Privacy Impact Assessment (PIA) Specialist - Senior

LanceSoft; Toronto; Remote; CAD 80,000 - 120,000; Full time

Job summary

An established industry player is seeking a Senior Privacy Impact Assessment Specialist to ensure compliance with privacy obligations while supporting key IT projects. This role involves conducting privacy assessments, advising on privacy risks, and developing privacy requirements for various initiatives. The ideal candidate will have a strong background in health privacy, project management, and familiarity with relevant regulations. Join a forward-thinking organization that values the protection of personal health information and offers a dynamic work environment focused on innovation and compliance.

Qualifications

• 3+ years of health privacy experience conducting privacy impact assessments.
• 5+ years of operational level privacy experience in health sector or IT.

Responsibilities

• Conducting Privacy Impact Assessments and associated documentation.
• Providing privacy consultation on complex health privacy issues.

Skills

Health Privacy Experience

Privacy Impact Assessments (PIAs)

Project Management

Data Sharing Agreements

Privacy Policies and Procedures

Familiarity with PHIPA

API Functionality

Electronic Medical Records (EMR)

Education

Undergraduate or Graduate Degree in Health, Computer Science, Engineering, Law, Security

Tools

MS Project

MS Teams

Job description

Job Title: Privacy Impact Assessment (PIA) Specialist - Senior
Location: Toronto, ON (100% Remote)
Duration: 12-month contract + possible extension
Job Description:
Background Information:
The purpose of this procurement of a Senior Privacy (PIA) Specialist is to acquire a contingent resource to act as a dedicated privacy subject matter expert to assist with supporting privacy matters related to a number of key Information Technology projects that include Patients Before Paperwork (PB4P) initiatives, enterprise products & services, business intelligence tools, and cloud migration.
Client is seeking a Privacy resource to ensure that maintains compliance with its legal and contractual privacy obligations and builds privacy into the design of projects that involve personal health information (PHI), thus reducing risk for the organization and protecting the trust and privacy of individuals whose PHI we manage.
Responsibilities:

• Conducting/Completing Privacy Impact Assessments and associated documentation
• Providing Privacy Consultation on a diverse range of complex, multi-stakeholder health privacy issues and Information Technology (IT) initiatives
• Identify and assess privacy risks, including developing risk mitigation plans
• Create or inform the creation of data flow diagrams and associated privacy controls and compliance requirements
• Reviewing and advising on agreements, including data sharing agreements
• Developing privacy requirements for new or changing projects
• Providing privacy advisory and support to business teams
• Other duties as required

Desired Skills:

• Demonstrable knowledge of project management; Knowledge and understanding of Project Management’s Institute’s Project Management Body of Knowledge is an asset
• Experience working on and delivering multiple projects
• Demonstrated project management software skills and experience e.g. MS Project, MS Teams etc.
• University undergraduate or graduate degree in Health, Computer Science, Engineering, Law, Security, or a related discipline from a recognized institution or equivalent experience – desired
• Familiarity with Prescribed Entities (PEs) or Prescribed Persons (PP) under the Personal Health Information Protection Act (PHIPA), and their related requirements, is an asset
• Familiarity with audit logging and Security Information and Event Management (SIEM) technology is an asset
• Familiarity with technical data protection controls and technology such as encryption and tokenization is an asset
• Knowledge and understanding of Accessibility for Ontarians with Disability Act (AODA) and related regulations and standards is an asset

Required Skills:

• Minimum 3 years’ health privacy experience conducting privacy impact assessments (PIAs) on medium to high complexity projects.: 20 Points
• Minimum 5 years’ direct operational level privacy experience in a health sector and/or IT environment or both.: 20 Points
• Minimum 5 years’ experience in developing privacy policies and procedures, requirements, or controls.: 20 Points
• Minimum 5 years’ experience drafting and reviewing privacy requirements for data sharing agreements.: 15 Points
• Familiarity with the Personal Health Information Protection Act (PHIPA), and requirements related to Health Information Network Provider (HINP) and Electronic Service Provider (ESP).: 10 Points
• Familiarity with Application Programming Interface (API) functionality and management.: 7.5 Points
• Familiarity with Electronic Medical Record (EMR) or Hospital Information System (HIS) infrastructure, design, and data flows.: 7.5 Points

Must haves:

• Minimum of 3 years’ health privacy experience conducting privacy impact assessments (PIAs) on medium to high complexity projects
• Minimum 5 years’ direct operational level privacy experience preferably in a health sector and/or IT environment
• Minimum 5 years' experience drafting and reviewing privacy requirements for data sharing agreements
• Minimum 5 years’ experience developing privacy policies and procedures, requirements, or controls
• Familiarity with the Personal Health Information Protection Act (PHIPA), and its related requirements for Health Information Network Providers (HINP) and Electronic Service Providers (ESP)
• Familiarity with Application Programming Interface (API) functionality and management
• Familiarity with Electronic Medical Record (EMR) or Hospital Information System (HIS) infrastructure, design, and data flows