VHA can impose penalties ranging from a documented reprimand to removal from federal service, with suspensions and demotion in between. The harshest outcomes are reserved for willful snooping, selling or disclosing protected health information, and repeat offenses. Most cases are decided through VA's internal disciplinary process, not criminal prosecution, and the agency must weigh 12 mitigation factors before choosing a penalty. This article explains the mechanisms, the documented patterns, and the practical boundaries of that authority.
How the disciplinary mechanism actually works
Discipline at VHA runs through two linked authorities. The first is Title 38 personnel law, which gives the Secretary broad power to discipline employees providing direct patient care. The second is the standard federal framework under Title 5, including the Douglas factors: 12 criteria managers must weigh when selecting a penalty. Those factors include the seriousness of the offense, the employee's job level, past discipline, and potential for rehabilitation.
Privacy violations enter this pipeline through several channels. The Privacy Office investigates suspected unauthorized access to electronic health records. The Office of Inspector General can open a parallel criminal or administrative case. An administrative investigation board may convene for serious incidents. Each channel produces evidence that a deciding official then uses to select a penalty from the table of penalties.
The table of penalties is the operational core of the system. It lists offenses and a range of typical penalties: oral admonishment, written reprimand, suspension of 1 to 30 days, demotion, and removal. The range matters because the same offense can draw a reprimand in one case and removal in another. The deciding official must document which Douglas factors drove the choice upward or downward.
One structural detail is counterintuitive: the Privacy Officer who finds the violation usually does not choose the penalty. Privacy staff investigate and refer; a separate deciding official imposes discipline. This separation exists so that investigators are not also judges.
Quantified context: what actual case outcomes look like
VA publishes semiannual reports on privacy and information security violations, and the pattern is consistent across recent cycles. Unauthorized access to a record without a legitimate business need typically draws a written reprimand or a short suspension for a first offense. Disclosure of information to an unauthorized third party draws harsher treatment, often a suspension of 7 to 14 days. Repeated snooping after a prior warning frequently results in removal.
The volume is substantial. VA's privacy reports have documented tens of thousands of reported privacy incidents per reporting period, with unauthorized access making up a large share. Only a small fraction of those reports result in formal discipline, because many incidents are accidental, immediately mitigated, or do not meet the threshold for referral.
Timelines vary by complexity. A straightforward unauthorized-access case may move from referral to decision in 30 to 90 days. Cases involving OIG referral, administrative investigation boards, or union representation can stretch to 6 to 12 months. An employee proposed for removal keeps working through the advance-notice period, typically at least 30 days, unless the agency places them on administrative leave.
The financial stakes are real. A 14-day suspension for a GS-11 employee costs roughly USD 3,000 to 4,000 in forfeited pay. Removal costs the full salary and benefits, plus replacement and training costs that commonly run 50 to 200 percent of annual salary for specialized clinical roles.
Comparison table: disciplinary options and their typical use
| Action | Typical trigger | Severity | Appeal route |
|---|---|---|---|
| Oral admonishment | First-time accidental disclosure | Lowest | Grievance only |
| Written reprimand | Unauthorized access, no prior record | Low | Grievance; MSPB rarely |
| Suspension, 1-14 days | Disclosure to third party or repeat access | Moderate | Grievance; MSPB appeal |
| Suspension, 15-30 days | Willful snooping, sensitive record | High | MSPB appeal |
| Demotion | Pattern of violations, supervisory role | High | MSPB appeal |
| Removal | Selling data, retaliation, repeat after warning | Highest | MSPB appeal |
This table reflects typical practice, not a fixed schedule. The table of penalties sets ranges, and deciding officials must justify departures in writing.
Timeline: from reported violation to final penalty
| Stage | Typical duration | What happens |
|---|---|---|
| Detection and reporting | Same day to 30 days | Privacy Office logs incident |
| Investigation | 30 to 120 days | Records pulled, employee interviewed |
| Proposal notice | 1 to 3 weeks after investigation | Employee receives written proposal |
| Employee response | At least 7 days, often 14 | Oral and written reply allowed |
| Deciding official decision | 30 to 60 days after response | Penalty selected and issued |
| Appeal window | 30 days for MSPB | Employee files or accepts |
| Final resolution | 3 to 12 months total | Appeal decided or settlement reached |
Union-represented employees get additional steps, including the right to representation during investigatory interviews. That alone can add weeks.
Edge cases that change the outcome
Several scenarios shift the penalty significantly. Disclosing information about a celebrity, public figure, coworker, or family member draws heightened scrutiny because the motive is clearly personal. Accessing records of a current or former intimate partner is treated as an aggravating factor and has led to removal in documented cases.
Selling or receiving payment for protected health information is among the most serious categories. The HIPAA criminal penalty structure allows fines up to USD 50,000 and imprisonment up to 1 year for knowingly obtaining or disclosing individually identifiable health information; penalties escalate for offenses committed under false pretenses or with intent to sell. VHA can pursue removal simultaneously with a criminal referral.
A less obvious edge case: employees who report a colleague's violation using proper channels are protected by whistleblower statutes. Retaliation against a reporter is itself a separate removable offense, so a manager who punishes a subordinate for reporting snooping faces discipline on two fronts.
Another wrinkle involves contractors and trainees. VHA can bar them from facilities and terminate their agreements, but the disciplinary process for a federal employee does not apply. Contractors face action through their employer and through suspension or debarment.
Deliberate falsification of training certifications, such as signing off on privacy training that was not completed, is treated as a separate integrity offense. It often converts a minor training lapse into a removable offense.
Misconceptions worth correcting
The most common misconception is that a first privacy violation automatically ends a career. In practice, accidental disclosures with quick self-reporting and no prior record often draw reprimands rather than removal. VHA's own guidance encourages employees to self-report promptly, and self-reporting is a recognized mitigating factor.
A second misconception is that HIPAA itself drives VHA discipline. It does not, directly. HIPAA governs covered entities and sets civil money penalties against organizations. VHA employees are disciplined under VA directives, Title 38, and Title 5. HIPAA provides the legal backdrop and the criminal referral pathway, but the penalty table is VA's.
A third misconception is that removal is final. Employees can appeal to the Merit Systems Protection Board within 30 days. Removal can be reversed or mitigated on appeal if the agency failed to weigh the Douglas factors properly or violated procedural rights.
A fourth misconception is that union membership shields an employee from discipline. It provides representation and procedural rights, not immunity. Documented cases show union members removed for privacy violations following a full negotiated process.
One professional caveat: the absence of discipline does not mean the conduct was acceptable. Many violations are resolved through retraining, counseling, or a documented verbal discussion that never enters the formal disciplinary file. Employees reading these outcomes sometimes conclude that minor snooping is tolerated. It is not.
Practical actions for employees and supervisors
Employees who suspect they accessed a record improperly should self-report to the Privacy Office the same day. Prompt self-reporting is documented as a mitigating factor and can move an outcome from suspension to reprimand.
Supervisors who receive a privacy complaint should not investigate independently. They should route it to the Privacy Officer and the OIG and avoid discussing it with the subject of the complaint. Informal handling can taint the case and expose the supervisor to a retaliation finding.
Employees facing a proposed disciplinary action should request a copy of the proposal in writing and respond within the stated deadline, which is typically 7 to 14 days. Requesting union representation at any investigatory interview is a procedural right, not an admission of guilt.
Practical thresholds that matter:
Self-report before the Privacy Office discovers the incident; that timing is frequently cited in mitigation. Respond to a proposal notice within the stated deadline; missing it waives the oral reply. File an MSPB appeal within 30 days of an adverse action; later filings are generally dismissed. Request representation before the first investigatory interview, not after. Document every business need before accessing a record; retrospective justification is rarely persuasive. Report suspected retaliation immediately; it is a separate offense.
Limitations of what can be concluded
The ranges above reflect documented patterns, not a rigid formula. Deciding officials have wide discretion, and outcomes vary by facility, by supervisor, and by the strength of documentation. Confidential settlement agreements often keep final terms out of public view, so published reports understate the number of removals.
The table of penalties changes over time and is supplemented by local facility policies. Treat any specific penalty prediction with caution. The mechanism is stable; the numbers are not.
VHA's disciplinary authority over privacy violations is real, structured, and increasingly enforced through automated audit tools that flag unusual record access. The practical takeaway is that the system rewards prompt self-reporting and punishes concealment far more than it punishes the underlying error.
This article provides general educational information about federal administrative processes, not legal advice or a prediction of any specific outcome. Employees facing potential discipline should consult a qualified employment attorney or their union representative, and anyone in immediate crisis should contact local emergency services.