Does Your Practice Have a HIPAA Privacy Officer and Security Officer? Here's What OCR Actually Requires

Ask most small practice owners who their "HIPAA Security Officer" is, and you'll get a pause, then a guess. Ask to see the written designation, and the pause gets longer. That gap — a real person doing the job, but no documentation saying so — is one of the most common findings when outside reviewers actually look at a small practice's compliance file.

What OCR actually requires

This isn't a best practice or a recommendation. It's two separate, explicit requirements in the HIPAA rules themselves. The Privacy Rule, at 45 CFR § 164.530(a)(1)(i), requires every covered entity to designate a Privacy Officer. The Security Rule, at 45 CFR § 164.308(a)(2), separately requires a designated Security Officer. There's no small-practice exemption in either citation — a solo physician's office has the same designation requirement as a hospital system.

The good news: it doesn't need to be a dedicated hire, and it doesn't need to be two different people. In practices under 50 staff, it's standard — and compliant — for one person to hold both roles, often the owner, office manager, or physician themselves. What OCR and outside auditors actually check for isn't a fancy title. It's a written designation that documents who holds the role, what authority and time they've been given to do it, and who takes over if they're out. According to compliance firm d3rx's review of over 400 client compliance binders, the most common defect isn't a missing person — it's a designation that exists only informally, with no documented successor, no written job description, and no time actually allocated to the work.

That last point matters more than it sounds. d3rx estimates the role realistically takes 5 to 15 hours a month for a practice with one to five providers, climbing to 15 to 30 hours a month for five to twenty providers — reviewing access logs, handling patient complaints, tracking training, maintaining the breach log, and coordinating with IT on the security side. If that time isn't blocked on someone's calendar, the designation is a name on paper, not a functioning role.

Why this is getting more attention right now

We covered OCR's Risk Analysis Initiative last week — the enforcement push where investigators ask for a current, documented risk analysis as the first question after almost any breach. Officer designation is the quieter sibling of that same trend. OCR's own audit protocol lists "designate a privacy official" as a core Privacy Rule obligation, and compliance checklists built around that protocol now routinely tell practices to "appoint privacy and security leaders" and "define escalation paths" before anything else. Search interest in "HIPAA compliance officer" is up roughly 70% in Florida over the past few months — a sign practices are starting to ask this question themselves, often after hearing about another practice's OCR investigation.

The practical risk isn't usually a standalone penalty for a missing designation. It's what happens during an actual investigation. When OCR requests documentation — and the HIPAA Journal notes that failing to respond to those requests within the required timeframe is now one of the most common reasons complaints escalate — a practice with no clear, documented owner for that response loses time it doesn't have. Records need to be retrievable within 30 days in most cases, and six years of documentation needs to exist somewhere findable. Without a designated, documented officer, "somewhere findable" often means nowhere at all.

What this means if you're a South Florida practice

For practices across Palm Beach, Broward, and Miami-Dade, this is usually a fast fix, not a new program: formalize what's probably already happening informally. Put the designation in writing, name a backup, and put actual hours on someone's calendar each month for the work.

It's also worth building in from the start for practices newer to working with a HIPAA-focused IT partner — including the practices we're increasingly supporting as we extend our compliance-focused service reach into Martin and St. Lucie County, on the Treasure Coast. A documented Privacy and Security Officer designation is one of the first things we help a new client put in place, alongside the risk analysis, specifically because it's inexpensive to fix now and expensive to be missing later.

Practical takeaways

• Confirm in writing, today, who your designated Privacy Officer and Security Officer are — it's acceptable, and common, for one person to hold both roles.

• Put a real job description behind each title: what they review, how often, and what authority they have to act on findings.

• Name a documented backup for each role, so coverage doesn't depend on one person always being reachable.

• Block actual calendar time for the work — roughly 5-15 hours a month for a practice with 1-5 providers, more for larger groups.

• Confirm your documentation (training records, complaint logs, breach assessments) is retrievable within 30 days and retained for at least 6 years.

• If you can't produce a written designation today, treat that the same way you'd treat a missing risk analysis: your most urgent compliance gap, not a someday project.