What is a HIPAA Privacy Official?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice; instead, all information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.  

The HIPAA Privacy Rule at 45 CFR 164.530(a) states that a covered entity “must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity.”

Another Privacy Rule provision, 45 CFR 164.530(i), in turn, states that “A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of the HIPAA Privacy Rule and the HIPAA Breach Notification Rule. The policies and procedures must be reasonably designed, taking into account the size and the type of activities that relate to protected health information undertaken by a covered entity, to ensure such compliance.”

So, the HIPAA Privacy Official must develop and implement policies and procedures, taking into account the organization's size, and the types of activities performed by the organization that are related to PHI.

HIPAA does not contain any other rules regarding the Privacy Official. There is no particular required educational or work background that a Privacy Official must have. A Privacy Official should be capable of performing the functions required of them. Previous work or educational experience in the areas of privacy (healthcare data privacy, consumer data privacy, etc.) are desirable.

Can Covered Entities and Business Associates Have Multiple Individuals Serve as the “Privacy Official”?

HIPAA requires that a single individual be designated as the privacy official. This individual may delegate responsibilities to others. The ultimate responsibility for the development and implementation of policies and procedures falls on the individual designated as the privacy official. 

What Functions Does a Privacy Official Typically Perform?

An organization’s Privacy Officer oversees the Organization’s compliance with the HIPAA Privacy Rule. The Privacy Officer typically oversees an organization’s efforts to secure and maintain the confidentiality and integrity of protected health information (PHI); maintain sensitive organization information; prevent and detect inappropriate and illegal uses and disclosures of PHI; and assure individuals’ rights concerning accessing, amending and accounting for use and disclosure of their PHI.    

Workforce members should be familiar with their responsibility to maintain the confidentiality and integrity of PHI and to disclose and use it only as allowed or required. Workforce members should contact the Privacy Official whenever the organization's policies and procedures require that they do so.