HIPPA Privacy Officer

Location: Oklahoma City - 123 Robert S Kerr Avenue

Full-time, regular position. Primary hours: Monday – Friday, 8 a.m. – 5 p.m.

About the role

The HIPAA Privacy Officer, within the Office of the General Counsel, leads and oversees the agency’s privacy program, ensuring compliance with the Health Insurance Portability and Accountability Act (HIPAA), 42 CFR Part 2, and other applicable state and federal regulations. This position provides strategic guidance to OSDH leadership and oversees the continuous improvement of privacy controls, processes, and services to support organizational and regulatory requirements. The role manages privacy risk, breach response, and regulatory reporting while promoting a culture of confidentiality, security, and compliance.

Responsibilities

• Oversees the establishment, implementation, maintenance, and adherence to privacy policies and procedures; ensures policies remain compliant with federal and state laws.
• Coordinates with OSDH leadership to review practices impacting HIPAA Privacy Rule compliance.
• Performs periodic risk analyses, internal audits, and assessments of policies, staff activities, and training programs; determines remediation priorities.
• Establishes and administers a process for receiving, documenting, tracking, investigating, and responding to privacy-related complaints and issues.
• Coordinates responses to compliance assessments or investigations initiated by HHS’ Office of Civil Rights or the State Attorney General; monitors regulatory updates.
• Drafts and approves Business Associate Agreements, Data Use Agreements, and Data Sharing Agreements.
• Consults with legal counsel regarding privacy standards and applicable laws.
• Ensures mandatory and ongoing privacy training for all OSDH members, including updates when policies change.
• Organizes and maintains all privacy policies and procedures.
• Reviews contracts, data-sharing agreements, and policies for legal and regulatory compliance.
• Advises on risk mitigation for privacy and cybersecurity issues, ensuring legal obligations are met while protecting sensitive data.
• May participate in governance committees.
• Other duties as assigned.

Requirements

• Bachelor’s degree in Business Administration, Information Systems, Healthcare Administration, Legal Studies, Cybersecurity, or a related field.
• Five years of experience in privacy, compliance, information governance, risk management, healthcare operations, information security, or a related field.
• A master’s degree or Juris Doctor may substitute for up to two years of the required experience.

Preferred Qualifications

• Knowledge of data protection laws, such as HIPAA and related federal and state privacy regulations.
• Experience conducting privacy risk assessments, compliance reviews, investigations, breach response activities, and corrective action planning.

Skills

• Strong understanding of data protection laws and information security principles.
• Experience with policy development and privacy risk assessments.
• Strong analytical, investigative, communication, and leadership skills.

Pay

Annual salary up to $99,000, based on education and experience.

Benefits

• Generous state-paid benefit allowance to cover insurance premiums.
• Wide choice of insurance plans with no pre-existing condition exclusions or limitations.
• Flexible spending accounts for health care and dependent care expenses.
• Retirement Savings Plan with a generous employer match.
• 15 days of vacation and 15 days of sick leave in the first year for full-time employees.
• 11 paid holidays per year.
• Student loan repayment options and tuition reimbursement.
• Employee discounts with various companies and vendors.
• Longevity bonuses for years of service.

Physical Demands and Work Environment

• Work is typically performed in a climate-controlled office setting with moderate noise levels.
• Requires talking, standing, walking, and reaching with hands and arms.
• Involves long periods of sitting and daily use of computers and phones.
• Must be willing to complete all job-related travel.
• Being present at the office is an essential function of the job.