The Administrative Requirements of the Privacy Rule stipulate that Covered Entities must have and apply appropriate sanctions against members of its workforce that fail to comply with the Covered Entity´s HIPAA policies and procedures. The sanctions policy should explain the disciplinary process for non-compliance and what sanctions can be applied depending on the culpability of the individual and the severity of any violation or breach that results from the non-compliance.