HIPAA Privacy and Security Officer: How to Designate One

HIPAA requires every covered entity to designate a privacy official responsible for its privacy policies and procedures, plus a contact for complaints, under 45 CFR 164.530(a). The Security Rule separately requires covered entities and business associates to identify a security official under 45 CFR 164.308(a)(2). One person can hold both roles, but each must be formally named and documented.

Key takeaways

• The privacy official and the security official are both required designations, not optional best practices.
• Business associates must name a security official; the privacy official requirement applies to covered entities.
• Small practices often combine both roles in one person; larger organizations usually separate them.
• Put the designation in writing, define authority and keep the record for six years.
• The officer needs time, budget and access to leadership, not just a title.

What does HIPAA actually require?

The privacy official

Under the Privacy Rule's administrative requirements at 45 CFR 164.530(a), a covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures. It must also designate a contact person or office responsible for receiving complaints and able to provide further information about matters in the notice of privacy practices. The privacy official is often that contact, but the rule allows an office instead.

The security official

The Security Rule requires administrative, physical and technical safeguards for electronic protected health information. One of its administrative safeguard standards, at 45 CFR 164.308(a)(2), is "assigned security responsibility": the organization must identify the security official responsible for developing and implementing the Security Rule policies and procedures. This applies to both covered entities and business associates.

Documentation

Section 164.530(j) requires covered entities to keep required documentation for six years from its creation or the date it was last in effect, whichever is later. The designation memo, job description and any change in officer should be part of that record.

Privacy officer vs security officer: who does what?

Area	Privacy official	Security official
Scope	All PHI in any form: paper, verbal, electronic	Electronic PHI
Core rule	Privacy Rule (uses, disclosures, patient rights)	Security Rule (safeguards)
Typical duties	Policies on use and disclosure, notice of privacy practices, patient access and amendment requests, complaints, workforce privacy training	Risk analysis, risk management plan, access controls, audit logs, incident response, contingency planning, security awareness
Common partners	Compliance, legal, health information management, HR	IT, infrastructure, vendors, facilities
Breach role	Breach risk assessment and notifications	Detection, containment, forensics

The roles overlap heavily during incidents. Many privacy failures are security failures and vice versa, which is why both officers should meet regularly. Our article on EHR data security and HIPAA compliance shows where those responsibilities meet in clinical systems.

Who should you designate?

Small practices and clinics

A practice manager or compliance lead often holds both roles, supported by an outside IT provider for technical work. That is acceptable as long as the person has enough time and authority, and the IT vendor's responsibilities are written into a contract.

Mid-size and larger organizations

Separate the roles. The privacy officer often sits in compliance or legal; the security officer usually sits in IT or information security. Both should have a direct line to senior leadership or a compliance committee.

Qualities to look for

• Working knowledge of HIPAA and relevant state privacy laws.
• Credibility with clinicians and leadership.
• Ability to write policy, train staff and run investigations.
• For security: practical understanding of systems, identity management and risk analysis.
• No conflict that would discourage reporting problems, such as being the person responsible for the systems they must audit, without independent review.

How to designate the officers: a checklist

1. Write a designation memo naming each official, effective date and reporting line, signed by an executive.
2. Attach a job description listing duties and decision authority.
3. Name the complaint contact and publish it in the notice of privacy practices.
4. Give each officer a budget, backup designee and access to leadership.
5. Announce the designation to the workforce and include it in training.
6. Store the designation records for at least six years and update them when people change roles.
7. Schedule the first deliverables: a current risk analysis, policy review and training plan.

HIPAA officers also tend to inherit related safety and workforce compliance duties, a combination covered in becoming HIPAA and OSHA compliant. Fraud risks such as medical identity theft are another area where privacy and security officers should coordinate.

Frequently Asked Questions

Can one person be both the HIPAA privacy and security officer?

Yes. HIPAA requires both designations but does not require two different people. Small organizations commonly combine them. The person must have the time, knowledge and authority to perform both sets of duties, and the designation should clearly state that the individual holds both roles, with a named backup for absences.

Do business associates need a privacy officer?

The Security Rule's assigned security responsibility standard applies directly to business associates, so they must identify a security official. The Privacy Rule's privacy official requirement is written for covered entities. Many business associates still appoint a privacy lead because their contracts require privacy obligations and someone must manage them.

Does the privacy officer need a certification?

No certification is required by HIPAA. Organizations choose officers based on knowledge and ability to do the job. Professional certifications can help demonstrate competence and structure training, but a certified officer without time, budget or authority is less effective than a well-supported officer without one.

Next steps

Check whether your current designations are in writing and up to date. If not, draft the memo and job descriptions this month, confirm the complaint contact in your notice of privacy practices, and have each officer deliver a risk analysis and policy review plan within ninety days.

Last reviewed: October 2026.

Sources

• 45 CFR 164.530, Administrative requirements, Electronic Code of Federal Regulations
• The HIPAA Privacy Rule, U.S. Department of Health and Human Services
• The Security Rule, U.S. Department of Health and Human Services