HIPAA Glossary · Entities & roles
Privacy Officer / Security Officer
The individuals a regulated entity must designate, in writing, as responsible for privacy compliance and the security programme.
Context
The Privacy Officer is required by §164.530(a); the Security Officer by §164.308(a)(2). Both must be designated in writing. One person may hold both roles in a small organisation, and the role may be contracted (see [Virtual HIPAA Officer](/services/virtual-hipaa-officer/)). The designation is one of the three artefacts OCR requests first — missing it is a §164.308(a)(2) finding on its own.
Related terms
- Workforce — Employees, volunteers, trainees, and others under the entity's direct control.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.