On this page
A HIPAA privacy officer is the person a covered entity must designate as its privacy official under 45 CFR 164.530(a), "responsible for the development and implementation of the policies and procedures of the entity" (eCFR). The Security Rule separately requires a security official for electronic PHI, and in practice both should see any new marketing tool that could receive patient data before it goes live. Curve Compliance, which signs a BAA on every plan and whose team reviews what a website sends to Meta, Google and TikTok with the customer, checked each source below on November 2, 2026.
Book a call. Need a clear picture for your privacy officer? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, strips PHI before data reaches an ad platform, and shows what each platform received in Event Logs. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What the rule requires
The Privacy Rule's administrative requirements open with personnel. A covered entity "must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity," and it "must designate a contact person or office who is responsible for receiving complaints" and who can answer questions about its notice of privacy practices. Both designations must be documented (45 CFR 164.530(a)). HHS summarizes it the same way: "A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity's privacy practices" (HHS).
"Privacy officer" is the common job title; the regulation says "privacy official." HHS notes the rule is meant to scale: "What is appropriate for a particular covered entity will depend on the nature of the covered entity's business, as well as the covered entity's size and resources" (HHS). A solo practice and a hospital system both need one, with very different workloads. The designation itself is documentation, kept for six years from when it was created or last in effect (164.530(j)); see HIPAA document retention.
Privacy official and security official
| Role | Rule | Who must name one | What it covers |
|---|---|---|---|
| Privacy official | 45 CFR 164.530(a)(1)(i) | Covered entities, except some fully insured group health plans | Developing and implementing the privacy policies and procedures for PHI in any form |
| Contact person or office | 45 CFR 164.530(a)(1)(ii) | Covered entities, except some fully insured group health plans | Receiving complaints and explaining the notice of privacy practices |
| Security official | 45 CFR 164.308(a)(2) | Covered entities and business associates | Developing and implementing the Security Rule policies and procedures for electronic PHI |
The Security Rule's standard reads: "Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate" (45 CFR 164.308(a)(2)). Note the difference in reach. A marketing vendor that is a business associate must name a security official; the privacy official requirement in 164.530 is written for covered entities. The rule text describes two designations and does not say they must go to different people. For what the Security Rule asks of that official, see the three types of HIPAA safeguards.
Day-to-day duties
The Privacy Rule doesn't write a job description, but section 164.530 lists what the privacy official's policies must deliver (45 CFR 164.530):
- Policies and procedures. Written policies "designed to comply with" the Privacy Rule, changed and documented when the law or practices change.
- Training. Every workforce member is trained "as necessary and appropriate" for their role, new staff within a reasonable time, and anyone affected by a material policy change.
- Safeguards. "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information."
- Complaints. A process for people to complain, with every complaint and its outcome documented. See the HIPAA complaint process.
- Sanctions and mitigation. Sanctions for staff who break the policies, and mitigation "to the extent practicable" of any known harmful effect of an improper use or disclosure, including one by a business associate.
- No retaliation or waivers. No retaliation against anyone who files a complaint, and no requiring patients to waive their rights to get care.
- Documentation. Policies, required communications and required actions kept in written or electronic form for six years.
The notice of privacy practices must name the contact: it "must contain the name, or title, and telephone number of a person or office to contact for further information" (45 CFR 164.520(b)(1)(vii)). See the notice of privacy practices.
Marketing decisions to route through privacy
Many marketing changes look like a quick tool install. These are the decisions worth sending to the privacy official first:
- A new pixel, tag or analytics script. HHS says regulated entities may not use tracking technologies in a way that results in impermissible disclosures of PHI, and that disclosures "to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS).
- A cookie banner offered as consent. HHS says such banners "do not constitute a valid HIPAA authorization" (HHS).
- Using patient lists for campaigns. A covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," with narrow exceptions (45 CFR 164.508(a)(3)). See the Privacy Rule and marketing.
- Sponsored messages. If a third party pays you to send a message about its product or service, the treatment and operations exceptions no longer apply (164.501), and the authorization must say remuneration is involved (164.508(a)(3)(ii)). See what the Omnibus Rule changed.
- A new form, chat or scheduling tool. Who hosts the answers, and does the vendor sign a BAA?
- A finding that data already leaked. An impermissible disclosure to a tracking vendor without a BAA is presumed to be a breach unless a risk assessment shows a low probability of compromise (HHS). See the Breach Notification Rule.
Vendor and BAA reviews
HHS is specific about tracking vendors: "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." It adds: "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information" (HHS). A business associate contract must also require the vendor, at the end of the contract, to "return or destroy all protected health information" it still holds if feasible (45 CFR 164.504(e)).
A short review for each marketing vendor: does it sign a BAA, on which plan; which fields does each ad platform receive, event by event; is there a log of what was sent; and what happens to the data when you leave. Start with a list of what your site loads today: Curve's free website scan lists the pixels and trackers on a page, and this guide explains how to read the result. The BAA Directory shows each vendor's own BAA statement, and this page covers the ad platforms. If the scan finds ad pixels on booking or condition pages, book a call and Curve's team will walk your privacy officer through what each platform receives.
How Curve Compliance helps
Curve Compliance gives the privacy officer a marketing setup that can be explained. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve then replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with only a fixed list of fields per platform and neutral event names.
Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and contact identifiers are off by default on Meta, Google Ads and TikTok. Event Logs show what Curve sent to each platform and what the platform accepted, a record a privacy officer can use for a sign-off. Curve signs a BAA on every plan, is SOC 2 Type II, and its team does the setup, typically live in about a week. For questions about your own policies, talk to your counsel.
Sources, checked November 2, 2026: HHS, Summary of the HIPAA Privacy Rule; HHS, Summary of the HIPAA Security Rule; HHS, Use of Online Tracking Technologies; HHS, Regulatory Initiatives; eCFR, 45 CFR 164.308, 164.501, 164.504, 164.508, 164.520 and 164.530; Federal Register, 90 FR 898 (2025).
Frequently Asked Questions
What is a HIPAA privacy officer?
It is the privacy official a covered entity must designate to develop and implement its privacy policies and procedures under 45 CFR 164.530(a) (eCFR).
Is a HIPAA privacy officer required?
Yes, for covered entities: the Privacy Rule says a covered entity "must designate a privacy official" and a contact person or office for complaints, and document both (45 CFR 164.530(a)). The one carve-out is a fully insured group health plan that receives no PHI beyond summary health information and enrollment data (164.530(k)).
What does a HIPAA compliance officer do?
"Compliance officer" is a common title, not a term in the rule. The rule names a privacy official, who owns privacy policies, training, complaints, sanctions and mitigation (45 CFR 164.530), and a security official, who owns the Security Rule program (45 CFR 164.308(a)(2)).
What is a HIPAA security officer?
The security official that covered entities and business associates must identify to develop and implement their Security Rule policies and procedures (45 CFR 164.308(a)(2); HHS).
Can one person be both privacy and security officer?
The rule describes two designations and does not say they must be different people (164.530(a); 164.308(a)(2)). Document who holds each role either way.
Who should approve new marketing tools?
The privacy official for what the tool may receive and the security official for how ePHI in it is protected, before the tool goes live. HHS says tracking vendors that receive PHI need a signed BAA and a permission first (HHS).
What is the new HIPAA rule in 2026?
HHS says compliance with the remaining notice of privacy practices changes "is required by February 16, 2026," which lands on the privacy officer's desk, and the Security Rule update is still a proposed rule (HHS; Federal Register). See the new HIPAA rules in 2026.
Talk to Curve Compliance
Book a call. Want your privacy officer to see exactly what your ads receive? Curve Compliance strips PHI before data reaches an ad platform, logs every send in Event Logs and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.