Remote Director, HIPAA IT Security & Risk

UofL Health; Louisville (KY); Remote; USD 140,000 - 190,000; Full time

Job summary

UofL Health is seeking a Director of IT HIPAA Security to oversee the organization’s information security program and HIPAA compliance, focusing on PHI access, risk assessments, and policy updates. The role requires directing audits, guiding teams, and coordinating with legal and administration to improve privacy controls.

You will educate staff on security standards, manage incident response, and ensure compliance with HIPAA Security Rule across administrative, technical, and physical

Qualifications

• Bachelor’s degree in a related field is required.
• Five years of information security/IT experience is required.
• Five years of HIPAA Privacy regulatory experience is required.
• Experience in developing and administering a healthcare privacy program is preferred.
• Must be open to relocating to the Louisville, KY area.

Responsibilities

• Oversee all audit activities for information systems and review results for trends.
• Build a strategic HIPAA security program to protect ePHI and ensure integrity and availability.
• Develop and implement HIPAA and information security policies, standards and procedures.
• Educate workforce on security standards related to ePHI.
• Manage Incident Reporting and Response system for security incidents.

Skills

Project management

HIPAA security

Information security

Leadership

Policy development

Cross-functional collaboration

Education

Bachelor’s degree

Advanced degree

Tools

Vulnerability scanners

Security software

Windows operating systems

Job description

UofL Health is seeking a Director of IT HIPAA Security to oversee the organization’s information security program and HIPAA compliance, focusing on PHI access, risk assessments, and policy updates. The role requires directing audits, guiding teams, and coordinating with legal and administration to improve privacy controls.

You will educate staff on security standards, manage incident response, and ensure compliance with HIPAA Security Rule across administrative, technical, and physical