Privacy Officer Job Descriptions
| Privacy Officer #1 | |
| Privacy Officer #2 |
Privacy Officer Roles and Responsibilities
Responsible for entity's privacy program and associated policies.
Role
--Chairing and/or providing leadership to the entity's privacy
board/committees, workgroups, and taskforces charged with creating
and implementing an enterprise-wide privacy program.
--Maintaining compliance with federal and state laws related to
privacy, security, confidentiality, and protection of information
resources.
--Servicing as a liaison to regulatory and accrediting bodies for
matters relating to privacy and security.
--Collaborating with other designated individuals to ensure policies
and procedures relating to (cyber) privacy and security are developed
and implemented for the organization's hardware, software and telecommunications
systems.
--Collaborating with other departments such as legal counsel, corporate
compliance, human resources, accounting, IT/IS, registration, medical
records, and medical services to ensure compliance with specific
privacy requirements.
--Monitoring all departmental systems development and operations
for security and privacy compliance.
--Developing corporate privacy policies and procedures that include
but are not limited to:
- Notice of information practices
- Handling of protected health information
- Use and disclosure of PHI
Individual requests for restriction of use and disclosure of PHI - Access, inspection and copying of PHI
- Amendment and correction of PHI
- Accounting of disclosures
- Record keeping procedures and Administrative procedures
--Developing, implementing and administering a corporate-wide request for access/disclosure verification procedure that reasonably verifies the identity of the individual or entity requesting access or disclosure and /or legal authority to request the protected health information. Such a procedure, shall at minimum address requests for information in the following circumstances:
- Individual requesting access who is the subject of the protected
health information
Emergency circumstances - Power-of-attorney/legal authority
- Public health oversight bodies
- Coroners and medical examiners for law enforcement
- Government health data systems for specific classes of information
- Disclosure required by other laws
- Financial institution non-routine transaction requests
- Judicial and administrative proceedings and
- Research related requests.
--Coordinating with the corporate compliance officer regarding
corporate complaint and information program for:
--Receiving complaints and/or questions related to any aspect of
the entity's privacy program
--Providing information in response to internal and external inquiries
regarding the entity's corporate privacy policies and procedures
or notice of information practices
--Ensuring that the corporate notice of information practices include
the method for contracting the program or individual for privacy
related matters and
--Recording and documenting all complaints/questions and their resolution
--Ensuring through investigation of all allegations of non-compliance
with the corporate privacy policies or notice of information practices.
--Reporting on a periodic basis the status of the privacy program
to the board, CIO or other responsible individual or committee.
--Providing strategic guidance to corporate officers regarding the
organizations information resources and technology.
--Assisting the security officer and other affected personnel with
the development and implementation of an information infrastructure.
--Providing leadership in the planning, design, and evaluation of
the organization's privacy and security related projects.
--Developing and implementing a corporate-wide privacy training
program and, in conjunction with the security officer or other individual
charged with security oversight, a cyber security awareness and
training program that includes the following components:
- Initial training of all employees relating to the privacy and
cyber security program
Privacy and cyber security training for all new employees - Upon changes in corporate privacy policy or procedure, restraining of directly affected employees;
- Mandated privacy retraining for all employees on a periodic basis, but, at a minimum, every three years;
- Privacy training to all members of the workforce, including all employees, volunteers, trainees, and other persons under their direct control of an entity on an unpaid basis, who are not business partners but are likely to have contact with PHI
- Coordinating with the chief compliance officer and HR to develop appropriate sanctions for failure to comply with the corporate privacy policies and procedures by all members of the entity's workforce or the entity's business partners.
- Coordinating with the chief compliance officer and HR to ensure no intimidating, discriminatory, or other retaliatory actions occur against a person who files, testifies, assists or participates in any investigation, compliance review, proceeding or hearing related to a privacy violation or opposed any unlawful act or practice.
- Implementing and overseeing the development and application of corrective action procedures that are designed to mitigate any deleterious effects of a use or disclosure of PHI by members of the entity's workforce business partners. This includes exercising any affirmative duty to address breaches of contract with respect to the treatment of protected health information by the entity's business partners.
- Establishing an internal privacy audit program to ensure enterprise-wide compliance to corporate privacy policies.
- Coordinating external audit processes of business partners for the purposes of monitoring and detecting any misconduct or noncompliance with corporate privacy policies.
- Coordinating the development of privacy risk assessment policies and procedures designed to measure the performance and quality of the company's privacy program.
- Periodically revising the privacy program in light of changes in laws, regulations, or company policy.
- Coordinating with the corporate compliance officer regarding the development of procedures for documenting and reporting self-disclosures of any evidence of privacy violations to legal counsel, and if appropriate to the appropriate government regulatory body according to corporate policy.
Privacy Officer #2
The Corporate Privacy Officer oversees the development and implementation of corporate-wide privacy principles, policies and practices. The Corporate Privacy Officer is responsible for coordinating all corporate activities with privacy implications, as well as monitoring all of the organization’s services and systems to assure meaningful privacy practices. The Corporate Privacy Officer also advocates and protects patient privacy by serving as a key privacy advisor for patients, handling disputes and managing patient requests regarding their medical record.
Requirements
--Coordinates corporate privacy activities which include overseeing
the establishment, implementation and adherence to corporate policies
on patient privacy, confidentiality and releas of patient information
--Reviews new or revised government healthcare laws and regulations
pertaining to patient privacy to determine if new policies or modifications
of current policies are needed
--Conducts privacy risk assessments and internal privacy audits
--Manages patient privacy-disputes and requests for changes to their
medical record
--Oversees the development and delivery of privacy training and
awareness.
Works closely with Health Information Management, Information Technology
and Marketing departments
--Ensures that record custodians correctly protect and archive patient
information
--Ensures that the organization’s privacy protections keep
pace with technological advances
--Participates in outside healthcare organizations for keeping updated
on privacy developments and best practices for patient privacy
-- Reports to the organization’s executive officers on emerging
legislation/regulations and how the company is currently dealing
with privacy issues
General Skills
--Good verbal and written communication skills
--A high level of integrity and trust
--Knowledge and understanding of technology-related law and public
policy experience, clinical research and related issues
Professional Certifications or Experience
Registered Health Information Administrator (RHIA)