From alert to resolution, with the evidence already assembled.
A structured path: alert, context, investigation, decision, resolution, report, so every case ends in a documented outcome.
An access event is flagged for review.
A privacy analyst opens the queue and sees a new flagged event with a priority score attached, not just a raw log line.
Billing Coordinator · No prior investigations
Admitted to Med/Surg Unit 4, current visit
Reached out to Billing supervisor to confirm relationship to patient. Confirmed the patient shares a household with the employee. No documented care or billing reason for the access. Escalating for HR and Privacy Officer review.
This is a workflow illustration, not a finalized feature.
It’s meant to demonstrate how Intruno structures an investigation: the specific fields, layout, and evidence types will be refined as the product evolves.
A privacy finding is only the beginning. What happens next is where most programs struggle.
Detection surfaces a potential violation. Investigation determines what actually happened. In most healthcare privacy programs, that investigation happens across email, spreadsheets, shared folders, and phone calls, and the resulting record reflects it.
Every investigation follows the same architecture regardless of violation type
What changes is the evidence and the stakeholders, not the structure.
Privacy finding received
A structured privacy finding arrives from Patient Privacy Monitoring with clinical context, behavioral baseline, care relationship check, and the policy triggered already attached. The analyst begins at a decision point, not a blank screen.
Case created and assigned
The finding becomes a formal case with a unique reference number, a named owner, and a status. Additional stakeholders can be added as the investigation develops, with their roles clearly defined inside the case.
Evidence gathered and organized
Access logs, identity records, care team rosters, screenshots, correspondence, and any other supporting material attach directly to the case. Evidence is tagged, organized, and retrievable from a single view.
Collaboration and review
Cases requiring input from multiple stakeholders (Privacy Officer, HR, Legal, supervisor) are managed through task assignments and case notes rather than email chains. Every participant works from the same record. Every action is logged.
Breach risk assessment
For cases that may constitute a reportable breach, the four-factor HIPAA breach risk analysis is conducted inside the case: structured, documented, and attached to the investigation record. The outcome and reasoning become part of the permanent case file.
Resolution and corrective action
Every case closes with a documented resolution: what the finding was, what was determined, what action was taken, who was notified, and what the final outcome was. Resolutions include education, corrective action, escalation, litigation tracking, and no-action-required.
Sanctions and corrective actions tracked
When a case results in a sanction or a corrective action, whether that is employee education, policy acknowledgment, or a corrective action plan, those steps are tracked inside Intruno. The case stays open until each one is confirmed complete and documented.
Case closed: documentation complete
When a case closes in Intruno, the investigation record is complete: the finding, evidence, timeline, every decision and its rationale, every stakeholder action, the disposition, and corrective action outcome. Documentation was built as the work happened.
Audit-ready record immediately available
The closed case becomes part of Intruno’s compliance record. When OCR requests documentation of an investigation, or when an internal audit reviews program performance, the case record exists in full: organized, timestamped, and structured exactly as regulators expect to see it.
Built around the operational work of a healthcare privacy investigation
Each capability exists because privacy investigation work has specific operational requirements that generic case management systems were not designed to meet.
Evidence management
Every piece of supporting material (access logs, clinical records, policy references, communications, notes) attaches to the case and stays there, organized by type and immediately retrievable.
What’s needed for a regulatory response is always where it should be.Case assignment and ownership
Every case has a named owner accountable for its progress. Additional stakeholders (Privacy Officers, Compliance, Legal, HR) are added with specific roles and visible due dates.
Cases move forward because accountability is clear.Automatic investigation timeline
Every action taken inside Intruno is recorded in the case timeline: notes added, evidence attached, tasks assigned, stakeholders notified, decisions made, approvals given. Cannot be altered retroactively.
Any analyst can orient to a case’s full history from the timeline alone.Task management
Investigation tasks (supervisor notifications, employee interviews, breach risk assessments, HR escalations, corrective action confirmations) are created inside the case with assigned owners and due dates.
Every step required to close a case is tracked and visible.In-case collaboration
Notes, questions, and decisions from every stakeholder are recorded as case notes, not in a separate email thread that lives outside the official record. Every note is part of the case.
Multi-stakeholder investigations generate one record.Resolution and disposition tracking
Every case closes with a documented outcome. Disposition options (education, corrective action, policy acknowledgment, escalation, no action required) each produce a structured record with reasoning captured alongside the outcome.
Every case closes with a complete, defensible record.Audit history
Every action, decision, participant, and timestamp is captured automatically in the case audit log. It cannot be altered. The result is a chronological, immutable record of the investigation. Exportable for regulatory response or legal review.
The record is complete and immediately available.Notifications
Stakeholders are notified when a task is assigned, when a case they’re involved in changes status, or when their input is required, without the Privacy Analyst sending a separate email.
The right people know what’s happening without making the case owner a full-time communicator.Escalation pathways
Cases requiring escalation to HR, Legal, connected GRC platforms, or leadership follow a defined pathway from inside the investigation workspace. Escalation is documented as a case stage with named recipients.
Escalation is a structured step with a documented record.Program health at a glance
Filter investigations by time period and status. Summary, status, severity, and category charts sit above the full case list.
A guided path to resolution
Summary, Notify, Resolution, Investigative Reporting, and Information Category tabs take the analyst from opening a case to closing it, including status, resolution notes, incident level, and reportability.
Every violation type creates its own investigation demands
The detection is the same process for every finding. The investigation that follows depends on the nature of the access, the people involved, and the stakes.
High StakesVIP patient access investigation
VIP patient access investigation
What happened: A clinical employee accessed the record of a patient with a VIP designation (an elected official, executive, or public figure) with no documented care relationship.
Why the investigation matters: VIP access investigations carry reputational and legal risk beyond a standard privacy violation. They frequently involve multiple stakeholders and may require breach risk assessment under compressed timelines.
How Intruno helps: The investigation workspace keeps all stakeholders coordinated in one record. Legal, Privacy, and leadership each contribute and review without parallel email threads. The complete record from finding to disposition is available if regulatory response is required.
High VolumeNeighbor and family member access investigation
Neighbor and family member access investigation
What happened: An employee accessed the records of a person they know personally (a neighbor, family member, or coworker) with no care relationship. This is the most common category of privacy violation.
How Intruno helps: The case structure is consistent: the analyst knows exactly what steps are required and in what order. Employee education or corrective action is assigned as a tracked task. The disposition is structured and documented. Every case closes at the same standard.
Sensitive Record Behavioral health record investigation
Behavioral health record investigation
What happened: A clinical employee accessed a behavioral health record, including records subject to 42 CFR Part 2, without a direct care relationship in that specialty.
How Intruno helps: The case captures the regulatory context alongside the investigation findings. Compliance can review and document the applicable framework within the case.
Policy ExceptionBreak-the-glass* access review
Break-the-glass* access review
What happened: An employee used emergency override access to open a patient record outside their normal care relationship, a legitimate clinical mechanism that can also be misused.
How Intruno helps: The investigation captures the clinical justification provided by the employee, the validation or non-validation of that justification, and the determination. If justified, the review record is closed with documentation of the validation.
Termination RiskFormer employee access investigation
Former employee access investigation
What happened: An employee who was terminated or resigned accessed patient records after their employment ended, through credential deprovisioning delays, a shared account, or another means.
How Intruno helps: The investigation workspace coordinates all involved parties from a single record. Evidence of access, the former employee’s access history, and the deprovisioning timeline are attached to the case. Escalation to HR or Legal is documented.
Policy ViolationEmployee self-access investigation
Employee self-access investigation
What happened: An employee accessed their own patient record in the EHR, a defined policy violation regardless of intent or role. Self-access cases can appear routine but occasionally signal a more serious issue.
How Intruno helps: The access context is already attached to the finding. The investigation captures the circumstances, the interview with the employee, the determination of intent and impact, and the corrective action.
Privacy investigations involve more than one team. Intruno keeps them all in one record.
A privacy investigation rarely stays within the privacy team alone. Depending on the case, it may involve compliance, legal counsel, HR, security, and executive leadership, each with a distinct role.
Opens and owns the case
Gathers evidence, logs findings, documents the investigation timeline, assigns tasks to other stakeholders, and manages the case through to closure.
Reviews and approves escalations
Reviews cases requiring supervisory approval before escalation or disposition. Approves breach risk assessment outcomes and breach notification decisions.
Ensures regulatory adequacy
Reviews cases for regulatory context and documentation adequacy. Ensures the case record meets standards required for OCR response or internal audit.
Litigation and notification review
Consulted on cases involving litigation exposure, potential breach notification obligations, or employment law considerations.*
Corrective action and discipline
Notified when a case requires employee corrective action, a formal disciplinary process, or a termination review. HR actions are tracked as tasks within the case.
Technical security concerns
Engaged on cases involving shared credentials, post-termination access, or unusual access patterns suggesting a technical security concern. Security review is documented as part of the case record.
Every stakeholder works from the same case record.
No duplicate documentation. No briefing documents created to communicate what already exists in the case.
What changes when investigations are managed in one place
Operational improvements accumulate across every case the privacy team handles: in time spent, decisions made, and documentation produced.
Faster case closure
When evidence is organized, ownership is clear, and tasks have due dates, cases move forward without delays from unclear next steps.
Investigations that previously required assembling a case record after closure close with documentation already complete.Significantly less email
Case notes replace status update emails. Task notifications replace follow-up reminders. Evidence attachments replace forwarded files. The investigation conversation that previously happened across email threads happens inside the case.
The email thread that used to constitute the investigation record becomes a case that holds the investigation record.Clear ownership at every stage
Every case has a named owner. Every task has an assigned person and a due date. Leadership and the Privacy Officer have visibility into the current state of every open case without asking for a status update.
Cases don’t stall in handoffs because ownership is explicit at each stage.Documentation that holds up
Investigation documentation built inside Intruno is timestamped, attributed, and structured. It reflects what actually happened during the investigation, not what was written up afterward based on memory.
The case record is the investigation record, not a summary of it.Audit readiness without preparation
Because every investigation step is captured as it happens, audit readiness is not a periodic project. When an OCR request arrives, the relevant case records are already organized, complete, and retrievable.
Regulatory response becomes a retrieval exercise, not a documentation project.Visibility that improves the program
Investigation data (case volume, average closure time, violation type distribution, repeat offenders, corrective action outcomes) feeds back into program reporting and analytics.
Investigation records become the evidence base for program improvement decisions.