You facility recently had a privacy violation. Terry, a former employee, was terminated 6 weeks ago. Apparently, Terry had a grudge against the hospital, so he went into the radiology information system, downloaded PHI from 1,000 patients, and then posted the information on his personal website. One of the current employees, Sean, who knew Terry, just happened to visit Terry's website to see if it said what he was doing now. Sean saw an inflammatory story about the hospital and some PHI posted on Terry's website. Sean immediately reported the breach to the privacy and security officers.
1. What legal issues are involved in this situation?
2. What steps would this facility need to take during its investigation?
3. What happens after you complete the investigation?