Privacy Officer and Security Officer designation letters

Granite City Family Dental — Officer designations. Version 1.0. Effective November 1, 2026. Designations dated November 1, 2026.

Authority: 45 CFR 164.530(a)(1) (Privacy Officer and complaint contact); 45 CFR 164.308(a)(2) (Security Officer).

1. Why these letters exist

HIPAA requires every covered entity and business associate to name, in writing, one person responsible for privacy and one person responsible for security. In a small practice the same person often holds both roles, as is the case here. The owner keeps the legal responsibility; the officers carry the work. These letters are the written designation OCR asks for first in any review, and they are re-confirmed every year at the October review.

2. Privacy Officer designation

Date: November 1, 2026

To: Janelle Okafor, Office Manager

From: Dr. Maria Lindqvist, Owner and Dentist, Granite City Family Dental, P.A.

Effective November 1, 2026, you are designated the Privacy Officer of Granite City Family Dental, P.A. under 45 CFR 164.530(a)(1)(i). You are responsible for the development, implementation and day-to-day oversight of the practice's privacy policies and procedures. You report directly to me on these matters and have the authority to stop any use or disclosure of protected health information that you believe violates the law or this binder, pending my review.

You are also the contact person who receives patient privacy complaints and questions about the Notice of Privacy Practices under 164.530(a)(1)(ii). Your name is printed in the Notice.

Duties of the Privacy Officer

1. Maintain the privacy policies in this binder, review them every year and after any change in law or practice, and keep every version for six years (164.530(i), (j)).
2. Maintain and distribute the Notice of Privacy Practices, post it in the office and on https://www.granitecityfamilydental.example, and keep the acknowledgment records (164.520).
3. Make sure every workforce member is trained on privacy policies when hired and when policies change, and keep the training roster (164.530(b)).
4. Receive, log, investigate and resolve privacy complaints, and make sure no one is retaliated against for complaining (164.530(d), (g)).
5. Recommend and document sanctions for privacy violations under the sanction policy (164.530(e)).
6. Mitigate the harmful effects of any improper use or disclosure (164.530(f)).
7. Handle patient rights requests — access, amendment, accounting of disclosures, restrictions and confidential communications — within the time limits, and keep the request log (164.522–164.528).
8. Approve non-routine disclosures and keep the minimum-necessary matrix current (164.502(b), 164.512, 164.514(d)).
9. Verify the identity and authority of anyone requesting PHI (164.514(h)).
10. Keep the business associate register and make sure a signed agreement exists before any vendor receives PHI (164.502(e), 164.504(e)).
11. Perform or oversee the four-factor breach risk assessment with the Security Officer and make sure breach notices go out on time, including the under-500 report to HHS by March 1 each year (164.402–164.414).
12. Apply the administrative, physical and technical safeguards for PHI in every form — paper, oral, fax, mail, text and social media (164.530(c)).
13. Keep the Minnesota consent-for-release process and form compliant with Minn. Stat. 144.291–144.298 and check the copy-fee schedule against Minn. Stat. 144.292 each year.

Resources and authority

You may call on CRU Technologies, outside counsel and the practice's cyber liability insurer (Pending quote) as needed. Time for this work is part of your regular duties. When you are unavailable, Dr. Maria Lindqvist acts in your place.

Designated by: Dr. Maria Lindqvist, Owner and Dentist

Signature: ______________________________ Date: ______________

Accepted by: Janelle Okafor, Privacy Officer

Signature: ______________________________ Date: ______________

3. Security Officer designation

Date: November 1, 2026

To: Janelle Okafor, Office Manager

From: Dr. Maria Lindqvist, Owner and Dentist, Granite City Family Dental, P.A.

Effective November 1, 2026, you are designated the Security Officer of Granite City Family Dental, P.A. under 45 CFR 164.308(a)(2). You are responsible for the development and implementation of the policies and procedures that protect electronic protected health information (ePHI) under the HIPAA Security Rule. You report directly to me on these matters and may direct the IT provider, CRU Technologies, on security configuration within the budget I approve. You hold this role in addition to your designation as Privacy Officer. The two designations are kept separate in writing so that each set of duties is clearly assigned.

Duties of the Security Officer

1. Lead the security risk analysis of all ePHI at every location and in every system, keep it current, and repeat it at least annually and after any significant change (164.308(a)(1)(ii)(A)).
2. Maintain the risk management plan: every medium or high risk has an owner, a planned action, a due date and a status, and closed items are kept as proof of risk reduction (164.308(a)(1)(ii)(B)).
3. Review information system activity — audit logs, access reports, security incident reports — on the schedule in the Technical Safeguards policy and record each review (164.308(a)(1)(ii)(D)).
4. Approve, modify and remove user access with the administrator; run the periodic access review; make sure departing workforce members lose access the same day (164.308(a)(3)–(4)).
5. Run the security awareness program: reminders, malware protection, log-in monitoring and password management, with the training tracker (164.308(a)(5)).
6. Own the security incident response plan, receive incident reports, lead containment with the IT provider and keep the incident log (164.308(a)(6)).
7. Own the contingency plan: backups, disaster recovery, emergency mode operations, the annual restore test and the criticality list (164.308(a)(7)).
8. Lead the annual technical and non-technical evaluation and present it at the annual review (164.308(a)(8)).
9. Confirm that every business associate with ePHI access has a signed agreement with security terms (164.308(b), 164.314(a)).
10. Maintain physical safeguards: facility access, workstation use and security, and the device and media inventory with disposal records (164.310).
11. Maintain technical safeguards: unique user IDs, emergency access, automatic logoff, encryption, audit controls, integrity controls, authentication (including MFA) and transmission security (164.312).
12. Keep security documentation for six years and make it available to the workforce members who need it (164.316).

Resources and authority

The IT provider, CRU Technologies, supports you under its business associate agreement. When you are unavailable, Dr. Maria Lindqvist acts in your place.

Designated by: Dr. Maria Lindqvist, Owner and Dentist

Signature: ______________________________ Date: ______________

Accepted by: Janelle Okafor, Security Officer

Signature: ______________________________ Date: ______________

4. Backup designee

When the Privacy Officer or the Security Officer is away, unreachable, or is the subject of a complaint, Dr. Maria Lindqvist acts in their place. The backup designee may receive complaints and incident reports, start the incident response plan, place a hold on a disclosure, and contact the IT provider, counsel and the insurer. Decisions on sanctions, breach determinations and policy changes wait for the officer or the owner unless a legal deadline would otherwise be missed. Every action taken by the backup designee is recorded in the relevant log.

Backup designee: Dr. Maria Lindqvist

Signature: ______________________________ Date: ______________

5. Contact summary

6. Annual re-confirmation

At each annual review the owner re-confirms or replaces both designations. If an officer leaves or changes roles, a new letter is issued within 30 days and this page is updated.