Privacy Analyst

Mercy Health BSMH•Toledo, OH

1d•Hybrid

About The Position

The Privacy Analyst investigates potential privacy breaches and noncompliance with Bon Secours Mercy Health (BSMH) Privacy/HIPAA-related policies. The Analyst is responsible for implementing and administering BSMH’s Privacy policies and procedures, and helping to ensure compliance with HIPAA, HITECH and state mandated privacy and confidentiality requirements. The Analyst participates in other privacy-related duties as necessary or as assigned. This is primarily a remote, work from home, position with the requirement to go onsite as needed (maybe 2-3 times/month).

Requirements

4-6 years’ experience working with HIPAA and HITECH privacy rules or related compliance areas (required)

Nice To Haves

Certified in Healthcare Privacy Compliance - Health Care Compliance Association (preferred)
Certified Information Privacy Manager - International Association of Privacy Professionals (preferred)
Bachelors, Business Administration, Health Care Management, Nursing, or Health Information Management (preferred)
Prior healthcare experience (preferred)
EPIC Electronic Health Record experience (preferred)

Responsibilities

Investigates, documents, and reports on issues related to privacy and confidentiality of Protected Health Information (PHI) under HIPAA (Health Insurance Portability and Accountability Act of 1996).
Reports breaches to the DHHS Office for Civil Rights (OCR) in compliance with governing federal laws and prepares breach notification letters per the requirements of BSMH policies.
Requests data and/or access audits of electronic systems and incorporates audit finding results into investigations.
Creates and maintains electronic documentation for privacy incident investigations, resolutions, and corrective actions/sanctions.
Meets regularly with and keeps Director, Privacy apprised of the status of all investigations and projects.
Ensures corrective action plans addressing HIPAA are implemented and functional.
Maintains confidentiality of investigations.
Travel, if required by the Director, Privacy and approved by the VP, Compliance and Privacy, to complete on-site education and investigations.