- Citation
45 CFR 164.308(a)(1)(ii)(C)- Standard
- Security management process, 164.308(a)(1)(i)
- Safeguard
- Administrative safeguards
- Type
- Required
What the rule says
Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate.45 CFR 164.308(a)(1)(ii)(C), as currently in force
In plain English: Decide in advance what happens to staff who break your security and privacy rules, write it down, tell everyone, and then do it consistently when it happens. Keep a record each time.
What it means in practice
- Covers both Security Rule violations (this specification) and Privacy Rule violations (164.530(e) has a parallel requirement).
- Describes tiers: an accidental first offense is treated differently from deliberate snooping or selling records.
- Names who decides and who's told, and applies to everyone including owners and physicians.
- Is applied and documented when something happens: the sanction log is the evidence.
- Connects to training: staff sign that they've read it.
What happens when someone peeks. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- The policy itself, approved and dated.
- Acknowledgments from workforce members.
- The sanction log, including incidents where the sanction was a documented warning.
- Consistency: similar violations treated similarly.
Where entities get caught
OCR's 2026 settlement with a small dental practice found it could produce no written privacy policies, including none for patient access requests or breach notification, which necessarily includes no sanction policy. Corrective action plans routinely require a sanction policy and reporting of workforce violations to OCR within 30 to 60 days.
Snooping cases, where staff viewed records of family, neighbors or celebrities, are the classic test: OCR asks what the policy said and what was done.
How to meet it at a small organization
One page is enough: the rules it enforces, three or four tiers of response from retraining to termination, who decides, how it's recorded, and a statement that it applies to everyone. The log can be a spreadsheet. The hard part is applying it to the long-serving receptionist or the owner's spouse; the rule expects you to.
Under the proposed Security Rule update
The proposal keeps the sanction requirement and would require all policies, including this one, to be in writing and reviewed at least every 12 months. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: The AI Policy Builder drafts a sanction policy from your answers about roles and decision-makers, an in-house CISO reviews it, acknowledgments are tracked per person and the incident log records each application.