IT - Medicaid - Senior Privacy Analyst

Job Description

Job DescriptionTitle: IT - Medicaid - Business Analyst - Senior Privacy Analyst– Contract Opportunity
Duration: 12 Months Contract - The assignment is currently budgeted for the current fiscal year. Position has the possibility of extending into the next fiscal year.
Location: Candidate will work 100% Onsite in Montgomery AL Main Office (No remote work allowed)


Position Summary

• The Senior Privacy Analyst supports the Agency Privacy Officer in the day-to-day operation of the Agency’s privacy program.
• This position reviews, tracks, coordinates, and documents privacy-sensitive requests and incidents involving:

• Medicaid applicants, recipients, and beneficiaries
• Claims, eligibility, and enrollment information
• Provider and program integrity data
• Protected Health Information (PHI)
• Personally Identifiable Information (PII)

Key Responsibilities:

Privacy Request Management
Responsible for processing and reviewing:

• Individual access requests
• Information-gathering requests
• Recipient-directed disclosures
• HIPAA authorizations
• Subpoenas and court/legal requests
• Privacy complaints
• Privacy incident reports
• Breach reporting activities

Privacy Compliance & Risk Assessment

• Apply HIPAA Privacy and Breach Notification requirements.
• Ensure compliance with Medicaid confidentiality requirements and applicable regulations.
• Review requests and incidents for privacy risks and compliance concerns.
• Verify identity and authority while adhering to minimum necessary standards.
• Follow established escalation procedures and privacy best practices.
• Conduct remote and onsite privacy assessments to verify compliance.

Program Support & Audit Participation

• Assist in the development, implementation, maintenance, and documentation of the Agency’s privacy program, including participation in federal and state audits conducted by organizations such as:

Social Security Administration (SSA)

• Internal Revenue Service (IRS)
• U.S. Department of Health & Human Services (HHS)
• Centers for Medicare & Medicaid Services (CMS)
• Office for Civil Rights (OCR)
• State Examiner’s Board
• Other regulatory and oversight agencies

Knowledge, Skills, and Abilities (KSAs)
Required Knowledge

• Working knowledge of HIPAA Privacy Rule and Breach Notification requirements.
• Working knowledge of Medicaid confidentiality requirements, particularly 42 CFR Part 431, Subpart F.
• Understanding of 42 CFR Part 2 considerations and related privacy requirements.

Required Skills
Ability to review and evaluate:

• Subpoenas
• Court orders
• HIPAA authorizations
• Access requests
• Privacy incident reports
• Ability to assess documentation for completeness, compliance, and privacy risk.
• Ability to verify identity and authority without over-collecting or retaining unnecessary documentation.
• Strong analytical, documentation, and problem-solving skills.
• Ability to implement and monitor privacy best practices and compliance standards.

Regulatory Knowledge Areas

• HIPAA Privacy Rule
• HIPAA Breach Notification Rule
• Medicaid Confidentiality Requirements
• 42 CFR Part 431, Subpart F
• 42 CFR Part 2
• PHI and PII Protection Standards
• Minimum Necessary Standard
• Identity and Authority Verification Requirements