Privacy Manager

GRP SCAN Group; California; Hybrid; USD 106,000 - 154,000; Full time

Benefits offered by this job

Mostly remote

Annual bonus

Wellness program

PTO and holidays

401(k) with employer match

Tuition reimbursement

Job summary

SCAN Health Plan in the United States is seeking a Privacy Manager to lead the enterprise privacy program across health plans and affiliated entities. The role translates HIPAA, state privacy laws, and AI data requirements into practical procedures and controls, coordinating risk assessments, incidents, and governance with Legal, Compliance, IT, Data, Clinical, Product, Marketing, HR, and Procurement.

You will guide privacy by design, monitor compliance metrics, prepare leadership dashboards,

Qualifications

• Bachelor's degree required; 5+ years in privacy/compliance or related field.
• Strong knowledge of HIPAA, HITECH, 42 CFR Part 2 and state privacy laws.
• Experience implementing privacy programs, investigations, and cross-functional initiatives.

Responsibilities

• Manage day-to-day privacy program activities for SCAN health plans and affiliates.
• Coordinate privacy risk assessments, audits, and incident response.
• Draft and implement privacy policies, notices, and standards under Privacy leadership.
• Prepare metrics and dashboards for leadership, audits, and regulatory inquiries.
• Advise across Legal, Compliance, IT, Data Analytics, Clinical, Product, Marketing, HR, and Procurement to embed privacy-by-design.
• Oversee AI/analytics governance, vendor oversight, and data minimization policies.

Skills

Privacy knowledge

Project management

Cross-functional collaboration

Policy implementation

AI governance

Education

Bachelor's Degree in Healthcare Administration, Law, Business or related field

Job description

Founded in 1977 as the Senior Care Action Network, SCAN began with a simple but radical idea: that older adults deserve to stay healthy and independent. That belief was championed by a group of community activists we still honor today as the “12 Angry Seniors.” Their mission continues to guide everything we do. Today, SCAN is a nonprofit health organization serving more than 500,000 people across Arizona, California, Nevada, New Mexico, Texas, and Washington, with over $8 billion in annual revenue. With nearly five decades of experience, we have built a distinctive, values-driven platform dedicated to improving care for older adults. Our work spans Medicare Advantage, fully integrated care models, primary care, care for the most medically and socially complex populations, and next-generation care delivery models. Across all this, we are united by a shared commitment: combining compassion with discipline, innovation with stewardship, and growth with integrity. At SCAN, we believe scale should strengthen—not dilute—our mission. We are building the future of care for older adults, grounded in purpose, accountability, and respect for the people and communities we serve.

The Job

The Privacy Manager, under the direction of the Chief Privacy Officer, manages assigned operational activities supporting SCAN’s enterprise privacy program across health plans and affiliated health care entities. The role translates federal and state privacy requirements into practical procedures and controls, coordinates privacy risk and incident activities, and supports privacy by design in business operations, data use, artificial intelligence (AI), analytics, and technology initiatives. The Manager collaborates with Legal, Compliance, Information Security, IT, Data, Clinical, Product, Marketing, Human Resources, Procurement, and business teams to protect individuals, support responsible innovation, and promote privacy accountability.

You Will

• Privacy Program Operations: Manage assigned day‑to‑day privacy program activities for SCAN health plans and affiliated health care entities. Implement established processes, controls, standards, and documentation supporting compliance across business and clinical operations.
• Privacy Risk Management: Perform and coordinate privacy impact assessments, risk assessments, audits, and gap analyses for products, vendors, technologies, data uses, and business changes. Maintain assigned risk register entries, track remediation, and elevate significant issues to Privacy leadership.
• Policy and Regulatory Implementation: Draft, update, and implement privacy policies, procedures, notices, standards, and operational guidance under Privacy leadership direction. Support implementation of HIPAA, HITECH, 42 CFR Part 2, federal health privacy requirements, and applicable state privacy, consumer health data, biometric, breach notification, and data security laws.
• Monitoring, Metrics, and Assurance: Conduct and coordinate monitoring and auditing activities related to privacy requirements, appropriate access, minimum necessary use, retention, data sharing, and individual rights. Prepare metrics, dashboards, and supporting materials for leadership, committees, audits, and regulatory inquiries.
• Privacy by Design and Business Partnership: Advise and collaborate with Legal, Compliance, Information Security, IT, Data and Analytics, Clinical, Product, Marketing, Human Resources, Procurement, and business teams to incorporate privacy requirements into projects, systems, contracts, digital experiences, communications, and operational workflows.
• Incident Response and Regulatory Support: Manage intake, investigation, risk assessment, documentation, mitigation, and closure of assigned privacy incidents. Coordinate corrective actions, support required notifications and regulatory responses, maintain defensible records, and elevate potential breaches or material issues to Privacy leadership.
• AI and Emerging Technology Governance: Assist with privacy reviews of AI, machine learning, automated decision systems, ambient technologies, online tracking technologies, and advanced analytics. Evaluate data sources, intended uses, transparency, human oversight, vendor practices, retention, secondary use, and individual impact; recommend safeguards and monitoring requirements.
• Training and Culture: Develop and deliver role‑based training, practical guidance, communications, and awareness materials that make privacy requirements understandable and actionable. Support a culture of accountability, member trust, and responsible innovation.
• Data Governance, Individual Rights, and Vendor Oversight: Manage or support operational processes for data minimization, retention and deletion, individual privacy rights, consent and preference management, and third‑party data sharing. Assist with privacy reviews of vendors, contracts, data use agreements, business associate arrangements, and higher‑risk processing activities; elevate complex issues as appropriate.

Your Qualifications

Bachelor's Degree in Healthcare Administration, Law, Business or related field or equivalent experience. 5 or more years of progressively responsible experience in privacy, compliance, information security, legal, health care operations, data governance, or related field. Strong knowledge of HIPAA, HITECH, 42 CFR Part 2, state medical privacy and breach notification laws, comprehensive state consumer privacy laws, and emerging consumer health data and AI requirements is preferred. Demonstrated experience implementing privacy and security requirements, conducting privacy reviews and investigations, assessing privacy and regulatory risks, supporting incident response activities, and coordinating cross‑functional initiatives is required. Experience applying privacy‑by‑design principles, evaluating emerging technologies, including artificial intelligence (AI), and supporting compliance with healthcare privacy and security regulations is preferred.

Preferred Certifications or Licenses

• CHPC, CIPP/US, CIPM, AIGP, or a comparable privacy, compliance credential preferred.

Preferred Experience

• 8 or more years of privacy, compliance, legal, data governance, information security, or related experience is preferred, particularly in health care, health insurance, digital health, or another highly regulated industry.
• Practical experience with privacy impact assessments, data inventories, individual rights, vendor oversight, incident response, regulatory inquiries, online tracking technologies, AI governance, and privacy‑enhancing controls is also preferred.
• Familiarity with the NIST Privacy Framework, NIST AI Risk Management Framework, HITRUST, SOC 2, ISO standards, or similar frameworks is beneficial.

Key Competencies

Strong project management, organization, and change implementation capabilities. Strong written and verbal communication, influence, and cross‑functional collaboration skills. Ability to interpret complex legal and technical requirements and convert them into practical operational controls. Ability to prioritize multiple regulatory, operational, incident, technology, and project‑based assignments. Ability to handle sensitive and confidential information with discretion and maintain defensible documentation.

What's in it for you?

Base Pay Range: $106,200 - $153,705 annually
Work Mode: Mostly Remote
An annual employee bonus program
Robust Wellness Program
Generous paid‑time‑off (PTO) along with 11 paid holidays per year, 1 floating holiday, birthday off, and 2 volunteer days
Excellent 401(k) Retirement Saving Plan with employer match
Robust employee recognition program
Tuition reimbursement
An opportunity to become part of a team that makes a difference to our members and our community every day!

Why consider a career at SCAN?

• A competitive compensation and benefits program;
• An annual employee bonus program;
• Generous paid‑time‑off (PTO);
• Eleven paid holidays per year;
• Excellent Retirement Savings program;
• A work‑life balance;
• An opportunity to become part of a team that makes a difference to our members and our community every day!

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities

The contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor’s legal duty to furnish information. 41 CFR 60-1.35(c)

We are committed to creating a workforce that reflects our community through inclusive programs and initiatives such as equal pay, employee resource groups, inclusive benefits, and more. SCAN is proud to be an Equal Employment Opportunity and affirmative action workplace. Individuals seeking employment will receive consideration for employment without regard to race, color, national origin, religion, age, sex (including pregnancy, childbirth or related medical conditions), sexual orientation, gender perception or identity, age, marital status, disability, protected veteran status or any other status protected by law. A background check is required.

At SCAN we believe that it is our business to improve the state of our world. Each of us has a responsibility to drive Equality in our communities and workplaces. We are committed to creating a workforce that reflects our community through inclusive programs and initiatives such as equal pay, employee resource groups, inclusive benefits, and more. SCAN is proud to be an Equal Employment Opportunity and affirmative action workplace. Individuals seeking employment will receive consideration for employment without regard to race, color, national origin, religion, age, sex (including pregnancy, childbirth or related medical conditions), sexual orientation, gender perception or identity, age, marital status, disability, protected veteran status or any other status protected by law. A background check is required.