Sr Privacy Officer

Overview Privacy Consultant – Hospital Privacy and PHI compliance. Location: 30 Corporate Woods, Suite 350, Rochester, New York 14623. Full time, 40 hours per week. Compensation range: $77,216.00 – $115,824.00 annually. Responsibilities Interpret HIPAA privacy regulations and related state and federal laws regarding confidentiality of protected health information (PHI). Develop and advise on entity‑specific policies related to privacy and confidentiality of patient information. Collaborate with the Chief Privacy Officer to identify, develop, implement, and maintain system‑wide privacy policies and procedures. Coordinate with and keep senior leadership apprised of areas of responsibility as appropriate. Ensure entity‑specific policies and procedures are updated in accordance with policies. Receive, document, track, investigate, and take action on patient, family, and workforce‑member initiated privacy complaints and breaches. Meet or discuss with patients and families about privacy complaints, which can often be of a highly sensitive nature. Defuse upset patients and contain the situation internally. Oversee development of correctional plans or process changes and remediation after issues have been investigated. Coordinate and recommend consistent application of sanctions for workforce members and business associates in cooperation with appropriate Human Resource Business Partner, Medical Director, Office of Counsel, and Dean for Graduate Medical Education, as appropriate. Maintain appropriate breach notification risk assessments, files, documentation, etc. Apprise and involve the Chief Privacy Officer when appropriate. Perform ongoing audit reviews and monitoring of activities, requiring knowledge of electronic medical record systems and in‑depth understanding of auditing tools to ensure compliance with federal privacy regulations and policies. Implement and oversee development of corrective action plans and required procedural changes in response to violations of privacy policies and practices. Apprise and involve the Chief Privacy Officer and senior leadership of issues, concerns, and progress regarding privacy‑related matters affecting the organization. Serve as consultant and/or subject‑matter expert in organizational privacy activities, such as the health system‑wide Privacy Workgroup, Privacy Officer Committee, Regional HIPAA Group, Research Committees, Policy Management Team, and other committees. Serve as advisor on HIPAA to the Institutional Review Board as required. Maintain current knowledge of privacy guidelines relating to research to ensure compliance with research guidelines and regulations. Ensure areas of responsibility utilize and maintain appropriate privacy authorizations, consents, notices, and materials reflecting organizational privacy practices and legal requirements. Review and negotiate terms of business associate agreement contracts for vendors who perform a function of a business associate as defined in the privacy regulation for areas of responsibility. Serve as liaison with the Forms Management vendor. Develop content for mandated privacy training of workforce members. Oversee and ensure delivery of privacy training and orientation to employees, physicians, and other workforce members in entity/entities of responsibility. Keep workforce current with updates, changes, and necessary information relating to privacy issues. Author and publish privacy materials on the intranet for ongoing knowledge and awareness of privacy. Ensure adherence to patient rights as mandated under HIPAA regulations, including inspections, receipt of copies, amendments to patient health and billing records, restrictions of disclosures, requesting confidential communications, and receiving disclosure‑tracking reports of access to protected health information. Work closely with the Health Information Management Department and other appropriate parties to manage patient rights under the Privacy Rule. Act as a resource to staff supporting various clinical information systems, including recommending and terminating user access, documentation, and advising on provision of access. Serve as privacy liaison for users of clinical and information systems, including the Rochester Regional Health Information Organization (RHIO). Serve as liaison to regulatory and accrediting bodies for matters relating to privacy. Other duties as assigned. Qualifications Bachelor's degree and four years of healthcare administration, information systems, compliance, auditing, or related experience; or an equivalent combination of education and experience. Nationally recognized certification in health information management upon hire preferred. EEO Statement The University of Rochester is committed to fostering, cultivating, and preserving an inclusive and welcoming culture to advance the University’s Mission to Learn, Discover, Heal, Create – and Make the World Ever Better. In support of our values and those of our society, the University is committed to not discriminating on the basis of age, color, disability, ethnicity, gender identity or expression, genetic information, marital status, military/veteran status, national origin, race, religion, creed, sex, sexual orientation, citizenship status, or any other characteristic protected by federal, state, or local law (Protected Characteristics). This commitment extends to non‑discrimination in the administration of our policies, admissions, employment, access, and recruitment of candidates, for all persons consistent with our values and based on applicable law. #J-18808-Ljbffr 001 University of Rochester