Whether a covered entity must ensure HIPAA Privacy Rule compliance by its workforce, adopt a sanction policy, and apply appropriate sanctions against non-compliant employees

QUESTIONS PRESENTED I. Pursuant to federal regulations collectively known as “the HIPAA Privacy Rule,” must a covered entity like the Howard Center ensure compliance therewith by its workforce, adopt a sanction policy, and apply appropriate sanctions against all members of its workforce who fail to comply? II. Did the Arbitrator manifestly disregard the law by prohibiting the Howard Center from imposing even minimal discipline on an employee, who indisputably violated patient privacy in violation of federal law, when “appropriate sanctions” are mandatory under the HIPAA Privacy Rule?