Privacy Attorney

This is a fully remote position, open to applicants in Texas.

📋 Description

• Act as the primary point of contact for privacy matters on large healthcare customer accounts.

• Ensure compliance with HIPAA Privacy and Security Rules as well as state privacy regulations.

• Provide guidance to Gainwell personnel and executives regarding relevant state and federal privacy legislation.

• Oversee intricate issues, including responses to external and internal audits and communications with regulators.

• Implement and manage account-specific privacy initiatives.

• Create policies and procedures, lead quality improvement efforts, conduct incident investigations, perform risk assessments, and provide staff training.

• Serve as the subject matter expert on HIPAA, OCR, and NIST privacy and security policies and controls.

• Interpret privacy and confidentiality obligations for governmental health programs, including Medicaid, substance use disorder records, federal tax information, and CMS and state agency contracts.

• Counsel product teams on privacy laws and Privacy-by-Design principles.

• Review technologies, analytics, and AI applications in collaboration with AI governance and information security teams.

• Investigate and report incidents related to privacy and conduct risk evaluations.

• Ensure compliance with federal and state reporting obligations.

• Develop and provide training on privacy and security awareness while maintaining completion records.

• Carry out monitoring assessments to verify adherence to privacy and security policies.

• Draft and maintain HIPAA compliance documentation, including policies, procedures, IRPs, PIAs, and associated controls.

• Respond to privacy and security emergency incidents outside of regular business hours.

• Assist clients with requests and complaints regarding privacy rights.

• Aid in contract initiatives and deliverables, including BAA provisions and related privacy and security obligations.

• Support corporate privacy initiatives, documentation, and training efforts.

⛳️ Requirements

• 5-7 years of experience in healthcare privacy.

• Proven experience in establishing, implementing, and ensuring compliance with corporate policies on privacy, confidentiality, and information release.

• Skilled in developing, conducting, and reporting on privacy risk assessments.

• Juris Doctor degree from an ABA-accredited law institution.

• Licensed to practice law in at least one U.S. state.

• Excellent written and verbal communication abilities.

• Capable of explaining complex legal and regulatory requirements to executives, technical teams, and clients.

• Ability to handle multiple priorities in a dynamic environment.

• Must possess and retain privacy certification from HCCA, IAPP, AHIMA, or an equivalent organization.

• CIPP/US certification is preferred.

• Experience in a healthcare payer or insurance environment, or within a state or federal agency, is preferred.

• Experience in AI governance is preferred.

🏝️ Benefits

• Flexible work options.

• Opportunities for learning and career advancement.

• Generous and flexible vacation policy.

• Employer-matched 401(k) plan.

• Comprehensive health benefits.

• Educational assistance programs.

• Leadership and technical development academies.

• Career growth opportunities.