IT Business & Security Analyst (HIPAA HL7 FHIR)

IT Business Analyst Responsibilities


o Requirements Gathering: Collaborates with clinical staff and administrators to define what the system must do, such as managing Electronic Health Records (EHR) or billing.


o Process Optimization: Identifies bottlenecks in patient flow or data entry and recommends technical solutions to streamline these tasks.


o User Support & Training: Translates complex technical features into actionable training for doctors, nurses, and administrative staff.


• Security Analyst Responsibilities


o Focuses on the protection of Electronic Protected Health Information (ePHI) and regulatory compliance.


o Risk Assessments: Conducts regular audits to identify vulnerabilities in the system's architecture, data flows, and third-party integrations.


o Access Management: Implements "least-privilege" access and Multi-Factor Authentication (MFA) to ensure staff only see the patient data necessary for their specific roles.


o Incident Response: Detects and responds to security threats, such as phishing or data breaches, and leads the recovery process while documenting findings for legal compliance.


o Vendor Oversight: Manages Business Associate Agreements (BAAs) with system vendors to ensure they meet the organization's security standards
• Effective collaboration with product, data, and business teams
• Good communication and documentation skills and can work with executive leadership on daily basis
• Good functional and domain knowledge of Pharma domain
• Health care specific certification good plus:


o HCISPP (HealthCare Information Security and Privacy Practitioner): The gold standard for this specific role; it covers healthcare risk, governance, and the legal aspects of patient data.


o C PHIMS (Certified Professional in Healthcare Information and Management Systems): Focuses on the "Business Analyst" side-improving clinical outcomes through better technology management.
• Core Security & Audit (Must have):
• CISSP (Certified Information Systems Security Professional): Best for high-level security strategy and architecture.
• CISA (Certified Information Systems Auditor): Critical for the "Analyst" side, focusing on auditing system controls and reporting.


• Process & Business Analysis (Must have):
• CBAP (Certified Business Analysis Professional): For mastering requirements gathering and process modeling.
• ITIL 4 Foundation: Useful for understanding how to manage IT services in a high-stakes environment like a hospital
• Essential Compliance documentation prior experience(must have):


o SRA (Security Risk Assessment) : A living document that identifies where ePHI is stored, transmitted, or at risk. This is a mandatory HIPAA requirement.


o BAA (Business Associate Agreements): ): Contracts with third-party vendors) ensuring they also follow strict security standards