ON TIME BUSINESS MANAGEMENT, A+ WORK, ON TIME, NO PLAGARIZING; ON TIME

1

4

Respond to Peoples (No less than 150 words)

Hello class,

One operational risk that stands out to me is employees accessing private health information without a work-related reason. Working in memory care makes this concern especially meaningful to me because residents and families trust staff with very personal details. That trust can be damaged when employees treat someone’s medical information like something to gossip about. For example, imagine an employee at a healthcare facility opening a neighbor’s medical record simply because they are curious about the person’s diagnosis. Even if the employee never shares the information, accessing it without a legitimate reason creates a serious privacy concern. For organizations covered by HIPAA, this also raises legal compliance issues. The U.S. Department of Health and Human Services (HHS, n.d.) explains that organizations must establish policies identifying which employees need access to protected health information based on their job duties. Ethically, I believe people deserve control over their personal information and should feel safe seeking care. The best practice I would recommend is limiting access to records based on each employee’s responsibilities, supported by regular privacy training. Having a password does not mean an employee should be allowed to view every record. Employees need to understand both what they can access and when accessing it is appropriate.

To implement this practice, I would first work with the privacy officer and IT team to review what information each position actually needs. Each employee would have an individual login, and access would be updated when someone changes roles or leaves the organization. I would also include realistic examples during orientation and short refresher sessions, such as whether it is acceptable to look up a friend’s test results.

Finally, I would have the designated privacy staff regularly review access logs and investigate unusual activity. Employees would have a clear way to report concerns, and violations would receive consistent follow-up. To me, a privacy policy only works when leaders reinforce it through everyday actions.

What do you think would be most effective in preventing employees from accessing records out of curiosity?

Respond to Seau (No less than 150 words)

Fraud and financial misconduct is one of the most significant legal and ethical operational risks in business today. Intentional conduct to deceive others for personal gain or to benefit commercially is known as fraud. Financial misconduct involves actions such as false recording, misappropriation or falsification of documents and the manipulation of financial information including the reporting of such information. Such conduct can result in a host of lawsuits, serious criminal penalties, and extensive action by a host of federal and state regulatory bodies. As noted in a recent Investopedia article on operational risk, Enron’s use of accounting statements to hide massive amounts of debt while reporting enormous profits until the house of cards collapsed and billions of wealth were destroyed for investors and employees alike is a well known example of such fraud (Segal, 2025). Such conduct is not only against the law but also goes against fundamental principles of ethics in business.

To best prevent and detect fraud a business needs strong internal controls as well as an organizational culture that is ethical. Effective internal controls assist an organization to meet their operational goals, report financial information on a reliable basis and comply with laws, regulations and other considerations. There are five key components that are included in the COSO Internal Control Model for detecting and preventing fraud in a business, the control environment, risk assessment, control activities, monitoring activities and information systems (COSO, 2013). Albrecht et al. (2024) reinforced that an organizational culture which is ethical as well as a business’ fraud prevention program will be effective in detecting and preventing fraud before losses occur.

By identifying areas of risk for fraud within your business through the means of a risk assessment, implementing a number of internal controls in order to attempt to prevent and detect any instances of fraud, and running both internal and external audits to be able to find out if there has been any sort of irregularity, you can better safeguard your company’s finances and build up a strong defense against any possible allegations of mismanagement, as well as protecting your stakeholders and upholding public trust by creating a strong internal control system and an ethical workplace (ACFE, 2024; Albrecht et al., 2024). This, in turn, can help prevent huge losses as a result of legal action being taken against a company in connection with instances of fraud.