Does HIPAA Require a Privacy Officer and a Security Officer?

Generally, yes. Subject to the group health plan exception in 164.530(k), the Privacy Rule requires a covered entity to designate a privacy official responsible for its privacy policies and a contact person or office to receive complaints. The Security Rule requires covered entities and business associates to identify a security official responsible for security policies. One person may hold both roles, and neither provision prescribes a particular professional credential.

Privacy official (45 CFR 164.530(a)). Subject to the fully insured group health plan exception in 164.530(k), a covered entity must designate a privacy official responsible for developing and implementing its policies and procedures, and a contact person or office responsible for receiving complaints and providing further information about matters covered by the Notice of Privacy Practices. The designations must be documented.

Security official (45 CFR 164.308(a)(2)). A covered entity or business associate must identify the security official responsible for developing and implementing the policies and procedures required by the Security Rule.

Same person. HHS Security Series guidance on administrative safeguards states: "The Security Official and Privacy Official can be the same person, but are not required to be."

Qualifications. Neither cited provision prescribes a particular license, degree, or certification for these roles, although other employment or licensing requirements may apply separately.

Business associates. A business associate must identify a security official but is not thereby subject to every Privacy Rule personnel duty that applies to covered entities.

Scalability. HHS Security Series guidance gives the example of designating "the same individual as both the Privacy and Security Official (for example, in a small provider office)."

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."