HIPAA Privacy Lead – Policy, Risk & Compliance

This is a fully remote position, open to applicants in Texas.

📋 Description

• Oversee and enhance HIPAA Privacy policies and procedures across all covered entities and business associates.

• Provide guidance to business, clinical, and IT teams regarding PHI management and strategies for mitigating privacy risks.

• Establish, execute, and monitor HIPAA controls alongside GRC, ensuring privacy requirements are in harmony with broader regulatory frameworks, including SOC 2.

• Evaluate project designs, system implementations, and process modifications to ensure HIPAA compliance and a privacy-by-design approach.

• Manage the BAA inventory, which includes drafting, monitoring, and addressing any gaps.

• Assist with the de-identification framework, covering Safe Harbor, Expert Determination, tokenization, and egress governance.

• Collaborate with external legal counsel on privacy-related inquiries, data architecture evaluations, and tracking unresolved items.

• Perform HIPAA privacy risk assessments and analyses of breach risks.

• Maintain the privacy risk register and drive remediation efforts to completion.

• Work closely during incidents on breach evaluations, escalation, containment, notification decisions, and post-incident protocols.

• Act as the primary contact for privacy complaints, investigations, and regulatory inquiries.

• Lead vendor risk assessments for third-party entities managing PHI.

• Supervise patient requests for access, amendments, restrictions, and confidential communications.

• Collaborate with Engineering and Data Engineering to trace PHI/PII data flows and assess new systems, AI/agentic tools, and vendor integrations.

• Create self-service tools and templates for standard privacy requirements.

• Design and conduct workforce training on HIPAA privacy and incident management.

• Represent AHG's privacy stance in regulatory, audit, and compliance discussions.

• Keep abreast of regulatory changes and report on program status to the CCO.

⛳️ Requirements

• A minimum of 5 years of direct HIPAA Privacy compliance experience in a regulated setting, particularly within a Specialty Pharmacy or other Covered Entity.

• Practical experience in mapping PHI/PII data flows.

• Proven experience leading a HIPAA Annual Risk Assessment.

• Background in designing and delivering HIPAA Incident Management training.

• Familiarity with the interplay between the HIPAA Privacy Rule and Security Rule.

• Knowledge of BAA requirements (45 CFR §164.504(e), §164.314(a)).

• Understanding of de-identification standards (§164.514).

• Experience in drafting or managing BAAs, data-sharing agreements, or privacy policies.

• Direct experience collaborating with external counsel and technical stakeholders.

• Proficiency with compliance and governance platforms like OneTrust, NAVEX, RSA Archer, ServiceNow GRC, or similar tools.

• Familiarity with document management systems.

• Proficient in Microsoft Office Suite, including Excel, Word, PowerPoint, and Outlook.

• Strong writing skills to convert legal/regulatory requirements into practical guidance.

• Must possess legal authorization to work in the United States without current or future sponsorship.

• Preferred: Certifications such as CHC, CHPC, or CIPP/US.

• Preferred: Experience in pharmacy, DTC health/wellness brands, or multi-brand healthcare holding structures.

• Preferred: Knowledge of BigQuery, cloud data warehouses, or tokenization/de-identification tools.

• Preferred: Exposure to SOC 2 programs.

🏝️ Benefits

• Comprehensive benefits package including medical, vision, dental, a 401(k) plan with company matching, paid time off, flexible days, holidays, and more.