Sample (Chief) Privacy Officer Job Description

Position Title: (Chief) Privacy Officer¹

Immediate Supervisor: Chief Executive Officer, (Chief) Compliance Officer, Senior Executive (Chief operating officer, CIO), (Senior) In-house Counsel, or Practice Manager

Position Overview: Under HIPAA (the Health Insurance Portability and Accountability Act of 1996) every healthcare organization must designate a privacy official . The privacy official may have other titles and duties in addition to his/her privacy official designation in a typical practice or organizational setting. In terms of HIPAA compliance, the privacy official shall oversee all ongoing activities related to the development, implementation and maintenance of the practice/organization's privacy policies in accordance with applicable federal and state laws. HIPAA for purposes of this document includes HIPAA, HITECH and Omnibus requirements.

General Purpose: The Privacy Officer is responsible for the organization's Privacy Program including but not limited to daily operations of the program, development, implementation, and maintenance of policies and procedures, monitoring program compliance, investigation and tracking of incidents and breaches and insuring patients' rights in compliance with federal and state laws.

Responsibilities:

• Builds a strategic and comprehensive privacy program that defines, develops, maintains and implements policies and processes that enable consistent, effective privacy practices which minimize risk and ensure the confidentiality of protected health information (PHI), paper and/or electronic, across all media types. Ensures privacy forms, policies, standards, and procedures are up-to-date.
• Works with organization senior management, security, and corporate compliance officer to establish governance for the privacy program.
• Serves in a leadership role for privacy compliance
• Collaborate with the information security officer to ensure alignment between security and privacy compliance programs including policies, practices, investigations, and acts as a liaison to the information systems department.
• Establishes, with the information security officer, an ongoing process to track, investigate and report inappropriate access and disclosure of protected health information. Monitor patterns of inappropriate access and/or disclosure of protected health information.
• Performs or oversees initial and periodic information privacy risk assessment/analysis, mitigation and remediation.
• Conducts related ongoing compliance monitoring activities in coordination with the organization's other compliance and operational assessment functions.
• Takes a lead role, to ensure the organization has and maintains appropriate privacy and confidentiality consents, authorization forms and information notices and materials reflecting current organization and legal practices and requirements.
• Oversees, develops and delivers initial and ongoing privacy training to the workforce.
• Participates in the development, implementation, and ongoing compliance monitoring of all business associates and business associate agreements, to ensure all privacy concerns, requirements, and responsibilities are addressed.
• Works cooperatively with the Health Information Management (HIM) Director and other applicable organization units in overseeing patient rights to inspect, amend, and restrict access to protected health information when appropriate.
• Manages all required breach determination and notification processes under HIPAA and applicable State breach rules and requirements.
• Establishes and administers a process for investigating and acting on privacy and security complaints
• Performs required breach risk assessment, documentation, and mitigation. Works with Human Resources to ensure consistent application of sanctions for privacy violations
• Initiates, facilitates and promotes activities to foster information privacy awareness within the organization and related entities.
• Maintains current knowledge of applicable federal and state privacy laws and accreditation standards.
• Works with organization administration, legal counsel, and other related parties to represent the organization's information privacy interests with external parties (state or local government bodies) who undertake to adopt or amend privacy legislation, regulation, or standard.
• Cooperates with the U.S. Department of Health and Human Service's Office for Civil Rights, State regulators and/or other legal entities in any compliance reviews or investigations.
• Serves as information privacy resource to the organization regarding release of information and to all departments for all privacy related issues.

Qualifications:

• Baccalaureate degree in health information management or a related healthcare field.
• Knowledge and experience in state and federal information privacy laws, including but not limited to HIPAA.
• Demonstrated organization, facilitation, written and oral communication, and presentation skills.
• Recommended privacy certification such as Certified in Healthcare Privacy and Security (CHPS) and/or other healthcare industry related credential, e.g. RHIA, RHIT.

Additional Requirements:

• Demonstrated skills in collaboration, teamwork, and problem-solving to achieve goals
• Demonstrated skills in verbal communication and listening
• Demonstrated skills in providing excellent service to customers
• Excellent writing skills
• A high level of integrity and trust
• Extensive familiarity with health care relevant legislation and standards for the protection of health information and patient privacy
• Health care legal, operational, and or financial skills.

Notes

^[1] The title for this position will vary from organization to organization, and may not be the primary title of the individual serving in the position. "Chief" would most likely refer to very large integrated delivery systems. The term "privacy officer" is specifically mention in the HIPAA Privacy Regulation.