Data Security Guidance: What is a HIPAA Security Official?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Introduction

This rule discusses the HIPAA Security Rule requirement to designate a Security Official. 

What are the HIPAA Rules Regarding the Appointment of a Security Official?

The HIPAA Security Rule's administrative safeguard provision requires covered entities and business associates to appoint a Security Official: “Identify the security official who is responsible for the development and implementation of the policies and procedures required by the Security Rule for the covered entity or business associate.” 

This identification (name of official and their title and contact information) should be in writing, either in the Security Policy Manual or in another document accessible to the workforce. Employees should be informed when there is a new Security Official.

What are the Duties of the Security Official?

The Security Official is responsible for the development and implementation of security policies and procedures that protect electronic protected health information from unauthorized access, disclosure, alteration, or destruction.