County Privacy Officer

Clackamas County; Oregon City (OR); Hybrid; USD 110.000 - 170.000; Vollzeit

Zusammenfassung

Clackamas County seeks a strategic County Privacy Officer to shape privacy practices across the organization. You will lead the enterprise privacy program, translate regulatory requirements into policies, and coordinate responses to privacy incidents with Technology Services, County Counsel, and other stakeholders.

The role requires experience in healthcare privacy legislation, data analytics, and the ability to influence policy across departments.

Qualifikationen

• Five years of related compliance/regulatory experience in health care.
• Experience in healthcare compliance/regulatory affairs and data analytics.
• Familiarity with health care legislation and patient privacy standards.

Aufgaben

• Develop, implement, and maintain countywide privacy policies, procedures, standards, and guidelines.
• Monitor HIPAA compliance and privacy requirements across federal/state levels; assess impacts and recommend changes.
• Coordinate privacy incident response, investigations, and remediation with stakeholders.

Kenntnisse

Strategic thinking

Analytical skills

Collaboration

Regulatory affairs

Data visualization

Ausbildung

Bachelor's degree in health information management or related healthcare field

Jobbeschreibung

The first application review will be on Tuesday, November 10, 2026. We reserve the right to close this recruitment at any time on or after that date.

JOB DETAILS AND QUALIFICATIONS

Clackamas County seeks a strategic, analytical, and collaborative professional to serve as County Privacy Officer. This high-profile role will shape how the county collects, uses, stores, shares, and protects personal and confidential information. As the county’s Enterprise Privacy Officer and HIPAA Compliance Officer, you will strengthen privacy practices, support regulatory compliance, and develop a culture of accountability and trust.

The County Privacy Officer leads the development and implementation of the County’s enterprise privacy program, translating complex statutory and regulatory requirements into practical policies, procedures, and standards. Responsibilities include monitoring compliance with federal and state privacy requirements, evaluating emerging legislation, assessing privacy risks, conducting privacy impact assessments, and coordinating responses to suspected privacy incidents in partnership with Technology Services, County Counsel, and other stakeholders. The role also develops countywide privacy training and awareness programs adapted to departmental needs and risk levels.

Working across the organization, the County Privacy Officer advises executive leadership and collaborates with departments such as Health, Housing and Human Services, Human Resources, the Sheriff’s Office Jail, and the Medical Examiner’s Office to promote consistent privacy practices. Additional responsibilities include coordinating individual privacy rights requests, leading cross-departmental initiatives, developing program metrics, analyzing data, and preparing executive reports and policy recommendations to evaluate effectiveness and guide improvements.

The successful candidate will bring substantial healthcare compliance or regulatory experience, deep knowledge of healthcare privacy legislation and standards, and the ability to translate complex requirements into clear, actionable guidance. Strong analytical skills, experience presenting data, and sound judgment when advising leadership on sensitive issues are essential. The ability to build partnerships, communicate effectively, and influence practices across organizational boundaries is key to success.

This policy leadership role has a strong regulatory component and involves countywide data analysis and strategic planning. The County Privacy Officer will protect sensitive information, support informed decision‑making, and help improve staff and public practices and systems.

Clackamas County is a hybrid covered entity under HIPAA, meaning the law applies to designated County components rather than the entire organization. The County Privacy Officer will help those components meet their obligations while supporting consistent privacy practices across the entire organization.

Required Minimum Qualifications/Transferable Skills*

• A minimum of five (5) years of related compliance and/or regulatory experience that would provide the required knowledge and skills to perform the responsibilities of this position
• Experience in a health care‑related field, including a role in Compliance and/or Regulatory Affairs
• Experience in data analytics and presentation of data
• Extensive familiarity with relevant health care legislation and standards for the protection of health information and patient privacy
• Experience in advancing health equity, addressing systemic health disparities, and collaborating with diverse, vulnerable, and underrepresented populations

Preferred Qualifications/Transferable Skills*

• Bachelor's degree or higher in health information management or a related healthcare field
• Experience in the development, implementation, or management of an enterprise‑wide privacy program.
• Experience interpreting and applying HIPAA Privacy, Security, and Breach Notification Rules and applicable state privacy laws.
• Experience conducting privacy impact assessments, risk assessments, or compliance audits and developing corrective action plans.
• Experience investigating privacy incidents or breaches and coordinating remediation.
• Experience developing and delivering privacy training or compliance education programs.
• Experience advising executive leadership on complex regulatory requirements, privacy risks, and policy decisions.
• Experience leading cross‑functional initiatives and developing performance measures to evaluate program effectiveness.
• Possession of one or more of the following professional certifications:
  • Certified in Healthcare Privacy and Security (CHPS)
  • Certified in Healthcare Privacy Compliance (CHPC)
  • Certified Information Privacy Professional (CIPP)
  • Certified Information Privacy Manager (CIPM)

Pre‑Employment Requirements:

• Must pass a criminal history check, which may include a national or state fingerprint records check
• Driving is required for county business on a regular basis or to accomplish work. Incumbents must possess a valid driver's license and possess and maintain an acceptable driving record throughout the course of employment.

*For veterans qualified for Veterans' Preference: If you believe you have skills that would transfer well to this position and/or special qualifications that relate to this position, please list those skills and/or qualifications in the open‑ended question at the end of the application and explain how those skills and/or qualifications relate to this position.

TYPICAL TASKS

Duties may include, but are not limited to, the following:

Privacy Program Leadership & Policy Development:Develop, implement, and maintain countywide privacy policies, procedures, standards, and guidelines. Interpret complex legal and regulatory requirements and translate them into practical operational practices aligned with County strategic goals and legal obligations.

Compliance Oversight & Regulatory Monitoring:Serve as the County’s HIPAA Compliance Officer and monitor compliance with HIPAA and applicable federal and state privacy requirements. Evaluate emerging legislation, regulatory guidance, and industry practices; assess potential impacts; and recommend policy or operational changes as needed.

Privacy Risk Assessment & Mitigation: Conduct and oversee privacy impact assessments and compliance reviews to identify risks associated with the collection, use, storage, sharing, retention, and disposal of sensitive information. Develop and recommend mitigation strategies and corrective actions to strengthen privacy protections.

Privacy Incident Response & Investigation:Coordinate the investigation, documentation, remediation, and reporting of suspected privacy incidents and breaches in collaboration with Technology Services, County Counsel, and other stakeholders. Identify trends and recommend improvements to prevent recurrence and strengthen incident response practices.

Countywide Training & Awareness:Develop, deliver, and maintain mandatory privacy training and ongoing awareness programs for County employees and contractors. Create specialized training and guidance for departments with heightened privacy risks or unique regulatory requirements.

Interdepartmental Coordination & Executive Support:Serve as a strategic privacy advisor to executive leadership and County departments, including Health, Housing and Human Services, Human Resources, the Sheriff’s Office Jail, and the Medical Examiner’s Office. Promote consistent privacy practices, provide consultation on complex issues, and coordinate responses to individual privacy rights requests, including requests for access to or correction of personal information, as applicable.

Performance Measurement, Reporting & Strategic Initiatives: Establish and track privacy program metrics, analyze data, evaluate program effectiveness, and prepare executive‑level reports and recommendations. Lead cross‑departmental initiatives requiring advanced research, policy analysis, strategic planning, and coordination to improve privacy governance and support continuous improvement.

WORK SCHEDULE

This position is included in the County’s alternate workweek program, working 40 hours during a standard workweek of Monday through Thursday (Fridays off). Specific hours of work will be discussed with the candidate selected for this position at the time an offer of employment is extended.

This position is eligible for hybrid on-site/telework and based on the Department’s business needs. The exact amount of on-site/telework and schedule will be discussed with the hiring manager during time of offer. Telework locations cannot be located outside of Oregon or Washington. Washington residents must perform 50% of their time on-site at Clackamas County.