sanctions

·          Applied against any staff member who violates the Agency’s Privacy Practices

·          Determined based on the nature of the violation, its severity and whether it was intentional or unintentional

·          Documented and retained for 6 years