Director – IT HIPAA Security
UofL Health
Director – IT HIPAA Security
UofL Health
Regional academic health system with hospitals
Position Summary and Purpose
The Director of IT HIPAA Security will oversee the management and implementation of a comprehensive information and HIPAA security program to ensure organizational compliance with applicable federal and state HIPAA regulations and guidelines, particularly regarding the organizations access to and use of protected health information (PHI). The director will oversee the team responsible for the auditing of IT systems, will evaluate the organizations existing policies and procedures for HIPAA compliance by performing HIPAA risk assessments, collaborates with plan management, administration, and legal counsel to identify and address privacy policies and procedures that require improvement and develop and assist with implementation of new and updated policies and procedures.
Essential Functions:
• Oversees all audit activities for information systems and reviews results for trends, as needed
• Builds a strategic and comprehensive HIPAA security program that minimizes risk and ensures integrity, confidentiality, and availability of ePHI
• Oversees the development and implementation of HIPAA and information security policies, standards and procedures; coordinates with key Information System offices, data custodians and governance groups in the development of such policies
• Ensures all workforce members are educated on standards and procedures related to security of ePHI
• Oversees the Incident Reporting and Response system to address security incidents (breaches), responds to alleged policy violations, or complaints from external parties
• Evaluates security trends, evolving threats, risks and vulnerabilities and applies tools to mitigate risk as necessary
• Manages ongoing risk assessment program targeting HIPAA and information security matters; recommends methods for vulnerability detection, remediation, and vulnerability testing
• Ensures that the organization is following mandated HIPAA Security Rule requirements for administrative, technical and physical safeguards
Other Functions:
• Ensures team remains aware of latest security and privacy legislation, regulations, advisories, alerts and vulnerabilities pertaining to UofL Health
• Collaborates with Information Technology as needed for Recovery Planning, Business Downtime Planning and other projects, as needed
• Ensures that audit controls are in place to monitor activity on electronic systems that contain or use ePHI
• Maintains compliance with all company policies, procedures and standards of conduct
• Complies with HIPAA privacy and security requirements to maintain confidentiality at all times
• Performs other duties as assigned
Job Requirements
(Education, Experience, Licensure and Certification)
Education:
• Bachelor’s degree in related field (required)
• Advanced degree in related field (preferred)
Experience:
• Minimum five (5) years of experience in information security, information technology, or related field (required)
• Five (5) years of experience in HIPAA Privacy regulatory requirements (required)
• Experience in developing and administering a healthcare privacy program (preferred)
Licensure:
• N/A
Certification:
• N/A
***MUST BE OPEN TO RELOCATING TO THE LOUISVILLE, KY AREA
Job Competency:
Knowledge, Skills, and Abilities critical to this role:
• Demonstrated project management skills
• Ability to work collaboratively with a broad range of constituencies
• Working knowledge of policy and regulatory environment of HIPAA and information security, especially in medical field including HIPAA regulations, requirements, and guidelines and related information privacy laws and regulations including those governing access, release of information, and security technologies
• Exemplifies service excellence – responsive, informs constituents of process, pleasant to work with, educates and provides timely, accurate information
• Displays strong organizational skills – manages time effectively, keeps tasks appropriately prioritized and delegates appropriately; works proactively- anticipates and plans for problems before they arise; is able to perform work in a neat, efficient, well-coordinated, well communicated manner with a high degree of accuracy and professionalism
• Role models strong work ethic – motivated, diligent, industrious and persistent in the workplace, stays on tasks to completion, works at a fast pace to ensure optimal efficiency; remains flexible – ability to change directions, as needed, to ensure optimal outcomes
• Displays strong interpersonal skills– can build effective, strong working relationships with employees, colleagues, management and vendors through trust, communication, and credibility; displays self-awareness and emotional intelligence, exercises sound judgement
• Displays strong leadership skills – ability to work collaboratively with others, serve others, help others, lead others, mentor others, and take directions from others in the interest of moving process and programs forward to the desired outcome
Language Ability:
• Must be able to communicate effectively in both verbal and written formats
Reasoning Ability:
• Ability to break down problems or tasks; scanning one’s own knowledge and experience to identify causes and consequences of events
Computer Skills:
• Understanding of network and system security technology and practices across all major-computing areas with an emphasis on Internet related technology
• Experienced in the management of both physical and logical information security systems
• Basic knowledge of current Windows workstation and server operating systems as well as standard security applications (antivirus, vulnerability scanners, etc.)
Additional Responsibilities:
• Demonstrates a commitment to service, organization values and professionalism through appropriate conduct and demeanor at all times
• Maintains confidentiality and protects sensitive data at all times
• Adheres to organizational and department specific safety standards and guidelines
• Works collaboratively and supports efforts of team members
• Demonstrates exceptional customer service and interacts effectively with physicians, patients, residents, visitors, staff and the broader health care community
UofL Health Core Expectation:
At UofL Health, we expect all our employees to live the values of honesty, integrity and compassion and demonstrate these values in their interactions with others and as they deliver excellent patient care by:
• Honoring and caring for the dignity of all persons in mind, body, and spirit
• Ensuring the highest quality of care for those we serve
• Working together as a team to achieve our goals
• Improving continuously by listening, and asking for and responding to feedback
• Seeking new and better ways to meet the needs of those we serve
• Using our resources wisely
• Understanding how each of our roles contributes to the success of UofL Health
Regional academic health system with hospitals
UofL Health is a not-for-profit regional academic health system serving Louisville and surrounding areas with nine hospitals, four medical centers, specialty centers like Brown Cancer Center and Eye Institute, and over 250 physician practice locations with 1,200+ providers. It operates through an integrated network of hospitals, centers, and outpatient clinics that deliver patient-centered care and coordinate among physicians, nurses, pharmacists, and other professionals. Affiliated with the University of Louisville School of Medicine, the system conducts clinical trials and collaborates on research to develop new technologies and treatments, with access to care expanded through a partnership with Carroll County Memorial Hospital. With more than 14,000 team members, its goal is to transform the health of the communities it serves by providing compassionate, high-quality care and access to advanced medical options.
Explore more opportunities at UofL Health