News
Aesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data BreachAesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data Breach
Beginnerpractice managerprovider

Do we need a Privacy Officer?

Yes, someone must own HIPAA privacy for your organization. At a small practice, that can be a part-time role.

TL;DR

HIPAA requires a privacy official responsible for policies, training coordination, and complaints. In small practices, the practice manager often wears this hat alongside other duties.

Updated 2026-04-21

HIPAA expects every covered entity to have a Privacy Official (sometimes called a privacy officer). That person is the named leader for privacy policies, workforce training, patient rights processes, and complaint handling.

Does it have to be a full-time job?

No. Many solo and small practices combine the role with office management. What matters is that someone is accountable, documented, and reachable when staff have questions or incidents happen.

What do they actually do?

Day-to-day, a privacy officer often:

  • Keeps Notices of Privacy Practices up to date and available.
  • Makes sure training happens for new hires and refreshers.
  • Reviews vendor BAAs and tracks where data lives.
  • Leads investigations when something goes wrong.
  • Serves as the contact point for patient complaints about privacy.

How do we "designate" someone?

Put it in writing, job description addendum, policy page, or organizational chart note. Train that person enough that they know when to call counsel or a HIPAA consultant.

Pair with security leadership

Larger organizations often split privacy and security roles. Small sites may combine them, but still document who owns technical safeguards like backups and access reviews.

Keep reading

Next in your reading path → Do we need to sign anything? Business Associate Agreements explained simply

Not legal advice. Educational overview only; consult qualified counsel for your situation.