If you suspect someone is violating the facility's privacy policy, you should:

Ignoring a suspected privacy violation can make an employee complicit in a breach and may violate the facility's HIPAA compliance obligations and workforce policies.

Independently surveilling a colleague without authorization is inappropriate, potentially illegal, and outside the scope of an employee's role - proper reporting channels exist for this purpose.

Reporting suspected privacy violations to a clinical supervisor or privacy officer is consistent with HIPAA compliance requirements and most facility privacy policies, which establish formal reporting channels to ensure proper investigation. Individual employees are not authorized to conduct independent investigations, as this could compromise due process and evidence integrity. Timely reporting allows the facility to fulfill its legal obligation to investigate and mitigate potential breaches.