-year- old son, Matthew, with her to the meeting. He sat completing research for a school project on Lisa's computer while she attended her meeting. When Lisa was finished with her meeting, she and her son left. A few days later, Lisa was contacted regarding her access of celebrity patient records. Lisa denied the allegations as she would not break policy; however, upon further examination of how this could happen, she recalled that her son did have access to her computer. After speaking to her son and realizing he was at fault, Lisa notified the Chief Privacy Office (CPO) of the situation.

1. Explain how audit trails and data quality monitoring were applied in this particular situation to determine a breach had occurred?

2. What course of action should be taken by the CPO considering the policies and procedures that have been put in place?

3. How should access and disclosure of personal health information of celebrities be addressed in the policies and procedures? If your stance is that they do not need to be addressed specifically, then discuss in general how these items should be addressed in the policies and procedures.

4. What methods of educating the staff, other than reading the material and signing off on it, could have helped prevent such an occurrence?