Responsible for creating a framework to facilitate ongoing data privacy and security compliance for the covered entity. Provides strategic regulatory guidance in support of and aligned with NCHS mission, meeting regulatory burden, and pursuit of excellence. Provides senior leadership with compliance programs and administration of personnel, budgeting, and operations of the compliance program. Responsible for initiatives and operational functions of assigned areas including governance, logistics, and collaborates with Legal, Compliance, strategic partners, and stakeholders. Leads the department with a commitment to quality, service, growth, compliance, and organizational accountability.
Job Specific Duties
Responsible for creating a framework to facilitate ongoing data privacy and security compliance for all applicable areas of the health system.
Develop and manage required infrastructure to respond to rapidly evolving regulatory landscape surrounding privacy.
Owner of HIPAA and other related privacy policies and procedures; reviews and revises HIPAA privacy and security policies as needed.
Lead implementation of and provide ongoing management of the Protenus Privacy Monitoring System and implementation of analytics.
Respond to data security and privacy incidents, including breaches and external audits to mitigate potential damage to institution; assist with institutional breach response including review of notification materials, affected population lists, call center and escalation calls, liaise with credit monitoring and call center vendors, business services, and others.
Monitors and stays current with changes in legislation, regulations, ethics, and accreditation standards that affect information privacy and data security.
Support and promote organization at regulatory meetings as assigned and represents Regulatory Affairs on cross-functional project teams by Leader.
Works cooperatively with stakeholders such as Health Information Integrity and other applicable organizational medical record units in overseeing compliance with patient rights.
Cultivates and maintains strategic relationships with key regulatory authorities externally.
Receives, documents, tracks, and investigates incidents, complaints and events concerning the organization’s privacy practices; works with stakeholders and workforce members to timely complete and support investigations. Oversee process and timely completion of same.
Oversees, directs, delivers, or ensures delivery of initial and continuing privacy/security training to all employees in conjunction with TM&E and other relevant stakeholders. Creates articles, tips, and training materials to educate workforce members on HIPAA policies, information security, and privacy best practices; supervise remediation training and document audits; creates curriculum for awareness events such as compliance week and privacy day.
Acts as privacy liaison between department and business units to recommend solutions for compliance with HIPAA rules and other privacy laws/regulations.
Provide support to constellation NCHS community including workforce, patients, and other third parties regarding regulatory mandates, HIPAA policies & procedures, facilitation of patient privacy rights under HIPAA, business associate requirements. Responsible for follow-up, customer service issues including complaints, website assistance, and support with potential incidents.
Cooperates with the Office of Civil Rights, Office of the Inspector General, other Governmental oversight agencies, legal entities, and organization officers in any compliance reviews or investigations.
Manage program and personnel. Develop appropriate metrics to track the success of the program and individual functions and initiatives. Contribute to the management and administration of the compliance program at large.
Provide budgeting and administrative support to the compliance program at large.
Actively establishes and cultivates an environment that puts information privacy at its center and helps develop a culture that fosters best practices for data protection.
Minimum Job Requirements
Master's Degree Health Care Administration, Business Administration or equivalent discipline
4-7 years of leadership experience in a healthcare environment or academic medical center
3-5 years of progressive experience in program development, data privacy and security compliance framework, and management of vendor programs
Experience in information privacy laws, access, release of information, and release control mechanisms
Experience leading a team toward building confidence and striving toward established goals
Experience developing partnerships and supporting initiatives and programs with relevant stakeholders
Experience with developing compliance concepts to contribute and embed into organizational culture of excellence and regulatory compliance
Knowledge, Skills, and Abilities
CIPP or CHP preferred.
Savvy in presenting strategic regulatory recommendations and establishing trusted relationships.
Builds connections by developing positive and collaborative partnerships that drive sustainable business results.
Extensive knowledge of regulatory mandates, development of programs, and procedures to comply.
Skilled in presenting to stakeholders and providing education and awareness.
Excellent organizational skills, detail oriented, and effective written/oral communication skills.
Familiarity with and knowledge in implementation of privacy monitoring system and associated analytics.
Professional and customer service oriented when dealing with patients, community, all levels of administration, and workforce.
