A psychometrist discovers that a colleague has been sharing patient test scores with unauthorized staff members.What is the most appropriate first step?