A HIPAA security officer is responsible for the continuous management of information security policies, procedures, and technical systems in order to maintain the confidentiality, integrity, and availability of all organizational information systems. Below, we’ve outlined some of the key features of the role of a HIPAA security officer, along with what they should be expected to know when it comes to maintaining HIPAA compliance.

What a HIPAA Security Officer Should Be Familiar With

ePHI

Electronic protected health information (ePHI) is any kind of PHI that is created, stored, transferred, or received electronically. HIPAA security officers should be familiar with how ePHI is handled at their practice so that they can develop an ePHI plan to ensure its security. The HIPAA privacy officer should incorporate their knowledge of state and federal HIPAA regulation and their knowledge of information systems to develop ePHI plans that can protect a practice’s ePHI from risk.

Employee Training Program

Establishing employee training programs is an essential step toward achieving HIPAA compliance, and it’s one of the HIPAA security officer’s main duties. An effective employee training program should be focused on keeping employees informed of security risks and threats to PHI and ePHI. When applicable, a HIPAA privacy officer should work with human resources and IT departments to develop a training program that instructs employees how to avoid breaches in compliance and maintain common security safeguards. Training should be maintained on a regular basis and should include orientation sessions for new employees as well.

Internal Auditing

A HIPAA security officer should be in charge of monitoring internal audits that assess the status of a practice’s HIPAA compliance. Audits should be done regularly, and can be carried out quickly and easily with the help of a third-party service such as Compliancy Group’s compliance tracking solution, The Guard. The Guard does the work of identifying breaches in security so that the HIPAA security officer can address these concerns and vulnerabilities with corrective actions.

Incident Management and Remediation

In the event of a security breach, the HIPAA privacy officer is responsible for taking immediate corrective action. The HIPAA privacy officer should have processes in place that can be quickly and easily implemented should a breach occur. A HIPAA security officer should assemble an incident response team, with specifically designated roles and responsibilities for each member. The team should investigate the breach, including why or how it occurred, and then take actions to correct it. Remediation plans must be assembled that fully document the details of the breach, along with exactly the corrective measures that were taken to fix it.

Other HIPAA Privacy Officer Responsibilities Include

• Must maintain a working knowledge of legislative and regulatory initiatives for implementation.
• Develop appropriate policies, standards, guidelines, and procedures for information security systems.
• Coordinate with the Privacy Officer.
• Monitor, direct, and deliver initial security training and orientation to all employees, volunteers, medical and professional staff, contractors, alliances, business associates, and other appropriate third parties.
• Coordinate with management and operations to establish a mechanism to track access to PHI within the practice, as required by state and federal regulation, and to allow qualified individuals to review or receive a report on access activity.
• Ensure compliance with security practices and consistent application of sanctions for failure to comply with security policies for all individuals in the practice’s workforce and for all business associates (BAs).
• Review breaches in compliance and correct deficiencies.
• Maintain a current, up-to-date, knowledge of federal and state privacy laws and accreditation standards.
• Cooperate with the Office of Civil Rights (OCR) and other legal entities and organization officers in any compliance reviews, audits, or investigations.