This overview summarizes Blackstar’s approach to suspected violations of privacy, security, contractual, and operational requirements. It explains principles of reporting, non-retaliation, proportionate corrective action, and accountability without exposing personnel matters or disciplinary records.
This public overview summarizes Blackstar’s approach and does not replace Blackstar’s internal policies, procedures, contractual obligations, or client-specific requirements.
Our Commitment
Blackstar’s accountability program requires workforce members to follow applicable privacy and security policies and establishes a process for evaluating suspected violations and applying proportionate protective and corrective measures. Program requirements protect good-faith reporting and preserve separate incident-response, breach-assessment, mitigation, and legal obligations.
How We Approach This Area
- Prompt reporting. Workforce requirements call for prompt reporting of suspected policy violations, unauthorized activity, and privacy or security concerns.
- Non-retaliation. Blackstar prohibits intimidation, coercion, discrimination, or retaliation for protected good-faith complaints, reports, participation, or lawful opposition.
- Immediate protection. Access restriction, credential protection, workflow suspension, or other containment may occur before final fact-finding when necessary to protect PHI.
- Fair evaluation. Decisions consider reliable facts, applicable requirements, intent, sensitivity, scope, potential harm, reporting, cooperation, prior conduct, and consistency.
- Proportionate response. Corrective measures may include coaching, retraining, increased oversight, access restriction, role change, suspension, termination of a relationship, technical remediation, or referral when required.
- Separate legal processes. A policy violation is evaluated separately from whether an event is a security incident, impermissible use or disclosure, or breach.
- Confidentiality. Case information and personnel records are limited to those with a legitimate need to know and avoid unnecessary PHI.
- Effectiveness follow-up. Corrective-action requirements include completion and effectiveness review and may lead to changes in risk analysis, safeguards, procedures, or training.
Disciplinary criteria, case history, fact-finding methods, and personnel outcomes remain confidential.
Roles and Responsibilities
Company responsibilities assign intake, evaluation, sanctions, and non-retaliation protections to privacy and security governance; technical information and protective controls to engineering and security operations; appropriate personnel or contractor records to workforce governance; and security-event containment to incident-response functions.
Review and Continuous Improvement
The program calls for periodic and event-driven review after significant cases, retaliation concerns, material incidents, workforce changes, or evidence of inconsistent or ineffective corrective action. Lessons may inform policies, training, safeguards, and governance.
Working With Covered Entities
Where a violation affects a covered entity, applicable agreements and incident processes govern coordination through authorized contacts. Confidential workforce actions remain restricted except as authorized or required, while relevant customer protection, mitigation, and notice information is addressed separately.
Additional Information
Additional information may be made available to customers and qualified prospective customers through an appropriate security, legal, or procurement review. Certain implementation details are restricted to protect Blackstar’s systems, customers, and security operations.