Privacy Analyst

Position Summary

The Senior Privacy Analyst supports the Agency Privacy Officer in the day-to-day operation of the Agency's privacy program. This position reviews, tracks, coordinates, and documents privacy-sensitive requests and incidents involving: Medicaid applicants, recipients, and beneficiaries, Claims, eligibility, and enrollment information, Provider and program integrity data, Protected Health Information (PHI), Personally Identifiable Information (PII).

Key Responsibilities

• Responsible for processing and reviewing: Individual access requests, Information-gathering requests, Recipient-directed disclosures, HIPAA authorizations, Subpoenas and court/legal requests, Privacy complaints, Privacy incident reports, Breach reporting activities.
• Apply HIPAA Privacy and Breach Notification requirements. Ensure compliance with Medicaid confidentiality requirements and applicable regulations.
• Review requests and incidents for privacy risks and compliance concerns. Verify identity and authority while adhering to minimum necessary standards.
• Follow established escalation procedures and privacy best practices. Conduct remote and onsite privacy assessments to verify compliance.

Program Support & Audit Participation

• Affiliate in the development, implementation, maintenance, and documentation of the Agency's privacy program.
• Participate in federal and state audits conducted by organizations such as: Social Security Administration (SSA), Internal Revenue Service (IRS), U.S. Department of Health & Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), Office for Civil Rights (OCR), State Examiner's Board, Other regulatory and oversight agencies.

Required Knowledge

• Working knowledge of HIPAA Privacy Rule and Breach Notification requirements.
• Working knowledge of Medicaid confidentiality requirements, particularly 42 CFR Part 431, Subpart F.
• Understanding of 42 CFR Part 2 considerations and related privacy requirements.

Required Skills

• Ability to review and evaluate: Subpoenas, Court orders, HIPAA authorizations, Access requests, Privacy incident reports.