A graduated sanction ladder composed for your clinic, acknowledgment tracked per person, and open sanction evaluations that cannot quietly stay open.
A sanctions policy is a set of decisions, not a document. The test is whether you can say what happens when an RBT shares PHI in a group chat, before it happens rather than after.
Your sanction policy covers workforce scope, the principle that sanctions run through ordinary discipline rather than a parallel process, a graduated five-tier ladder rendered from your own settings, violation categories mapped to those tiers, adjudication of every event, the protection that reporting in good faith is never sanctionable, the six documentation elements OCR expects, written workforce acknowledgment, referral to authorities, and the duty to report.
Six requirements:
Acknowledgment coverage runs per member against your active roster, so a new hire who never acknowledged shows as a gap rather than being absorbed into a percentage.
The system tracks that the policy exists, that everyone acknowledged it, and that evaluations resolved. It does not judge whether a sanction was applied appropriately or whether adjudication was fair. Those are decisions your officers make, and the record shows they were made and when.
A finalized, adopted policy with a defined ladder. A per-member acknowledgment record. A trail of sanction evaluations with resolution. The documentation elements OCR asks for, on file rather than assembled after a complaint.
The regulation: read the rule behind this control.
No pressure, no pitch. Book a 20-minute call, or just email a question and we'll point you the right way.