A medical assistant opened a coworker's chart. Your audit log caught it, you sat the employee down that same week, you cut the access and filed the breach report. That part moved fast, and it moved correctly.
Eight months later a follow-up data request from the Office for Civil Rights asks what the employee told you about why they did it and what training they had. The only record is four lines in an incident log.
Nothing went wrong in March. The investigation was prompt, the sanction was applied, the notification went out on time. What went wrong is that the single most decisive twenty minutes of the whole matter left behind less evidence than the badge reader did.
The Interview Quietly Becomes the Whole File
A breach report is a summary. The investigation is that one conversation. When OCR opens a case, the data request wants your risk analysis, your sanction policy, your training records, and your account of what happened. That account traces back to a privacy officer and a workforce member in a borrowed office, usually within a week of the alert.
Nobody treats that conversation as evidence while it is happening. Yet it decides everything downstream. Whether the access was idle curiosity or a treatment purpose misunderstood. Whether the annual training was completed or clicked through. Whether a supervisor asked them to look. Whether anyone else did the same thing.
Each of those turns on wording. “I thought I was allowed to” and “I knew I was not supposed to” are two different cases. One is a training failure and one is a willful disclosure, and they drive different sanctions and a different risk assessment.
The two sentences also sit about four seconds apart in a real conversation, usually inside the same nervous answer. An employee who is frightened will offer both in the same breath and then settle on whichever one your next question rewards. Which of the two ends up in your memo has less to do with what they meant than with which half you were still holding in your head when you finally sat down to type.
So the privacy officer writes a memo that night, or three weeks later. Then come reassignments and resignations. By the time OCR circles back, the memo is the only survivor and it is a paraphrase.
Why Your Compliance Records Do Not Cover This
You have every artifact the rule names. This is not an argument that your documentation is thin.
- The audit log entry showing the access and the timestamp
- The sanction record and the termination of access
- The training completion certificate
- The four factor breach risk assessment
- The notification letters
Every one of those documents a state. Not one of them documents the explanation.
| What you hold | What it proves | What it cannot show |
|---|---|---|
| Audit log entry | The chart was opened, by whom, when | What the employee believed they were permitted to do |
| Training certificate | The module was completed | Whether any of it was understood or retained |
| Sanction record | A penalty was applied | Whether the facts supporting it were captured accurately |
| Four factor assessment | You performed the analysis | The employee's own words the analysis rests on |
A paraphrase invites the exact question you cannot answer. The follow-up is not hostile, it is procedural. What did the workforce member say about their understanding of minimum necessary? Your memo reads “employee stated they were unaware.” Unaware of what, specifically? Asked how? Volunteered, or led there by the question?
That last distinction does more work than it looks like. An admission a workforce member offers unprompted and one produced by a leading question read very differently on paper, and they are indistinguishable once both have been compressed into the same four word summary. The memo cannot tell you which one you have, because the memo is the thing that erased the difference.
You cannot go back and ask. The employee has left, or their account has hardened into something more favorable to them. That is not usually dishonesty. Eight months of retelling a story to yourself, to a spouse, to a union representative, will smooth a genuinely uncertain memory into a confident one, and the version that survives is the one that is easiest to live with.
That distance between what you know happened and what you can show happened is what turns into a corrective action plan.
Look at the bottom row. “Two of us do it all the time” is not a detail about one employee. It is a disclosure that the access pattern is systemic, and it changes the scope of your own investigation the moment you hear it. In a memo written three weeks later, it does not appear at all — not because anyone suppressed it, but because you were writing about the person in front of you and that sentence was about everyone else.
Keep a Real Record of Your Own Fact Finding
Record the internal interview, with notice, as part of the investigation. This is your own fact finding under your own privacy program, the same posture as any HR investigation. Tell the employee, note it in the file, follow your state law and your written policy.
The irony is obvious: a recording inside a privacy investigation. That is exactly why the architecture matters more here than in any other setting. A privacy office that cannot answer where its own recordings live has no business asking a workforce member about minimum necessary.
AmyNote runs on the phone already in the privacy officer's pocket. No meeting bot joins the room, nothing external gets invited, and it behaves the same in a conference room as on a call. It captures the audio, transcribes with the OpenAI Speech API, and runs the analysis through Anthropic's Claude Opus to surface what the employee said about purpose, authorization, training, and who else knew.
Privacy is the entire subject here, so here is the architecture. Both OpenAI and Anthropic contractually guarantee zero training on user data. Audio is encrypted in transit and not retained after processing. Transcripts are stored locally on device with end to end encryption. Run your own vendor analysis before the first interview rather than after — the same diligence you would apply to any system that touches an investigation file.
That record pays for itself at three moments.
- The same week. The wording of the explanation drives all four factors of the risk assessment. This is the only one of the three where the record improves the decision rather than defending it.
- At the sanction decision. Consistency across employees is the thing you will be asked to prove, and consistency is impossible to demonstrate when each case rests on a different person's summary written at a different distance from the event.
- Eight months later, inside a response window. The whole dispute is what one person said out loud in a room, and the alternative to a contemporaneous record is four lines in a log.
There is a second cost that shows up later. A corrective action plan accepted under uncertainty becomes your file. The next time a workforce access issue arises, the record says you overhauled the program — which reads as an admission that the program was the problem. The concession that closed one case becomes the history you are held to in the next one.
Getting Started
Do not wait for a reportable breach. The habit you need under a data request is not one you can adopt on the day the data request arrives.
- Start with the interviews that already happen. A minor snooping report, an access complaint, a records request question. None of these involve an open OCR case, and all of them build the workflow.
- Clear it against your own policy first. Follow your state law and your written recording policy, and tell the employee they are being recorded. Note the notice in the file.
- Summarize the same day. Pull out the stated purpose, the belief about authorization, the training recall, and who else knew — while nobody is reconstructing anything.
- File it with the rest of the investigation. When a follow-up request arrives, comparing your record against it takes minutes instead of memory.
Build the habit while the stakes are low so it is automatic when they are not. AmyNote takes about a minute to set up, and amynote.app offers a 3-day full trial with no credit card.
A resolution agreement can trace back to twenty minutes in a borrowed office. Your privacy officer may well have run that interview perfectly. The only question is whether anyone on your side kept it.
Originally published as an X Article by @AmyNoteApp.
