Privacy Attorney

Summary

The Privacy Attorney / Privacy Officer serves as the single customer point of contact for privacy on large healthcare customer accounts and is responsible for account compliance with the HIPAA Privacy and Security Rules and state privacy laws. As a licensed attorney, the Privacy Attorney / Privacy Officer also advises Gainwell staff and executives on applicable state and federal privacy laws and manages complex matters, including external and internal audit responses and interactions with regulators.

Gainwell clients are highly regulated with comprehensive privacy and security needs. This position will implement and oversee account-specific privacy programs, including policies and procedures, quality improvement projects, incident investigations, risk assessment activities, and staff member training. The Privacy Attorney / Privacy Officer reports to the Corporate Privacy Officer.

Your role in our mission

• Subject matter expert for HIPAA Privacy and Security regulations and state/local privacy laws, including OCR and NIST privacy and security guidance and controls.
• Interpret and apply privacy and confidentiality requirements specific to government health programs, including Medicaid safeguarding requirements under 42 CFR Part 431, Subpart F, 42 CFR Part 2 for substance use disorder records, IRS Publication 1075 for federal tax information, and CMS and state agency contract requirements.
• Advise our staff and executives regarding applicable state and federal privacy laws and manage complex matters, including external and internal audit responses, contract analysis, and interacting with regulators.
• Advise our product teams on applicable privacy regulations and Privacy-By-Design principles.
• Review new technologies, analytics, and AI use cases and partner with AI governance and information security teams to ensure compliance with privacy and emerging AI laws.
• Investigate and report on privacy-related incidents. Conduct risk assessments to determine impact of incidents. Drive compliance with federal and state reporting requirements.
• Develop and deliver privacy and security awareness training for account staff, including onboarding and annual training, and maintain records of training completion.
• Conduct monitoring assessments to ensure staff member compliance with privacy and security policies and procedures.
• Be the face of privacy for staff members and create a culture of compliance in which reporting of concerns and incidents is encouraged and supported.
• Author and maintain all documentation supporting HIPAA compliance including privacy policies, health information management procedures, Incident Response Plans (IRPs), Privacy Impact Assessments (PIAs), and related controls.
• Be available outside normal business hours, including nights and weekends, to respond to privacy and security emergency incidents that may affect company and client operations.
• Assist clients in handling requests from individuals exercising their privacy rights, including access and amendment requests as well as privacy complaints.
• Work with the client Contracting Officer to supply and support initiatives and deliverables as outlined in the contract. Provide guidance on Business Associate Agreement (BAA) provisions and related privacy and security contract requirements.
• Support and contribute to Corporate privacy initiatives, documentation, and training as requested by the Corporate Privacy Officer.

  The above list of core responsibilities for the this position is not all-inclusive. The Privacy Attorney / Privacy Officer may perform additional duties as needed to support Gainwell or client account needs.

What we're looking for

• 5-7 years of experience in healthcare privacy, including overseeing the establishment, implementation, and adherence to corporate policies on privacy, confidentiality, and release of information, and developing, conducting, and reporting on privacy risk assessments.
• Law degree from an ABA-accredited law school and licensed to practice in at least one U.S. state.
• Strong written and verbal communication skills, with the ability to explain complex legal and regulatory requirements to executives, technical teams, and clients, and to manage multiple priorities in a fast-paced environment.
• Possess and maintain privacy certification from HCCA, IAPP, AHIMA, or equivalent. CIPP/US is preferred.
• Experience in a healthcare payer or insurance setting, or in a state or federal agency, is preferred.
• AI Governance experience is preferred

What you should expect in this role