Privacy Specialist

Stony Brook University•Town of Brookhaven, NY

About The Position

The Privacy Specialist supports compliance with HIPAA and other applicable state and federal laws for Stony Brook’s Organized Health Care Arrangement (SBOHCA). The role conducts investigations, audits, training, and reviews to help ensure compliance with privacy regulations across the participating covered entities, their employees and contracted professionals and students, and voluntary members of the SBUH Medical Staff. These covered entities operate at numerous locations throughout the greater New York area. The position investigates suspected or known privacy violations, assesses breaches involving unsecured protected health information, supports breach notifications, and maintains investigation and assessment documentation. It also responds to privacy concerns, conducts on-site HIPAA rounding and other audits, monitors Business Associate Agreements, collaborates with internal departments and operational leaders, supports the Privacy Officer with privacy training, and coordinates privacy-related research matters. Other related duties may be assigned. Stony Brook Medicine is a smoke-free environment. The position may be designated essential during institutional emergencies and may require respiratory protection, which may prohibit facial hair. Hospital positions may be subject to changes in pass days and shifts as necessary. Pre-employment requirements include a physical examination and medical clearance, an electronic reference check with at least three professional references, a four-panel drug screen, regulatory screenings, and submission of any required New York State licenses or certificates.

Requirements

Bachelor’s degree.
At least three years of professional experience in a healthcare- or research-related position, such as corporate compliance, health information management, healthcare administration, healthcare operations, or research, or direct experience in HIPAA compliance.
Demonstrated collaboration, teamwork, and problem-solving skills.
Strong communication skills regarding privacy and the ability to understand broad enterprise risks in a complex health system.
Excellent verbal, listening, and written communication skills.
Ability to present complex information clearly and thoroughly.
Excellent organizational skills and attention to detail.
High personal integrity and the ability to handle confidential matters professionally, exercising appropriate judgment and maturity.
Ability to develop and maintain positive interpersonal relationships.
Demonstrated commitment to diversity, equity, and inclusion.

Nice To Haves

Master’s degree.
Knowledge of and demonstrated experience with state and federal information privacy, confidentiality, security, and breach notification laws, and privacy in research settings.
Healthcare compliance certification, such as Certified in Health Care Privacy Compliance (CHPC), Certified Health Care Compliance Professional (CHC), or Certified in Health Care Research Compliance (CHRC).
Prior privacy experience within an academic healthcare hybrid entity.

Responsibilities

Conduct HIPAA privacy investigations in response to reports or alerts of suspected or known privacy violations, and ensure appropriate mitigation and corrective actions are implemented.
Conduct breach risk assessments of impermissible access, use, or disclosure involving unsecured protected health information to determine whether a breach occurred.
Assist with breach notifications when needed.
Maintain records and supporting documentation for investigations and breach risk assessments, including mitigation and corrective actions, communications, notifications, and unsubstantiated allegations; write letters to reporters as appropriate.
Accept, monitor, and respond to privacy and compliance helpline and phone requests or concerns from individuals and workforce members.
Conduct on-site HIPAA rounding audits and other audits and monitoring projects included in annual privacy work plans.
Assist with monitoring and tracking Business Associate Agreements.
Partner and collaborate with internal departments and operational leaders representing organizational privacy interests, including Health Information Management, General Counsel/Hospital Counsel, Patient Access, and Faculty Practices.
Assist the Privacy Officer in developing, maintaining, and providing new employee orientation, annual and periodic training, and reminders on health information privacy requirements, policies, and procedures.
Assist with coordination of privacy-related research matters.
Perform other related duties as assigned.