HIPAA privacy and security officers

HIPAA does not require a compliance officer. It requires a privacy official, a complaint contact, and a security official.

What belongs in your designation file

Each item traces to a paragraph of the regulation or to NIST's Security Rule guide.

A dated, signed record naming the privacy official (164.530(a)(2)).
The complaint contact person or office, matching the contact line in your notice of privacy practices (164.520(b)(1)(vii)).
A written record identifying the security official, with a job description (164.316(b)(1); NIST SP 800-66r2, Table 9).
The titles of the people or offices that process access, amendment, and accounting requests (164.524(e), 164.526(f), 164.528(d)).
Every superseded designation, kept six years after it was last in effect (164.530(j)(2)).

Every covered entity must designate a privacy official responsible for its privacy policies and procedures, and a contact person or office that receives complaints and answers questions about its notice of privacy practices (45 CFR 164.530(a)). Covered entities and business associates must also identify one security official responsible for their Security Rule policies (45 CFR 164.308(a)(2)).

The regulation names no title, degree, or certification for any of these roles, lets one person hold all of them, and requires the privacy designations to be documented and kept for six years. A two-physician clinic and a hospital system carry the same requirement. The difference is how much work sits behind it.

Train your privacy officer Help me choose a course

3designations a covered entity makesprivacy official, complaint contact, and security official

6 yrsretention for each written designationfrom creation or the date it was last in effect, whichever is later

0credentials the rules requireno title, degree, license, or certification is named

What the regulation requires

The Privacy Rule's administrative requirements open with personnel. Under 45 CFR 164.530(a)(1)(i), "a covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity." Paragraph (a)(1)(ii) adds a second designation: "a contact person or office who is responsible for receiving complaints under this section and who is able to provide further information about matters covered by the notice required by § 164.520." Paragraph (a)(2) then requires the covered entity to document both designations under paragraph (j), which calls for a written or electronic record of any required designation, kept for six years from the date it was created or last in effect, whichever is later.

The Security Rule adds the third role. The assigned security responsibility standard at 45 CFR 164.308(a)(2) requires a covered entity or business associate to "identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart." The standard has no implementation specifications, so nothing about it is addressable. It applies to every organization the Security Rule reaches, which under 45 CFR 164.302 includes business associates.

The title compliance officer comes from somewhere else. The HHS Office of Inspector General's General Compliance Program Guidance (November 2023) says every entity "should designate a leader as the entity's compliance officer" and recommends that the person report either to the CEO, with direct and independent access to the board, or to the board directly. That guidance is voluntary, and it covers fraud and abuse laws such as the Anti-Kickback Statute and the False Claims Act alongside HIPAA. Many organizations give the HIPAA designations to the person who holds the compliance officer title. That works, as long as the written record says which HIPAA roles the person holds.

Who designates what

The roles you need depend on how HIPAA reaches you

A clinic, a software vendor, a county with a public health clinic, and an employer with a group health plan each carry a different set of designations.

Covered entity

Providers, health plans, and clearinghouses

All three designations: a privacy official, a complaint contact, and a security official. Size changes how much work the roles involve, not whether they exist. Section 164.530(i)(1) asks for policies reasonably designed for the size and type of the entity's activities.

Small practice

One person can hold every role

HHS's FAQ 189 says "the privacy official at a small physician practice may be the office manager, who will have other non-privacy related duties." The 2003 Security Rule preamble says the same person could fill the security and privacy roles.

Business associate

Vendors and subcontractors handling PHI

A security official, because 164.302 applies the Security Rule directly to business associates. Section 164.530 is written for covered entities and does not require a business associate to name a privacy official. Your agreement must still require a vendor that carries out a covered entity's Privacy Rule obligation to follow the rules for that obligation (164.504(e)(2)(ii)(H)).

Hybrid entity

Organizations with designated health care components

A university, county, or employer that designates health care components under 164.105(a) stays responsible for compliance and for the policies required by 164.530(i) and 164.316(a). Write the designated components into the privacy official's scope so nobody has to guess where the role stops.

Affiliated covered entity

Commonly owned covered entities acting as one

Legally separate covered entities under common ownership or control may designate themselves a single covered entity under 164.105(b), in a documented designation kept six years. Treated as one covered entity, the group can name one privacy official and one security official.

Employer health plan

Fully insured plans that receive no PHI

Section 164.530(k) exempts a group health plan from paragraphs (a) through (f) and (i) when benefits come solely through an insurance contract and the plan receives only summary health information or enrollment data. A self-insured plan does not meet that test.

Duty map

What each designation makes someone answerable for

The rules make the privacy official responsible for developing and implementing the Privacy Rule policies, and the security official for the Security Rule policies. Each row is a policy or record a standard requires, with its paragraph. The owner column shows the usual assignment, not a regulatory mandate, except where the rule names the role. Anything the rules require you to document is kept six years from creation or the date it was last in effect (164.530(j)(2) and 164.316(b)(2)(i)).

Privacy official and complaint contact

Responsibility	45 CFR	Usual owner	What to keep
Privacy policies and procedures, revised promptly when the law changes	164.530(i)	Privacy official	Current and superseded versions
Training every workforce member on those policies, new members within a reasonable period and affected members after a material change	164.530(b)	Privacy official	Proof that the training was provided
Receiving privacy complaints and answering questions about the notice	164.530(a)(1)(ii) and (d)	Contact person or office	Every complaint and its disposition
Sanctions against workforce members who violate privacy or security policies	164.530(e); 164.308(a)(1)(ii)(C)	Both officials, usually with HR	Each sanction applied
Mitigating, to the extent practicable, known harm from a violation by the entity or its business associate	164.530(f)	Privacy official	Incident file showing what was done
Notice of privacy practices, including the complaint statement and the contact line	164.520(b)(1)(vi) and (vii)	Privacy official	Copies of each notice issued, under 164.520(e)
Requests for access, amendment, and an accounting of disclosures	164.524; 164.526; 164.528	The titles documented under 164.524(e)(2), 164.526(f), and 164.528(d)(3)	Those titles, designated record sets, and accountings provided
Breach risk assessments and notification decisions	164.402; 164.414(b); 164.530(j)(1)(iv)	Privacy official, with the security official	Enough documentation to carry the burden of proof
Business associate agreements for every vendor that handles PHI	164.502(e); 164.504(e); 164.308(b)	Shared	Signed agreements

Security official

Responsibility	45 CFR	Usual owner	What to keep
Risk analysis, and risk management that reduces risks to a reasonable and appropriate level	164.308(a)(1)(ii)(A) and (B)	Security official	The written analysis and the plan that follows it
Regular review of audit logs, access reports, and security incident tracking reports	164.308(a)(1)(ii)(D)	Security official	Review records
Workforce security and information access management, from authorization through termination	164.308(a)(3) and (a)(4)	Security official	Access approvals, changes, and removals
Security awareness and training for all members of the workforce, including management	164.308(a)(5)	Security official	Training and security reminder records
Identifying, responding to, and reporting security incidents	164.308(a)(6)	Security official	Security incidents and their outcomes
Contingency plan: data backup, disaster recovery, and emergency mode operation	164.308(a)(7)	Security official	The plans and test results
Periodic technical and nontechnical evaluation	164.308(a)(8)	Security official	Evaluation reports
Facility, workstation, device and media, access, audit, integrity, authentication, and transmission safeguards	164.310; 164.312	Security official	Inventories and configuration records
Written Security Rule policies, available to the people who carry them out and reviewed periodically	164.316	Security official	Policies with revision history

Can one person be both the privacy officer and the security officer?

Yes. When HHS issued the Security Rule on February 20, 2003, the preamble said "the same person could fill the role for both security and privacy" and described the single security official as aligning with the Privacy Rule's privacy official (68 FR 8334, discussion at 8347 to 8348). HHS repeated the point in its January 2025 proposal, which says the two officials "can, but need not be, the same person" (90 FR 947).

The same preamble set a limit on splitting the job. Commenters from large organizations asked to give security to a group. HHS answered that more than one individual may be given specific security responsibilities, "especially within a large organization," but that "the final responsibility for a covered entity's security must be assigned to one official." NIST's Security Rule guide says the same thing in a footnote: the security officer may enlist help from data governance or security management teams, but final responsibility rests with one individual (NIST SP 800-66r2, February 2024, Table 9).

How big the job is depends on the organization. HHS's FAQ 189 puts the small end plainly: "The privacy official at a small physician practice may be the office manager, who will have other non-privacy related duties." The same answer contrasts that with a large health plan, where the role may be a full-time position supported by privacy staff.

Splitting the roles makes sense once the technical work outgrows the person who handles complaints and patient requests. NIST's sample questions make a practical test for whoever holds the security role. Does that person oversee the risk assessment and risk management, handle the results of security evaluations, and direct security purchasing? Do they have adequate access to executives, the chief information officer, the chief compliance officer, and in-house counsel? And who in the organization is authorized to accept risk from its systems on its behalf (NIST SP 800-66r2, Table 9)?

Writing the designation down

For the privacy official and the complaint contact, documentation is an express requirement of 164.530(a)(2). For the security official, the 2003 preamble moved the documentation requirement into the Security Rule's documentation standard at 45 CFR 164.316, which requires written policies and required records to be kept for six years, made available to the people who carry them out, and reviewed periodically. NIST recommends documenting the assignment in a job description and telling the whole workforce who to call about a security problem.

Use titles where the rule allows them. The notice of privacy practices must give "the name, or title, and telephone number" of the contact (164.520(b)(1)(vii)), and the access, amendment, and accounting provisions ask you to document "the titles of the persons or offices" that receive and process requests (164.524(e)(2), 164.526(f), and 164.528(d)(3)). A notice that lists a title and a main number stays accurate when the person in the role changes. The signed designation still names the individual.

The rule prescribes no form. A one-page record like the template below covers every designation, and you can adapt the wording to your organization.

Template

HIPAA personnel designations

Organization: [legal name]
Effective date: [date]
Replaces: [date of the prior designation, or none]

Privacy official (45 CFR 164.530(a)(1)(i)). [Name], [title], is designated privacy official and is responsible for the development and implementation of our privacy policies and procedures [covering these health care components: list them].
Contact person or office (45 CFR 164.530(a)(1)(ii)). [Title or office], at [telephone], receives privacy complaints and answers questions about our notice of privacy practices. This is the contact printed in the notice.
Security official (45 CFR 164.308(a)(2)). [Name], [title], is identified as security official, holds final responsibility for developing and implementing our Security Rule policies and procedures, and may assign specific tasks to others.
Request handling (45 CFR 164.524(e)(2), 164.526(f), and 164.528(d)(3)). [Title or office] receives and processes requests for access; [title or office], requests for amendment; [title or office], requests for an accounting of disclosures.
Coverage during an absence, optional. When an official is unavailable, [title] acts in that role until the official returns or a successor is designated.
Reporting line, optional. The officials report to [executive or board] and may require any workforce member to cooperate with a privacy or security review.

Approved by: [name], [title], [signature], [date]

Keep this record, and every record it replaces, for at least six years from the date it was last in effect (45 CFR 164.530(j)(2) and 164.316(b)(2)(i)).

Training for the people who hold these roles

HIPAA sets no credential for either role. What it does require is training: every workforce member must be trained on the privacy policies and procedures "as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity" (164.530(b)(1)), and the Security Rule requires a security awareness and training program "for all members of its workforce (including management)" (164.308(a)(5)(i)). The officials are members of the workforce, and their function is the program itself, so their training has to reach further than a frontline course does.

For a privacy official, that means the duties in the privacy table: permitted uses and disclosures, minimum necessary, the rights to access, amendment, an accounting, restrictions, and confidential communications, the notice, complaints, sanctions, and the breach risk assessment. For a security official, it means risk analysis, access management, audit review, incident response, and contingency planning. No particular certificate is required, so judge a course by whether it covers those duties and leaves you with proof you can produce later.

USA HIPAA's self-paced courses cover the Privacy and Security Rules in about 90 minutes and end with an assessment and a certificate with public verification. A certificate shows that a person completed training. It does not show that your organization complies with HIPAA: the designations, policies, risk analysis, and records do that work. If you are training a team that includes the officials, team training handles seat assignment, completion tracking, and certificate records, and Help me choose matches each role to a course. You can also see how HIPAA certification works, how online HIPAA training providers compare, and current pricing.

What HHS has proposed for the security official

On January 6, 2025, HHS published a proposed overhaul of the Security Rule (90 FR 898; comments closed March 7, 2025). For this role, the proposal would move the standard to 164.308(a)(8) and require each regulated entity to "identify in writing the Security Official," who would be responsible for policies and procedures and for the deployment of technical controls. HHS said its enforcement experience showed that many regulated entities had not documented in writing who their security official was (90 FR 947 to 948).

None of that is in effect. HHS's current regulatory agenda lists the rulemaking, RIN 0945-AA22, as a long-term action with final action estimated for July 2027 (reginfo.gov), and the existing Security Rule applies until a final rule replaces it. A written designation already matches what 164.316 and NIST expect today, and it matches the proposed wording as well.

What a missing designation looks like in an investigation

OCR's April 2012 settlement with Phoenix Cardiac Surgery, a cardiothoracic surgery practice in Arizona, began with a complaint that the practice posted clinical and surgical appointments on a publicly accessible internet calendar. OCR found that the practice had not identified a security official or conducted a risk analysis, had not documented workforce training, and had no business associate agreements with the internet email and calendar services that held patient information. The practice paid $100,000 and agreed to a corrective action plan (HHS case summary).

Primary sources

45 CFR 164.530, the Privacy Rule administrative requirements, including personnel designations, training, complaints, sanctions, documentation, and the fully insured group health plan exception.
45 CFR 164.308 and 45 CFR 164.316, the Security Rule administrative safeguards and documentation standard.
45 CFR 164.520, the notice of privacy practices, including the contact line, and 45 CFR 164.105, hybrid and affiliated covered entities.
The Security Rule final rule, 68 FR 8334 (February 20, 2003), whose preamble discusses the security official at 8347 to 8348.
The Security Rule proposed rule, 90 FR 898 (January 6, 2025), and its regulatory agenda entry, RIN 0945-AA22.
NIST SP 800-66r2, Implementing the HIPAA Security Rule (February 2024), section 5.1.2 and Table 9.
HHS FAQ 189, on what the Privacy Rule requires of the average provider, and the HHS summary of the Phoenix Cardiac Surgery settlement.
HHS OIG General Compliance Program Guidance (November 2023), Element 2 on compliance leadership and oversight.

Educational information about federal regulations, not legal advice. USA HIPAA is not affiliated with or endorsed by HHS, OCR, OIG, or NIST. Regulatory text changes, so check the current text and ask qualified counsel before relying on it for a specific decision.

Tools and training for the designated officials

The designations come with a policy set, a notice, and a training plan to maintain. These are the USA HIPAA resources closest to that work.

Training

HIPAA Training for Privacy Officers

Training built around complaint intake, disclosure review, notice upkeep, and breach documentation.

See the training path

Training

HIPAA Training for Compliance Officers

Oversight training covering audit preparation, policy governance, and workforce accountability.

See the training path

Free tool

HIPAA Sanction Policy Generator

Builds the written sanction policy both rules require, cited to 164.308(a)(1)(ii)(C) and 164.530(e).

Build the policy

Free tool

Notice of Privacy Practices Generator

Drafts a notice with the complaint statement and the contact line your complaint contact owns.

Draft the notice

Free tool

Who Needs HIPAA Training?

Sorts staff, volunteers, contractors, and vendors into who needs training and who needs an agreement.

Plan training scope

Program

HIPAA Compliance Program

How the designations, policies, risk analysis, training, and evidence fit into one program.

Read the program guide

FAQs

Questions about HIPAA privacy and security officers

Is a HIPAA compliance officer the same as a privacy officer?

HIPAA does not require a compliance officer. It requires a privacy official under 45 CFR 164.530(a)(1)(i), a contact person or office for complaints under 164.530(a)(1)(ii), and a security official under 164.308(a)(2). The compliance officer title usually comes from the HHS Office of Inspector General's voluntary compliance program guidance. One person may hold all of these roles, and the written designation should say which HIPAA roles that person holds.

Does a small practice need a privacy officer?

Yes. The requirement applies to every covered entity regardless of size. What scales is the workload: HHS's FAQ 189 says "the privacy official at a small physician practice may be the office manager, who will have other non-privacy related duties." The same person can also serve as the complaint contact and the security official.

Does a business associate need a privacy officer?

Section 164.530 is written for covered entities, so it does not require a business associate to designate a privacy official. A business associate must identify a security official, because 45 CFR 164.302 applies the Security Rule directly to business associates. Business associate agreements often name a privacy contact for incident reporting, and a vendor that performs a covered entity's Privacy Rule obligations must follow the rules that apply to those obligations.

Does a HIPAA privacy officer need a certification?

No. Neither 164.530(a) nor 164.308(a)(2) names a title, degree, license, or certification. The rules do require training on the policies and procedures as necessary and appropriate for each workforce member's functions, and a security awareness and training program that includes management. A training certificate is proof that the official completed training. It is not a license, and it does not certify the organization.

Do we have to register our privacy officer with HHS?

No. The rule requires you to document the designation and keep the record for six years from the date it was created or last in effect, whichever is later. Nothing in 164.530 requires filing it with HHS. OCR can ask for it during a complaint investigation or compliance review, so keep it where you can produce it quickly.

What happens when the privacy officer leaves?

Designate a successor in writing, update the titles responsible for access, amendment, and accounting requests if they changed, and keep the old designation for six years after it was last in effect. If your notice of privacy practices lists the contact by title and telephone number rather than by name, a change of person does not change the notice.

Does a fully insured employer health plan need a privacy official?

Not if it fits the exception in 45 CFR 164.530(k): benefits provided solely through an insurance contract with a health insurance issuer or HMO, and no protected health information created or received beyond summary health information and enrollment information. A self-insured plan, or a fully insured plan that receives more than that, must make the designations.

Does completing training make my organization compliant?

No. Training proves that a person completed training. Organizational compliance depends on the designations, written policies, a current risk analysis, business associate agreements, and the records each designation requires. A certificate is evidence of workforce education, not a finding that an organization complies with HIPAA.

Get certified today

HIPAA Essentials (Privacy + Security) for $39

Self-paced Privacy and Security Rule training, the assessment, and a downloadable certificate with public verification.

One-time payment is available. Optional annual plan shown at checkout.

Get certified for $39

Team price per learner

2-9 learners$29
10-24 learners$24
25-49 learners$21
50-99 learners$18
100-1,000 learners$16

More than 1,000 learners? Contact us.

USA HIPAA

Give your privacy and security officials training they can prove

USA HIPAA provides online HIPAA training with verifiable certificates for individuals and organizations across the United States, so the people holding these designations can show their training when someone asks.

See training courses Compare pricing