Position Summary:

Position manages NRECA's data privacy protection compliance program by developing, implementing and maintaining the organization's privacy and record retention policies, procedures and practices in accordance with applicable federal and state privacy laws, including the HIPAA privacy regulation. Performs ongoing compliance monitoring activities and leads the investigation and resolution of unauthorized data disclosure incidents and breaches. Provides technical and business guidance to internal staff and members regarding compliance with federal and state privacy regulations.

Essential Duties and Responsibilities:

• Builds a strategic and comprehensive privacy program that defines, develops, maintains and implements policies and procedures that enable consistent, effective privacy practices which minimize risk and ensure the confidentiality of personally identifiable information (PII) and protected health information (PHI), paper and/or electronic, across all media types. Ensures privacy authorization and request forms, the HIPAA Privacy Rule Policy and Procedure Manual, and other associated policies and procedures are up-to-date.
• Works with information security, the Insurance and Financial Services' data management and senior management teams to establish governance for the privacy program and protection of data.
• Serves as the primary point of contact for internal staff, members and outside vendors regarding data privacy.
• Collaborates with the Chief Information Security Officer to ensure alignment between the security and privacy compliance programs including policies, practices, investigations, and acts as liaison to the information security team. Maintains NRECA's Information Incident Response Plan.
• Keeps current on technical level developments and strategic implications of state and federal privacy laws, including the HIPAA privacy regulation.
• Provides guidance and direction to members and internal staff regarding the impact of privacy regulatory actions and required modifications to their responsibilities.
• Approves or denies the use and disclosure of, and requests for, protected health information (PHI).
• Develops monitoring program to ensure ongoing compliance with privacy policies and procedures, evaluates results based on technical expertise and recommends enhancements.
• Develops and delivers educational programs to internal staff and members on federal and state privacy laws, including the HIPAA privacy regulation.
• Serves on the Information Security Advisory Committee to develop, promote and foster enterprise privacy and security awareness training, delivers department-focused privacy policy training initiatives, and coordinates annual Data Privacy Day activities.
• Leads multidisciplinary projects and serves as the internal technical expert in the development of website privacy policies, the HIPAA notice of privacy practices, plan document amendments, and negotiating and execution of HIPAA business associate agreements.
• Monitors HIPAA business associates' adherence to applicable privacy responsibilities and requirements and ensures all concerns are addressed as part of the Supplier Risk Management Oversight Program.
• Leads multidisciplinary teams including NRECA staff, experts assigned by NRECA's insurance provider, and state or local government agents in investigating and responding to potential breaches of protected health information (PHI) and personally identifiable information (PII).
• Establishes and administers a process for receiving, documenting, tracking, investigating and taking action on all complaints concerning privacy policies and procedures in collaboration with other similar functions and/or legal counsel. Addresses any compliance reviews or investigations with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).
• Manages and monitors NRECA's record retention and destruction policy to reflect current business practices and regulatory requirements. Ensures that departments maintain records according to the defined record retention schedule. Evaluates opportunities to streamline the saving, sharing, retrieval and destruction of records.
• Responsible for the proper security and disposal of confidential information that he or she may possess in the course of performing this position's job duties, in accordance with NRECA's Personnel & Administrative Policy and HIPAA Privacy and Security Policies & Procedures Manuals.

Direct Reports to this Position:

N/A

Qualifications

Formal Education Required:

Bachelor's degree in business administration, health information management or related field.

Experience and Certifications Required:

15+ years of experience with federal and state privacy and breach notification laws, and the HIPAA privacy regulation.

Required privacy certification such as Certified Information Privacy Professional (CIPP/US) and/or Certified Information Privacy Manager (CIPM).

FLSA Status: Exempt

Knowledge, Skills and Abilities Required ( as demonstrated by prior work experience ):

• Knowledge of federal and state privacy laws and the HIPAA privacy regulation to an overall data privacy protection compliance program as demonstrated by prior work experience.
• Knowledge of developing data privacy, access, disclosure of information policies and release control procedures.
• Ability to anticipate internal and or external business challenges and/or regulatory issues; recommends process or risk mitigation options as demonstrated by prior work experience.
• Ability to be persuasive, negotiate, and collaborate with individuals at all levels inside and outside of the organization.
• Ability to manage competing deadlines and multiple projects at various stages of development using effective organization skills and attention to detail.
• Ability to lead highly visible multidisciplinary project/program teams or initiatives and provide leadership as the authority in a specialized field.
• Ability to lead people and foster collaborative skills and consensus building while operating in a fast-moving environment.
• Ability to effectively interact with others and work in a team environment and providing follow-up when needed.
• Ability to communicate, both verbally and in writing, with a diverse membership, employees and/or vendors in a clear and precise manner.
• Ability to use Microsoft Office tools (Excel, Word, Outlook, Power Point) in the day-to-day essential duties of the job.
• Ability to operate various office equipment such as personal computer, copier, printer, fax machine or other job-related equipment.
• Ability to provide service excellence by building relationships, being resourceful, responsive and respectful.

Essential Physical Requirements :

• The worker is required to have close visual acuity to perform an activity such as: preparing and analyzing data and figures; transcribing; viewing a computer terminal and extensive reading.
• Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force frequently, and/or a negligible amount of force constantly to move objects. If the use of arm and/or leg controls requires exertion of forces greater than that for sedentary work and the worker sits most of the time, the job is rated for light work.

Additional Requirement:

The preceding job description has been written to reflect management's assignment of essential functions. It does not prescribe or restrict the tasks that may be assigned. All qualified applicants will receive consideration for employment without regard to race, color, sex, sexual orientation, gender identity, religion, national origin, disability, veteran status, or other legally protected status.

NRECA is committed to working with and providing reasonable accommodation to individuals with physical and mental disabilities. If you need special assistance or an accommodation while seeking employment, please e-mail humanresources@nreca.coop or call: 703-907-5992 - NRECA Arlington Human Resources. Please call 402-483-9275 - NRECA Lincoln Human Resources, for Lincoln, NE employment opportunities. We will make a determination on your request for reasonable accommodation on a case-by-case basis.

EEO is the Law. The law requires NRECA to post a notice describing the Federal laws prohibiting job discrimination. For information regarding your legal rights and protections, please click on the following link: EEO is the Law and EEO is the Law Supplement .

Pay Transparency Non-Discrimination. NRECA will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay. Please see the Pay Transparency Nondiscrimination Provision for more information.

E-Verify. As a Federal Contractor, NRECA is required to participate in the E-Verify Program to confirm eligibility to work in the United States. For information please click on the following link: E-Verify .