Director, IT HIPAA Security - Must be willing to relocate to Louisville, KY area

UofL Health•Louisville, KY

13d•Remote

About The Position

The Director of IT HIPAA Security oversees the management and implementation of a comprehensive information and HIPAA security program to ensure compliance with applicable federal and state HIPAA regulations and guidelines, particularly concerning access to and use of protected health information (PHI). The director oversees the team responsible for auditing IT systems, evaluates existing policies and procedures through HIPAA risk assessments, and collaborates with plan management, administration, and legal counsel to identify privacy policies and procedures that need improvement and to develop and implement updates. The role builds and manages a strategic HIPAA security program to minimize risk and protect the integrity, confidentiality, and availability of electronic protected health information (ePHI). It oversees information-system audits, policies and procedures, workforce education, incident reporting and response, and ongoing risk assessment and vulnerability-management activities. The director also ensures the organization follows HIPAA Security Rule requirements for administrative, technical, and physical safeguards. The position is listed as work from home in Kentucky, with a first shift schedule, and requires willingness to relocate to the Louisville, Kentucky area.

Requirements

Bachelor’s degree in a related field.
At least five years of experience in information security, information technology, or a related field.
Five years of experience in HIPAA privacy regulatory requirements.
Demonstrated project management skills.
Ability to work collaboratively with a broad range of constituencies.
Working knowledge of HIPAA and information-security policy and regulation in the medical field, including relevant privacy laws and rules governing access, release of information, and security technologies.
Effective verbal and written communication skills.
Ability to break down problems or tasks and identify causes and consequences.
Understanding of network and system security technologies and practices across major computing areas, especially internet-related technology.
Experience managing physical and logical information-security systems.
Basic knowledge of current Windows workstation and server operating systems and standard security applications such as antivirus and vulnerability scanners.
Must be willing to relocate to the Louisville, Kentucky area.

Nice To Haves

Advanced degree in a related field.
Experience developing and administering a healthcare privacy program.

Responsibilities

Oversee information-system audit activities and review results for trends as needed.
Build a comprehensive HIPAA security program that minimizes risk and ensures the integrity, confidentiality, and availability of ePHI.
Oversee development and implementation of HIPAA and information security policies, standards, and procedures, coordinating with relevant Information System offices, data custodians, and governance groups.
Ensure workforce members are educated on standards and procedures for ePHI security.
Oversee incident reporting and response for security incidents and breaches, alleged policy violations, and complaints from external parties.
Evaluate security trends, evolving threats, risks, and vulnerabilities, and apply tools to mitigate risk as needed.
Manage ongoing HIPAA and information security risk assessments; recommend methods for vulnerability detection, remediation, and testing.
Ensure compliance with mandated HIPAA Security Rule administrative, technical, and physical safeguards.
Keep the team informed about current security and privacy legislation, regulations, advisories, alerts, and vulnerabilities pertaining to UofL Health.
Collaborate with Information Technology on recovery planning, business downtime planning, and other projects as needed.
Ensure audit controls monitor activity on electronic systems containing or using ePHI.
Maintain compliance with company policies, procedures, and standards of conduct.
Comply with HIPAA privacy and security requirements and maintain confidentiality.
Perform other duties as assigned.
Demonstrate service, professionalism, confidentiality, safety awareness, collaboration, and customer service in interactions with the healthcare community.