HIPAA does not stipulate that the roles have to be assigned to different individuals, so it is possible for the privacy official and the security official to be the same person. However, it is more often the case in smaller organizations that the role of privacy official is assigned to an employee with an administrative position, while the role of security official is assigned to an employee in a senior IT position due to the complexity of some Security Rule implementation specifications.