What Is a Privacy Officer?

HIPAA requires every covered entity and business associate to designate a Privacy Officer — a named individual responsible for developing, implementing, and maintaining your organization's HIPAA compliance program. This is not optional. The Privacy Officer is your compliance anchor and the person OCR will look for first in an investigation.

The Privacy Officer does not need to be a lawyer, a doctor, or a full-time compliance employee. At many small practices, this role is filled by the practice manager, office administrator, or even the owner. What matters is that someone is officially designated, trained, and actively performing the duties of the role.

Who Qualifies?

Any employee with sufficient authority and organizational knowledge can serve as Privacy Officer. Look for someone who:

Has access to internal processes, workflows, and staff
Can enforce policy changes and hold colleagues accountable
Is comfortable communicating with patients, vendors, and regulators
Has time to dedicate to ongoing compliance tasks (even part-time)
Understands how PHI flows through your organization

Tip: In organizations with fewer than 20 employees, the Privacy Officer and Security Officer roles are often held by the same person. The portal supports this — you can designate one individual for both roles.

Designating Your Privacy Officer in the Portal

Once you have identified the right person, you need to formally record the designation:

Navigate to Settings in the Privacy Officer dashboard
Under the Organization tab, locate the Privacy Officer field
Enter the individual's name and email address
Click Save Changes — the designation is now on record

If that individual is also an employee user in your portal account, invite them using the employee invite flow (covered in Step 7) and assign them the Privacy Officer role. This gives them access to the full compliance dashboard, incident management, and reporting tools.

Privacy Officer Responsibilities Checklist

Once designated, your Privacy Officer takes on the following ongoing responsibilities. Use this checklist when onboarding them to the role:

Develop and maintain privacy policies and procedures
Train workforce members on HIPAA privacy requirements
Receive and process patient complaints regarding PHI
Investigate potential privacy violations and document findings
Oversee business associate agreement execution
Conduct or oversee annual risk assessments
Ensure Notice of Privacy Practices (NPP) is current and distributed
Maintain required documentation for six years

Important: The Privacy Officer designation must be documented in writing. The portal records this, but you should also note it in your employee handbook or an official letter of designation. If OCR investigates, verbal designations are not sufficient.

Next Steps

With your Privacy Officer designated, you are ready to move into the substantive compliance work. The next step — the Security Risk Assessment — is the most important compliance activity your organization will complete. Your Privacy Officer should be directly involved in that process.

Assign Privacy Officer