chart . The ISO gave the report to the Privacy Officer ( PO ) . The PO will follow up with the employee who accessed the medical record to get a written response and authority for accessing the record . Employee admitted he looked at the record without a need to know . ;