Senior Privacy Analyst

POSITION SUMMARY:

The Senior Privacy Analyst role provides support for operations and initiatives critical to Boston Medical Center Health Systems (BMCHS) information privacy practices. It is expected that this individual will support the implementation of our information privacy strategy and goals, which includes various projects and programs central to the privacy function throughout the organization.

Reporting functionally to the Director of Compliance and Privacy, the Senior Privacy Analyst is responsible for the implementation of all aspects of privacy and security breach case intake, investigations, internal reporting, monitoring and improvement efforts. The Senior Privacy Analyst assists with projects, external incident and breach reporting, and development of employee training and engagement material. The Senior Privacy Analyst monitors policies and procedures to align with and reflect current and future state and federal regulations (including HIPAA and HITECH).

Position: Senior Privacy Analyst        

Department: Compliance

Schedule: Full Time

ESSENTIAL RESPONSIBILITIES / DUTIES:

The Senior Privacy Analyst will champion good information stewardship and privacy practices across BMCHS.

Prepares and completes all steps necessary to resolve privacy and security incidents. This includes:

• Manage and maintain all channels of incident reporting.
• Prepares intake documentation, contacts involved parties, conducts interviews, and researches data of privacy incidents to complete cases.
• Uses risk assessment standards to determine breach and reporting requirements.
• Prepares documentation of incident review and retains in the department’s incident tracking system.
• Works with all levels of staff and clinicians including department heads, information security / information technology, office of general counsel, clinical research and institutional review board, patient advocacy, quality and safety, and human resources.
• Maintains integrity of privacy breach files with all supporting documentation.
• Responsible for ensuring mailings to patients are accurate, timely and recorded for regulatory requirements and reporting.
• Utilizes hospital’s clinical systems to investigate reports of inappropriate access or breach or protected health information.
• Conducts audits of clinical records in response to patient request or at the direction of the Director, Compliance and Privacy.
• Conducts proactive audits to ensure the integrity of the medical record.
• Assists in facility walkthroughs for physical audits.
• Manages process as necessary to complete deadlines.
• Suggests continuous improvement and solutions for Privacy Office. Identifies root causes of issues, assesses trends, recommends changes, and reports these to the Director, Compliance and Privacy.
• Monitor the Privacy Office phone line and email address as needed.

Project Management:

• Develop project plans for consultation requests that require in-depth review by compliance and other stakeholders.
• Set deadlines, determine necessary stakeholders, coordinate meetings and follow projects through to completion.

• Human Resources and Compliance Line:

• Take the lead in developing bi-weekly agendas for review and collaboration with Human Resources Labor Relations team.
• Prepare weekly Compliance Line complaints, track to completion all complaints in the incident management system.
• Lead investigatory reviews of any issues that require meeting with employees, document all steps and present on meetings at the Human Resources Labor Relations meeting.

Research Privacy and Security Reviews:

• Establish a workflow for reviewing any researcher initiated requests to the department.
• Develop agenda for the Research Privacy and Security meetings and see each issue through to completion.
• Proactively recommend topics to bring to the bi-weekly Research Compliance meeting with support from the Director, Compliance and Privacy.

Policy Management:

• Ensure all Compliance and Privacy policies are renewed at the required intervals to stay current.
• Proactively review policies in both Compliance and Privacy manuals to recommend substantive updates when regulation or operational changes warrant review.
• Identify on a monthly