Resource: Sample Investigation Checklist | COSMOS Compliance Universe

Resource: Sample Investigation Checklist

By Melissa Andrews^[1]


1. Notify Appropriate Individuals
☐	Privacy Officer
☐	Director
☐	VP
☐	CEO
☐	Compliance Committee
☐	Board of Directors
☐	Other:


2. Timeline
☐	Acknowledge Receipt of Complaint
☐	Identify Involved Parties
☐	Interview Complainant
☐	Inform Accused Supervisor
☐	Prepare Interview
☐	Notify Human Resources
☐	Inform Accused
☐	Patient Notification
☐	OCR Breach Notification


3. Investigation Documentation
☐	Interviews
☐	Screen Shots
☐	Photographs
☐	Audits
☐	Baseline/Behavior Analytics
☐	Electronic Medical Record (EMR) Documentation
☐	Business Associate Agreement
☐	Department Processes/Procedures
☐	Employee HIPAA Training
☐	Breach Analysis/Risk Assessment


4. Patient Notification Documentation
☐	Breach Letter
☐	No Breach Letter
☐	Media/Web Notice
☐	No Contact Letter


5. Mitigation Documentation
☐	Discipline
☐	Training/Retraining
☐	Process/Procedure Changes
☐	Technical Changes
☐	Corrective Action Plan


6. Standard [Facility] Privacy Policies
☐	Minimum Necessary Standard
☐	Use and Disclosure of Protected Health Information with Authorization
☐	Use and Disclosure of Protected Health Information Without Authorization
☐	Use and Disclosure of Protected Health Information for Facility Directory
☐	Use and Disclosure of PHI to Individuals involved in the Patient’s Care and for Notification
☐	Sanctions for Failure to Comply with Privacy Standards
☐	Breach Notification


7. Other Request Documentation
☐	Incident Discovery
☐	Similar Cases
☐	Previous Discipline for Similar Cases
☐	Previous Training for Similar Cases
☐	Previous Training for Department
☐	Privacy Incident Investigation Process
☐	Communications
☐	Complete File


8. TIPS
Make sure everyone knows what to do if they receive an Office for Civil Rights (OCR) letter.
Do Not Mix Cases.
Consider whether Attorney-Client Privilege is necessary.
Define Scope of Investigation early and follow it.
Do not label an incident a Breach until after Breach Analysis/Risk Assessment is completed.
Collect documentation early at time of investigation.
Treat every investigation as an OCR investigation.