HIPAA privacy officer and security officer: the two roles a small NEMT company must name

The designations HIPAA requires

HIPAA makes a company assign three jobs to specific people, or for complaints, to an office:

• Privacy official. A covered entity must designate the person responsible for developing and carrying out its privacy policies and procedures (45 CFR 164.530(a)(1)(i)).
• Complaint contact. A covered entity must also name a person or office that receives privacy complaints and can answer questions about its notice of privacy practices (164.530(a)(1)(ii)). The notice itself has to list that contact by name or title, with a phone number (164.520(b)(1)(vii)).
• Security official. Covered entities and business associates alike must identify the official responsible for their Security Rule policies (164.308(a)(2)).

Which of these apply depends on your HIPAA role. Our guide to HIPAA for NEMT providers explains how to decide, one line of business at a time, whether you hold covered entity or business associate status.

Business associates name a security official, not a privacy official

A company that runs trips only as a broker’s subcontractor counts as a business associate under HIPAA, and the privacy official requirement does not reach it by law. HHS said so directly in the 2013 Omnibus rule: business associates do not have to designate a privacy official unless a covered entity hands them that duty by contract (78 FR 5566). The security official requirement does apply, because the Security Rule covers business associates.

Broker contracts fill the gap in practice. They make you report privacy and security problems on a short clock, so someone has to own that call.

One person can hold every role

The owner or office manager can be privacy official, complaint contact, and security official at once. HHS said in 2003 that the same person could fill the security and privacy roles. In 2000 it said the privacy job could be an added duty for an existing employee, using an office manager in a small entity as its example, and that duties may be shared as long as one person stays accountable.

HHS also declined to set qualifications for the role, because the job varies so much with the size of the organization.

What the job covers in a small fleet

In a NEMT company the privacy and security officer usually handles:

• Policies. Keep the written rules for manifests, phones, texting, records requests, and disposal, and update them when something changes.
• Training records. Make sure drivers and office staff are trained and that the training is documented, as the HIPAA guide describes.
• Complaints and sanctions. Log every privacy complaint and what was done about it (164.530(d)), and apply the sanction policy when someone breaks the rules.
• The risk analysis. Lead the Security Rule risk analysis; the risk assessment template is a starting point.
• Incident reports. Take the first report of a lost phone or misdirected manifest and meet the broker’s deadline. WellTrans’s subcontractor agreement (October 2025) allows one business day for improper disclosures and security incidents.
• Agency questions. Answer an OCR inquiry. Riders can complain to HHS within 180 days of learning of a problem (45 CFR 160.306), and the guide to an OCR investigation covers what happens next.

Put the designation in writing

The designation has to be documented. Privacy Rule records stay on file for six years, counted from creation or from the last day they applied if that is later (164.530(j)), and the Security Rule sets the same six-year period for its own documentation (164.316(b)(2)). A one-page memo with the person’s name, title, start date, and duties, signed by the owner, does the job. When the person leaves, write a new designation and keep the old one.

HealthRide is HIPAA compliant. In the provider portal, each person sees only what their role allows, and a record of every change gives your privacy officer something concrete to check when a question comes in.