Privacy Program Governance and Administration
Building the Program
A privacy program needs formal structure: a designated Privacy Official, documented policies and procedures, a workforce training plan, a complaint process, and a sanctions policy. Governance also includes assigning responsibility for the Security Rule (often a Security Official) and ensuring the two roles coordinate. The Privacy Official is the point of contact for individuals and for the Secretary of HHS on privacy matters.
Documentation and Retention
Policies must be in writing and retained for six years from the date of last effective use. Documentation of required actions-training, risk analyses, complaint resolutions, and disclosures-supports both compliance and defensibility. A frequent gap is having policies that exist but were never communicated or enforced.
Traps Candidates Miss
- One person can hold both privacy and security roles in smaller organizations, but the functions must still be performed.
- Policies alone are insufficient; the organization must actually apply and document them.
- Sanctions must be applied consistently; a documented sanctions policy that is never used signals a weak program.
- The Notice of Privacy Practices is a governance deliverable that must be current and posted.
Rule of Thumb
If a required element cannot be produced as a dated, written artifact, treat it as missing. Governance questions reward "documented and applied" over "understood informally."
Worked Example
An auditor asks how the organization handles patient complaints. A strong answer describes a written complaint process, a designated recipient, a log, a resolution timeline, and evidence that complaints were reviewed by the Privacy Official-not merely that staff "know who to ask."