Chief Privacy and Security Officer (CPSO)

The HIPAA (Health Insurance Portability and Accountability Act) Privacy Officer will oversee the company’s privacy program. The Privacy Officer will develop, manage, and implement processes to ensure the organization’s compliance with applicable federal and state HIPAA regulations and guidelines, particularly regarding the organization’s access to and use of protected health information (PHI).

Responsibilities

Policy Development & Risk Assessment

• Evaluates the organization’s existing policies and procedures for HIPAA compliance by performing HIPAA risk assessments.
• Collaborates with plan management, administration, and legal counsel to identify and address privacy policies and procedures that require improvement.
• Develops and assists with implementation of new and updated policies and procedures.
• Maintains policies and procedures related to PHI access and use; ensures strict adherence by all staff with access to PHI.
• Develop enterprise-wide strategy to protect the company's digital assets, data and IT infrastructure from cyber threats.
• Design comprehensive information security policies, standards and disaster recovery plans.
  
  

Compliance, Auditing & Breach Management

• Assesses methods and procedures used to store and transmit PHI; identifies security or other compliance risks and researches and recommends improvements.
• Maintains required records and supporting documentation including authorization forms, notices, and plan documents.
• Completes and maintains a breach investigation process and log that ensures full compliance with the Office for Civil Rights breach reporting requirements.
• Reviews and edits all Business Associate Agreements for the company.
  
  

Training, Leadership & Communication

• Develops and leads the organization’s health information privacy committee, task force, or similar group.
• Develops and provides training on health information privacy requirements and procedures.
• Communicates with individuals regarding their right to inspect, amend, and restrict access to their PHI.
• Drafts and implements procedures for addressing and resolving complaints regarding the organization’s privacy policies and procedures.
  
  

Advisory & Governance

• Serves as the internal subject matter expert on HIPAA, maintaining current knowledge of HIPAA laws and regulations, and any other applicable federal and state privacy laws or regulations.
• Reports on changes in applicable laws and regulations and provides training as needed.
• Makes or facilitates appropriate disciplinary steps and sanctions as needed when any member of the workforce fails to comply with privacy policies.
• Performs other related duties as assigned.
  
  

Required Skills

Required Competencies, Education, and Experience

• Bachelor’s degree in Human Resources or related field required.
• Minimum of three (3) years of related experience required.
• Experience with HIPAA required.
• Thorough understanding of related information privacy laws and regulations including those governing access, release of information, and security technologies.
• Excellent verbal and written communication skills with the ability to explain and present complex information clearly and thoroughly.
• Excellent organizational skills, attention to detail, and proficiency with Microsoft Office Suite or related software.
  
  

Preferred Competencies, Education, and Experience

• Certifications in privacy compliance (CHC or CHPC).
• SHRM-CP or SHRM-SCP.
  
  

Position Type/Expected Hours of Work

This is a full-time position, Monday through Friday. Occasional evening and weekend work may be required as job duties demand.

Travel

No travel is expected for this position.

Work Environment

This job operates in a professional office environment. This role routinely uses standard office equipment such as computers, phones, photocopiers, filing cabinets, and fax machines.

Physical Demands

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job.

This is largely a sedentary role; however, some filing may be required. This would require the ability to lift files, open filing cabinets and bend or stand on a stool as necessary.