# Workforce Policies, Acceptable Use & Sanctions
This module covers the company's acceptable use policy and the consequences of HIPAA violations.
## Acceptable use policy
Company systems, credentials, and PHI access are granted for work purposes only.
**Prohibited at all times:**
- Using PHI for personal purposes
- Sharing access credentials with anyone (including colleagues)
- Bypassing security controls (e.g., disabling encryption, logging in as another user)
- Storing PHI on personal cloud services (Google Drive, Dropbox, iCloud) without approval
- Using public AI/LLM APIs (ChatGPT, Claude.ai, Gemini) for tasks involving PHI
- Accessing PHI outside your job scope (curiosity is not a HIPAA-permitted purpose)
## HIPAA violation severity and sanctions
**Level 1 — Inadvertent, corrected immediately (documented warning):**
- Single wrong-email disclosure, immediately recalled
- Brief unattended screen in a low-risk area
**Level 2 — Negligent or repeated (formal corrective action plan):**
- Repeated accidental disclosures
- Accessing PHI beyond minimum necessary
- Failure to report a known incident within 24 hours
**Level 3 — Willful or malicious (immediate termination + regulatory referral):**
- Intentional unauthorized access to PHI
- Knowingly failing to report a breach
- Selling, copying, or disclosing PHI for personal gain
- Sharing credentials that led to unauthorized access
## Termination and offboarding
When your engagement ends (employment, contract, or project):
- Return all company-owned devices within 24 hours
- Confirm in writing that PHI has been deleted from personal devices
- Your access credentials will be revoked by IT within 4 business hours of your last day
- HIPAA confidentiality obligations survive termination indefinitely
## Reporting violations
If you observe a potential violation — by yourself or a colleague — report confidentially to:
- Security Officer: j@chimaro.ai
- Privacy Officer: j@chimaro.ai
**Retaliation against good-faith reporters is strictly prohibited and is itself a Level 3 violation.**
## Attestation
Completing this module confirms you understand acceptable use requirements and sanction consequences.