HIPAA Privacy Officer Recruiters

What do we check before you see anyone?

Ask: “An employee accessed a neighbor’s chart without an apparent work reason. What would you examine first?” Look for access logs, role permissions, work assignments, interviews, and documented findings. The answer should not jump from an alert directly to a disciplinary recommendation.

• Ask: “A department sends patient information to the wrong recipient. How would you organize the review?” Useful answers describe containment, fact gathering, incident documentation, and consultation about breach assessment and notification obligations. Ask how the candidate tracks follow-up without making assumptions about the outcome.
• Ask: “How would you handle a patient complaint about an inappropriate disclosure?” Listen for respectful intake, a clear record of the concern, evidence review, and an explanation of next steps. Ask how they communicate findings while protecting other people’s information.
• Ask: “How do you teach minimum necessary practices to registration and billing staff?” Seek examples built around actual tasks, such as discussing account details or sending documents. A useful answer distinguishes applicable limits from situations where different disclosure rules apply.
• Ask: “What do you do when a patient requests access to records held across several systems?” Look for coordination with records staff, tracking of applicable deadlines, identity verification, and escalation of disputed decisions. Ask what they document when a request cannot be handled routinely.
• Ask: “How have you reviewed a new vendor’s access to patient information?” Listen for collaboration with procurement, counsel, and security, including business associate agreement review where applicable. Verify claimed privacy certifications with the issuing body. This role does not inherently require a clinical license.

Which mistakes stall the search?

A common mistake is combining privacy and information security without defining ownership. If one person covers both, ask for evidence in each area and identify the technical support available. Another is treating a certification as proof of investigation skill. Ask the candidate to walk through an anonymized case, including what remained uncertain and how the decision was recorded.