Officer designation, evidenced not assumed

The rule requires a named security official. Most clinics have one in the sense that someone would raise their hand, which is not the same as a designation anyone can produce.

The policy is composed from your clinic’s facts

Your officer designation policy names both your privacy and security officers, how designations are made, what authority the role carries, the qualifications expected, where complaints go, rendered from your own recorded contact, how the workforce is told, interim coverage during a vacancy, the cadence for keeping designations current, how changes are handled, and records. A clinic where one person holds both roles gets a clause addressing exactly that.

What gets tracked after the policy exists

Eight requirements:

• A privacy officer is appointed, and a security officer is appointed.
• Each has designation evidence on file, a signed letter or a designation attestation.
• If the same person holds both roles, a written rationale explains why.
• The policy is adopted, reviewed within twelve months, with facts that have not drifted.

The dual-role check compares the two appointments and only asks for a rationale when they are the same person. Small clinics frequently combine the roles, which is permitted, but combining them without a stated reason is a gap worth closing before someone asks.

What this is, and what it is not

The system tracks appointments, evidence documents, and the dual-role rationale. It does not evaluate whether the named officer actually performs the role, has the time for it, or is qualified beyond what your policy states. A designation on file is a designation, not a working compliance function.

That said, the failure this catches is real: an officer named in a policy years ago who has since left, or a role assigned verbally with nothing signed.

What an investigator gets

Two named officers with signed designation evidence and dates. A documented rationale where the roles are combined. A policy naming where complaints go. The answer to “who is your security official,” with a document behind it.