HIM- Manager: HIM, Privacy Officer FT/Day

JOB SUMMARY: The Manager, Health Information Management (HIM) & Privacy Officer is responsible for planning, directing, and overseeing the Health Information Management program for a California Critical Access Hospital (CAH), including associated rural health clinic or outpatient operations, as applicable. The position ensures the integrity, availability, confidentiality, security, retention, and appropriate disclosure of health information; supports accurate, timely clinical documentation, coding, billing, and quality reporting; and maintains organizational readiness for regulatory, accreditation, payer, and privacy compliance reviews.
As the designated Privacy Officer, the incumbent develops, implements, monitors, and improves the organization’s privacy program; coordinates investigation and response to potential privacy incidents and breaches; oversees patients’ privacy rights; and serves as a resource to workforce members, medical staff, leadership, business associates, and patients regarding the appropriate use and disclosure of protected health information (PHI) and medical information. The position works collaboratively with Revenue Cycle, Nursing, Medical Staff, Quality, Risk Management, Compliance, Information Technology, Human Resources, Legal Counsel, and executive leadership.
PERFORMANCE DIMENSIONS AND TASKS
Essential Job Functions
The duties listed below are the essential functions of this position. Employees must be able to perform these essential functions, with or without reasonable accommodation. This list is intended to describe the primary responsibilities of the position and is not intended to be an exhaustive list of all duties. Additional job-related duties may be assigned as needed.

Health Information Management
• Directs day-to-day HIM operations for the CAH and applicable outpatient, clinic, skilled nursing, swing-bed, emergency, and ancillary services.
• Maintains an organized, secure, accessible, and complete health-record system that supports patient care, reimbursement, quality reporting, legal requirements, and organizational operations.
• Oversees the timely assembly, analysis, completion, scanning, indexing, quality review, deficiency management, and retention of paper and electronic health records.
• Ensures processes are in place to monitor medical-record completeness, authentication, timeliness, legibility, and content requirements consistent with medical-staff bylaws, rules and regulations, organizational policy, and applicable law.
• Coordinates with Medical Staff Services and clinical leadership to monitor delinquent-record reports; communicates deficiencies to providers; and administers record-completion escalation or suspension processes in accordance with approved medical-staff policies.
• Oversees release-of-information (ROI) operations, ensuring disclosures and authorizations are processed accurately, timely, securely, and in accordance with HIPAA, the California Confidentiality of Medical Information Act (CMIA), California Health and Safety Code requirements, 42 CFR Part 2 when applicable, and organization policies.
• Maintains processes that support patients’ rights to access, inspect, obtain copies of, request amendment to, and receive an accounting of disclosures of their health information, as applicable.
• Develops, implements, and monitors medical-record retention, destruction, storage, and retrieval procedures. Following the California Hospital Association Record Retention policy.
• Oversees document-imaging, scanning, indexing, and quality-assurance functions to ensure documents are complete, correctly assigned, available in the electronic health record, and protected from loss, alteration, or unauthorized disclosure.
• Coordinates with clinical leaders, providers, coding staff, and revenue-cycle personnel to resolve documentation, coding, charging, and record-completion issues that may affect claim integrity, quality reporting, utilization review, audits, or reimbursement.
• Oversees internal and external coding, documentation, and HIM audits; identifies trends and opportunities; and develops or supports corrective actions and education.
• Coordinates audit responses related to documentation, coding, billing, medical-record production, payer requests, Recovery Audit Contractor reviews, and government or commercial-payer audits.
• Ensures required HIM-related reports, logs, and documentation are completed accurately and timely, including reports required by leadership, medical staff, quality, regulatory agencies, payers, and other authorized entities.
• Coordinates health-record functions related to birth-certificate processes and required reporting, when applicable to the organization’s services and designated responsibilities.

Privacy Officer
• Serves as the organization’s designated Privacy Officer and leads the privacy-compliance program for the CAH and affiliated operations, as assigned.
• Develops, reviews, implements, and maintains privacy policies, procedures, forms, notices, training materials, and monitoring processes consistent with HIPAA, HITECH, California privacy requirements, applicable federal and state regulations, and organization policy.
• Maintains and supports the organization’s Notice of Privacy Practices, authorization forms, accounting-of-disclosures procedures, complaint processes, and patient-rights processes.
• Receives, documents, investigates, trends, and coordinates response to privacy complaints, suspected unauthorized access, use, or disclosure of PHI or medical information, and other privacy concerns.
• Conducts or coordinates privacy-incident and breach risk assessments in collaboration with Information Technology, Risk Management, Compliance, Human Resources, Legal Counsel, and leadership.
• Coordinates required breach notifications, reports, documentation, mitigation, and follow-up. California-licensed facilities must report a medical-information breach to CDPH no later than 15 days after detection, with required patient notification obligations also applying; HIPAA and other state requirements may impose additional notification duties.(cdph.ca)
• Oversees privacy-related access monitoring, audit-log review, role-based access concerns, and corrective actions in collaboration with Information Technology and department leaders.
• Ensures workforce members, volunteers, medical staff, contractors, students, and applicable business associates receive required privacy education and understand their responsibilities for protecting PHI and medical information.
• Coordinates with Legal Counsel, Compliance, Information Technology, and operational leaders regarding business-associate agreements, vendor privacy obligations, and appropriate access to PHI.
• Provides guidance on subpoenas, court orders, law-enforcement requests, coroner requests, attorney requests, workers’ compensation requests, public-health reporting, and other special disclosures in consultation with Legal Counsel and organizational policy.
• Maintains complete, confidential documentation of privacy complaints, investigations, sanctions, mitigation, reporting decisions, breach notifications, and corrective actions.
• Prepares regular privacy-program reports for leadership and appropriate committees, including incident trends, education completion, audit findings, mitigation activities, and identified privacy risks.

Department Leadership and Compliance
• Develops, implements, and maintains HIM policies, procedures, workflows, productivity standards, quality-monitoring processes, and departmental goals.
• Supervises assigned HIM staff; participates in selection, orientation, scheduling, training, performance evaluation, coaching, competency assessment, corrective action, and succession planning.
• Establishes workload priorities and ensures reliable coverage for record completion, ROI, scanning, deficiency management, coding coordination, and other departmental functions.
• Develops and monitors the HIM department budget, staffing plan, supply needs, vendor contracts, and performance indicators.
• Maintains readiness for CMS, CDPH, HCAI, accrediting-organization, payer, and other external reviews involving health records, patient rights, privacy, coding, or documentation.
• Participates in the CAH’s Quality Assessment and Performance Improvement program and contributes HIM, documentation, privacy, and data-integrity expertise to performance-improvement projects.
• Prepares reports, dashboards, and presentations for the Director of Revenue Cycle, Chief Financial Officer, Quality/Risk, Medical Staff, Compliance, executive leadership, and board or committee review, as assigned.
• Monitors regulatory changes affecting HIM, privacy, records retention, documentation, coding, data governance, and release of information; recommends policy, process, training, or system changes as needed.
• Performs other duties consistent with the scope of the position and as assigned by leadership.

.

QUALIFICATIONS

Education
• Associate degree or higher in Health Information Management, Health Information Technology, Health Informatics, Healthcare Administration, Nursing, Business Administration, or a closely related field - Required
• Bachelor’s degree in Health Information Management, Health Informatics, Healthcare Administration, or a related field - Preferred.

Certification
• Current Registered Health Information Technician (RHIT) or Registered Health Information Administrator (RHIA) credential issued by the American Health Information Management Association - Required
• Certified Coding Specialist (CCS), Certified Coding Specialist–Physician-based (CCS-P), Certified in Healthcare Privacy and Security (CHPS), Certified in Healthcare Compliance (CHC), or other relevant HIM/privacy/compliance credential - Preferred.
• Credentials must be maintained in active status throughout employment.

Work Experience
• At least three years of progressively responsible HIM, medical-records, clinical-documentation, coding, revenue-cycle, privacy, compliance, or closely related healthcare experience – Required
• At least two year of supervisory, lead, coordinator, or management experience in HIM or a closely related healthcare operational function – Required
• Experience in an acute-care hospital, Critical Access Hospital, rural hospital, rural-health clinic, or integrated hospital/clinic system – Preferred
• Experience with electronic health records, document-imaging systems, electronic ROI workflows, coding systems, deficiency-management tools, privacy access auditing, and data-reporting tools – Required
• Demonstrated experience supporting medical-record completion, ROI, coding/documentation audits, record-retention practices, privacy investigations, or HIPAA compliance – Required
• Experience with California hospital regulatory requirements, CDPH surveys, CMS Conditions of Participation, medical-staff documentation requirements, and payer or government audits - Preferred

Knowledge, Skills and Abilities
• Knowledge of HIM principles, medical-record content and completion standards, clinical documentation, coding processes, reimbursement documentation requirements, record retention, ROI, and information governance.
• Knowledge of federal and California requirements affecting health information, including HIPAA, HITECH, the California Confidentiality of Medical Information Act, applicable California Health and Safety Code and Title 22 provisions, 42 CFR Part 2 when applicable, and CAH Conditions of Participation.
• Knowledge of patient access rights and hospital obligations to facilitate patient access to medical records. Federal CAH participation requirements state that hospitals must not frustrate legitimate patient efforts to obtain their medical records and must meet those requests as promptly as the recordkeeping system permits
• Ability to conduct objective investigations, document facts, protect confidentiality, assess risk, and escalate concerns appropriately.
• Ability to plan, organize, prioritize, and manage multiple urgent and routine responsibilities while meeting internal and external deadlines.
• Ability to supervise, coach, evaluate, and develop staff; assign work; set performance expectations; and maintain productive, respectful working relationships.
• Proficiency with Microsoft Office applications, particularly Excel, Word, Outlook, and PowerPoint, and with electronic health records and HIM-related systems.

Language Requirements
• Proficient in English, both written and spoken – Required. Bilingual English/Spanish - Preferred

Physical Requirements
• Must be able to sit up to 6 hours and stand/walk up to 2 hours.
• Must be able to lift and push up to 10 pounds.
• Must be able to use hands repetitively for 6 hours or more.

Working Conditions
• The position primarily performs administrative, management, analytical, and computer-based work in an office and healthcare environment.
• The incumbent may periodically visit clinical, registration, HIM, clinic, and other operational areas; review paper or electronic records; participate in meetings, audits, tracers, surveys, and education activities; and interact with staff, medical staff, patients, vendors, and regulatory representatives.
• The employee may be exposed to typical healthcare-environment conditions and must follow all MMHS safety, infection-prevention, confidentiality, and security requirements

DISCLAIMER:
The preceding job description has been designed to indicate the general nature and level of work performed. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.