Privacy Manager

Responsibilities

• Operate and improve the privacy program across HIPAA, 42 CFR Part 2, state privacy laws, behavioral health confidentiality, individual rights, vendor governance, and responsible AI use.
• Maintain privacy policies, procedures, controls, data maps, records of processing, ownership records, evidence, and testing schedules.
• Track privacy risks and operational metrics, including request volume, aging items, and remediation progress.
• Translate regulatory, payer, and contractual requirements into practical guidance and develop privacy training and resources.
• Triage privacy inquiries, individual rights requests, and potential incidents.
• Manage HIPAA and state privacy rights workflows, including access, amendment, accounting of disclosures, restriction, confidential communications, and deletion.
• Support incident investigations, documentation, root-cause analysis, corrective actions, notifications, and regulatory submissions.
• Conduct privacy assessments for products, vendors, workflows, and initiatives involving PHI or sensitive personal information.
• Evaluate AI and machine-learning use cases for appropriate data use, minimum-necessary access, retention, transparency, and human oversight.
• Conduct vendor privacy diligence with Legal and Security, maintain the BAA inventory, and drive gaps to resolution.
• Build scalable privacy checklists and playbooks.

Requirements

• 4–7 years of U.S. privacy experience in a regulated industry, such as healthcare, health technology, health plans, or financial services.
• Direct HIPAA experience strongly preferred.
• Hands-on experience in at least two of: privacy incidents, individual rights or DSAR workflows, privacy assessments, vendor and BAA governance, or privacy training.
• Ability to translate complex legal and regulatory requirements into clear, actionable guidance for non-experts.
• Strong judgment, communication, documentation, cross-functional influence, and ability to balance execution with program design.
• Fluency with AI tools for research, drafting, and analysis, with sound judgment regarding verification and regulated data.
• Ability to evaluate AI use cases involving patient data.
• Collaborative, pragmatic approach to ambiguity and pushback.

Nice to have

• Experience with 42 CFR Part 2, minor consent and confidentiality requirements, or other heightened-confidentiality regimes.
• Familiarity with payer or contractual privacy requirements.
• Experience assessing privacy risk in SaaS, cloud, or AI-enabled products.
• CIPP/US, CIPM, CIPT, CHPC, CHPS, or an AI governance credential.

Compensation

• $121,600–$190,000 annually.