A HIPAA Privacy Officer is the designated individual responsible for the practice’s HIPAA Privacy Rule compliance — privacy policies, workforce training, patient rights administration, breach response, and Business Associate management. The HIPAA Privacy Rule requires every covered entity to designate a Privacy Officer. This is the role that exists by federal mandate, and it is the role that determines whether the practice’s privacy program holds up under OCR scrutiny.
How This Work Happens
HIPAA Privacy Officer work happens in three places: as a hospital or health-system employee, as a contractor working through a billing services or RCM company, or as an independent business owner. This page covers all three so you can choose the path that fits your life.
Mendry supports the third path. We are a Florida 501(c)(3) membership platform full of opportunities — not an employer, not a placement agency. We list independent professionals so the practices that need them can find them. Your business. Your contracts. Your rates. Your decisions.
Membership in Mendry’s DCSP Network is built on these understandings about your business.
You set your own rates. Mendry does not suggest, publish, recommend, or facilitate the sharing of rate information between members.
What This Really Means
01
You decide what to charge.
02
You send the bill. You collect the money.
03
You buy your own insurance.
04
You pay your own taxes — four times a year.
05
You sign your own contracts.
06
You sign a BAA with every client before you start.
07
You hold your own business licenses.
08
You keep your credentials and CE current.
09
You own the quality of your work.
10
You market yourself accurately.
11
Your clients are DCP practices. Veterans are not your clients.
12
You keep your own records.
13
Your directory listing is conditional, not permanent.
14
Your membership fee pays for listing — not for leads.
15
You are a member. We are a platform. That is the whole relationship.
What This Role Involves
HIPAA Privacy Officers run the privacy program structure. They maintain the practice’s privacy policies and procedures. They administer patient rights — access requests, amendment requests, accounting of disclosures, restrictions, confidential communications. They handle complaints. They coordinate with HIPAA Security Officers on areas where privacy and security overlap.
Business Associate management is core work. Every vendor with access to PHI must have a signed Business Associate Agreement. The Privacy Officer maintains the BAA inventory. They review proposed vendors for BAA appropriateness. They handle BAA renewals and termination. They investigate Business Associate breaches that affect the practice.
Breach response is the high-stakes work. When privacy incidents occur — lost laptops, misdirected faxes, unauthorized access, ransomware affecting PHI — the Privacy Officer conducts the breach risk assessment, determines reportability, coordinates notification when required, and documents everything for OCR review.
The HIPAA Privacy Officer role rewards regulatory precision and steady judgment under pressure. Members who do well in this work enjoy the structure of HIPAA Privacy Rule requirements, take pride in audit-ready privacy programs, and find satisfaction in protecting patient privacy through systematic discipline.
The Core Activities
1
Develop and update HIPAA Privacy Rule policies. Adapt to regulatory changes. Train workforce on policy requirements.
2
Process patient access requests, amendment requests, accounting of disclosures, restriction requests, and confidential communication requests within HIPAA timelines.
3
Maintain BAA inventory. Review new vendor BAAs. Handle renewals and terminations. Investigate Business Associate-related issues.
4
When privacy incidents occur, conduct the four-factor risk assessment to determine reportability. Document the assessment. Coordinate notification when required.
5
Privacy and security overlap on workforce training, breach response, and PHI access controls. Coordinate workflow with the HIPAA Security Officer.
Where This Role Appears in the Field
Hospital HIPAA Privacy Officers work within compliance or legal departments. Often W-2 employment with senior responsibilities.
Consulting firms offer fractional and interim HIPAA Privacy Officer services. Senior consulting work.
Small and mid-size practices need a designated HIPAA Privacy Officer but cannot justify a full-time hire. Fractional Privacy Officer engagements are common and growing.
VA Community Care Network privacy involves VA-specific privacy considerations on top of standard HIPAA. The Privacy Act of 1974 applies to VA records. Privacy Officers serving practices treating veterans through VA CCN need to understand how VA privacy requirements layer with HIPAA.
TRICARE and CHAMPVA privacy follow DoD privacy requirements alongside HIPAA. Privacy Officers handling federal payer privacy across all three programs bring valuable cross-program expertise.
The two-hat reality. In a two-hat practice, this work runs on two parallel tracks at once — VA Community Care credentialing and claims under federal authority, and state medical cannabis practitioner participation under state authority. The two tracks never share a workflow, but they share a deadline: a lapse on either side stops payment and access on both. Members who can hold both tracks steady at the same time are the ones two-hat practices keep.
Your Roadmap to becoming an independent HIPAA Privacy Officer
This is the step-by-step path. Follow each step in order.
Certified in Healthcare Privacy Compliance is the recognized HIPAA Privacy Officer credential. AHIMA CHPS is also recognized.
Most Privacy Officers come from compliance or privacy backgrounds with 3 to 5 years of experience.
Register an LLC. Get an EIN. Open a separate business bank account.
Privacy Officer engagements involve significant breach response exposure. Coverage matters.
Every client signs a BAA — even though as Privacy Officer you’re enforcing BAAs, your engagement also requires one with each client.
Mid-size practices that have been operating without a designated Privacy Officer, or those needing transition support, are natural first clients.
Position yourself as fractional HIPAA Privacy Officer specifically.
Fractional Privacy Officers often work with 3 to 6 client practices at fractional engagement levels.
Education & Experience Pathways
Members exploring this role typically come into the work through one of these learning paths:
HIPAA Privacy Officers who grow fastest are the ones who become deep experts in breach response — the highest-stakes part of the role. The Privacy Officer who can conduct a defensible four-factor risk assessment, document it thoroughly, and coordinate notification when required becomes the trusted choice when something goes wrong.
The Realities of the Work
The HIPAA Privacy Officer role mixes routine program work (training, policy maintenance, BAA management) with high-stakes incident response. The role requires emotional steadiness during breach investigations.
It is remote-work compatible for fractional engagements. Compensation is at senior compliance levels because the role carries significant regulatory responsibility.
Income — Research the Range
Mendry does not publish specific income figures because numbers vary based on credential, geographic market, employment type, specialty focus, and experience. Here are the authoritative sources to research current income data:
BLS data covering senior healthcare management roles.
HCCA compensation data with HIPAA Privacy Officer breakouts.
AHIMA compensation data for CHPS credential holders.
Active market data for HIPAA Privacy Officer positions.
How to Know If This Role Fits You
The HIPAA Privacy Officer role is a good fit for compliance professionals with HIPAA Privacy Rule expertise who can handle both routine program work and high-stakes incident response. Members who can conduct defensible breach risk assessments. Members who enjoy patient rights administration. It requires HIPAA expertise and the CHPC or CHPS credential typically. For experienced privacy professionals, especially those wanting fractional consulting work, it offers strong specialty positioning.