Privacy Manager

SCAN Health Insurance; United States; Remote; USD 106,000 - 154,000; Full time

Benefits offered by this job

Mostly Remote

Annual bonus program

Wellness program

PTO + holidays

401(k) plan

Recognition program

Tuition reimbursement

Job summary

SCAN Health Insurance is seeking a Privacy Manager to lead the enterprise privacy program across health plans and affiliates. This role translates HIPAA and state privacy requirements into practical procedures, coordinating risk assessments and incident responses while collaborating with Legal, Compliance, IT, and business teams to safeguard member privacy.

The role emphasizes privacy by design, governance of AI and analytics, and training to build a culture of privacy accountability across

Qualifications

• Bachelor’s Degree in Healthcare Administration, Law, Business or related field or equivalent experience.
• 5+ years of privacy, compliance, information security, or related field with HIPAA and related laws preferred.
• Experience implementing privacy and security requirements and coordinating cross-functional initiatives.
• Experience applying privacy-by-design principles to technologies and AI governance.
• Preferred privacy licenses/certifications (CHPC, CIPP/US, CIPM, AIGP).
• 8+ years privacy, compliance, or data governance experience preferred in regulated industries.
• Experience with privacy impact assessments, data inventories, and vendor oversight.
• Familiarity with NIST Privacy Framework and ISO/SOC standards beneficial.
• Strong project management and cross-functional collaboration skills.
• Excellent written and verbal communication and ability to translate legal/technical requirements into controls.
• Ability to manage multiple regulatory, incident, and project assignments.
• Ability to handle sensitive information with discretion.

Responsibilities

• Privacy Program Operations: manage day-to-day privacy program activities across plans and entities.
• Privacy Risk Management: perform privacy impact assessments, risk assessments, audits, and remediation tracking.
• Policy and Regulatory Implementation: draft and implement privacy policies and notices.
• Monitoring, Metrics, and Assurance: prepare dashboards and metrics for leadership and audits.
• Privacy by Design and Business Partnership: integrate privacy into projects, systems, contracts, and workflows.
• Incident Response and Regulatory Support: manage privacy incidents and regulatory notifications.
• AI and Emerging Technology Governance: assist with privacy reviews of AI, ML, and analytics.
• Training and Culture: develop role-based privacy training and awareness materials.
• Data Governance and Vendor Oversight: manage data minimization, retention, rights, and third-party reviews.
• We seek Rebels who are curious about AI and its power to transform how we operate and serve our members.
• Actively support SCAN’s Vision and Goals.

Skills

Privacy governance

Cross-functional collaboration

HIPAA knowledge

Regulatory compliance

Education

Bachelor’s degree in healthcare administration, law, business or related field

Job description

Founded in 1977 as the Senior Care Action Network, SCAN began with a simple but radical idea: that older adults deserve to stay healthy and independent. That belief was championed by a group of community activists we still honor today as the “12 Angry Seniors.” Their mission continues to guide everything we do.

Today, SCAN is a nonprofit health organization serving more than 500,000 people across Arizona, California, Nevada, New Mexico, Texas, and Washington, with over $8 billion in annual revenue. With nearly five decades of experience, we have built a distinctive, values-driven platform dedicated to improving care for older adults.

Our work spans Medicare Advantage, fully integrated care models, primary care, care for the most medically and socially complex populations, and next-generation care delivery models. Across all of this, we are united by a shared commitment: combining compassion with discipline, innovation with stewardship, and growth with integrity.

At SCAN, we believe scale should strengthen—not dilute—our mission. We are building the future of care for older adults, grounded in purpose, accountability, and respect for the people and communities we serve.

The Job

The Privacy Manager, under the direction of the Chief Privacy Officer, manages assigned operational activities supporting SCAN’s enterprise privacy program across health plans and affiliated health care entities. The role translates federal and state privacy requirements into practical procedures and controls, coordinates privacy risk and incident activities, and supports privacy by design in business operations, data use, artificial intelligence (AI), analytics, and technology initiatives. The Manager collaborates with Legal, Compliance, Information Security, IT, Data, Clinical, Product, Marketing, Human Resources, Procurement, and business teams to protect individuals, support responsible innovation, and promote privacy accountability.

You Will

• Privacy Program Operations: Manage assigned day-to-day privacy program activities for SCAN health plans and affiliated health care entities. Implement established processes, controls, standards, and documentation supporting compliance across business and clinical operations.

• Privacy Risk Management: Perform and coordinate privacy impact assessments, risk assessments, audits, and gap analyses for products, vendors, technologies, data uses, and business changes. Maintain assigned risk register entries, track remediation, and elevate significant issues to Privacy leadership.

• Policy and Regulatory Implementation: Draft, update, and implement privacy policies, procedures, notices, standards, and operational guidance under Privacy leadership direction. Support implementation of HIPAA, HITECH, 42 CFR Part 2, federal health privacy requirements, and applicable state privacy, consumer health data, biometric, breach notification, and data security laws.

• Monitoring, Metrics, and Assurance: Conduct and coordinate monitoring and auditing activities related to privacy requirements, appropriate access, minimum necessary use, retention, data sharing, and individual rights. Prepare metrics, dashboards, and supporting materials for leadership, committees, audits, and regulatory inquiries.

• Privacy by Design and Business Partnership: Advise and collaborate with Legal, Compliance, Information Security, IT, Data and Analytics, Clinical, Product, Marketing, Human Resources, Procurement, and business teams to incorporate privacy requirements into projects, systems, contracts, digital experiences, communications, and operational workflows.

• Incident Response and Regulatory Support: Manage intake, investigation, risk assessment, documentation, mitigation, and closure of assigned privacy incidents. Coordinate corrective actions, support required notifications and regulatory responses, maintain defensible records, and elevate potential breaches or material issues to Privacy leadership.

• AI and Emerging Technology Governance: Assist with privacy reviews of AI, machine learning, automated decision systems, ambient technologies, online tracking technologies, and advanced analytics. Evaluate data sources, intended uses, transparency, human oversight, vendor practices, retention, secondary use, and individual impact; recommend safeguards and monitoring requirements.

• Training and Culture: Develop and deliver role-based training, practical guidance, communications, and awareness materials that make privacy requirements understandable and actionable. Support a culture of accountability, member trust, and responsible innovation.

• Data Governance, Individual Rights, and Vendor Oversight: Manage or support operational processes for data minimization, retention and deletion, individual privacy rights, consent and preference management, and third-party data sharing. Assist with privacy reviews of vendors, contracts, data use agreements, business associate arrangements, and higher-risk processing activities; elevate complex issues as appropriate.

• We seek Rebels who are curious about AI and its power to transform how we operate and serve our members.

• Actively support the achievement of SCAN’s Vision and Goals.

• Other duties as assigned.

Your Qualifications

• Bachelor’s Degree in Healthcare Administration, Law, Business or related field or equivalent experience
• 5 or more years of progressively responsible experience in privacy, compliance, information security, legal, health care operations, data governance, or related field. Strong knowledge of HIPAA, HITECH, 42 CFR Part 2, state medical privacy and breach notification laws, comprehensive state consumer privacy laws, and emerging consumer health data and AI requirements is preferred.
• Demonstrated experience implementing privacy and security requirements, conducting privacy reviews and investigations, assessing privacy and regulatory risks, supporting incident response activities, and coordinating cross-functional initiatives is required.
• Experience applying privacy-by-design principles, evaluating emerging technologies, including artificial intelligence (AI), and supporting compliance with healthcare privacy and security regulations is preferred.
• Preferred Certifications or Licenses: CHPC, CIPP/US, CIPM, AIGP, or a comparable privacy, compliance credential preferred.
• Preferred 8 or more years of privacy, compliance, legal, data governance, information security, or related experience is preferred, particularly in health care, health insurance, digital health, or another highly regulated industry.
• Practical experience with privacy impact assessments, data inventories, individual rights, vendor oversight, incident response, regulatory inquiries, online tracking technologies, AI governance, and privacy-enhancing controls is also preferred.
• Familiarity with the NIST Privacy Framework, NIST AI Risk Management Framework, HITRUST, SOC 2, ISO standards, or similar frameworks is beneficial.
• Strong project management, organization, and change implementation capabilities
• Strong written and verbal communication, influence, and cross-functional collaboration skills
• Ability to interpret complex legal and technical requirements and convert them into practical operational controls
• Ability to prioritize multiple regulatory, operational, incident, technology, and project-based assignments
• Ability to handle sensitive and confidential information with discretion and maintain defensible documentation

What’s in it for you?

• Base Pay Range: $106,200 - $153,705 annually
• Work Mode: Mostly Remote
• An annual employee bonus program
• Robust Wellness Program
• Generous paid-time-off (PTO) along with 11 paid holidays per year, 1 floating holiday, birthday off, and 2 volunteer days
• Excellent 401(k) Retirement Saving Plan with employer match
• Robust employee recognition program
• Tuition reimbursement
• An opportunity to become part of a team that makes a difference to our members and our community every day!

We’re always looking for talented people to join our team!

At SCAN we believe that it is our business to improve the state of our world. Each of us has a responsibility to drive Equality in our communities and workplaces. We are committed to creating a workforce that reflects our community through inclusive programs and initiatives such as equal pay, employee resource groups, inclusive benefits, and more.

SCAN is proud to be an Equal Employment Opportunity and Aff…

Individuals seeking employment will receive consideration for employment without regard to race, color, national origin, religion, age, sex (including pregnancy, childbirth or related medical conditions), sexual orientation, gender perception or identity, age, marital status, disability, protected veteran status or any other status protected by law. A background check is required.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities

The contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor’s legal duty to furnish information. 41 CFR 60-1.35(c)