If several medical records are missing and physicians are taking original records home, what should the privacy professional do first?

Developing an audit process is the appropriate action to take first in this scenario. An audit process allows the privacy professional to systematically examine the circumstances surrounding the missing medical records. This will help identify the extent of the problem, determine how many records are missing, and assess the potential impact on patient confidentiality and compliance with regulations.

An audit can reveal critical information about why original records are being taken home by physicians, which can inform future preventive measures. It also provides a documented approach to understanding the issue, which is essential for reporting to management or taking further corrective actions. This data-driven approach is fundamental in establishing a foundation for any subsequent steps that may need to be taken, such as developing monitoring tools, creating shadow records to temporarily address the issue, or evaluating if discipline is warranted based on the outcomes of the audit.