Privacy Specialist

Virginia Commonwealth University Health; Richmond, Northern (VA, KY); Hybrid; USD 52,000 - 81,000; Full time

Job summary

Virginia Commonwealth University Health seeks a Privacy Specialist to advance privacy investigations and operational activities ensuring HIPAA compliance. You will coordinate with Legal, Compliance, ISRM, HIM, and IT teams to support risk assessments, policy updates, and regulatory readiness across the organization.

The role emphasizes developing actionable findings, maintaining defensible documentation, and contributing to enterprise privacy initiatives while identifying gaps and driving

Qualifications

• Required Education: Bachelor’s degree in healthcare administration, compliance, public health, health information management, business administration, or a related field.
• Preferred Education: Master’s degree in healthcare administration, compliance, public health, health information management, business administration, or a related field.
• Licensing/Certification Required: Certification in healthcare privacy or compliance (e.g., CHPC, CHPS) or ability to obtain within one year of hire.
• Licensure/Certification Preferred: Additional certifications in privacy or compliance (e.g., CIPP, CIPM, CHC) are preferred.

Responsibilities

• Conduct privacy investigations from intake through resolution with thorough fact gathering, interviews, and documentation.
• Perform access reviews and audit log analysis to detect potential inappropriate access or disclosure.
• Apply HIPAA breach risk assessment standards to determine impermissible use or disclosure.
• Develop findings, conclusions, and recommendations with clear, defensible documentation.
• Coordinate with Legal, Compliance, Information Security, HIM, and operations during investigations.
• Ensure timely case progression and closure per timelines and standards.
• Coordinate and execute privacy operations activities, tracking initiatives and workflows.
• Support development, review, and maintenance of privacy policies, procedures, and standards.
• Prepare and maintain reports, dashboards, and metrics for leadership visibility.
• Support regulatory readiness activities including audits, assessments, and documentation reviews.
• Participate in enterprise initiatives (research privacy, vendor data use, interoperability, AI governance).
• Identify operational gaps and opportunities for process improvement.

Skills

HIPAA knowledge

Interviews & documentation

Cross-functional collaboration

Dashboards & reporting

Communication skills

Project coordination

Education

Bachelor’s degree in healthcare administration, compliance, public health, health information management, business administration, or related field

Master’s degree in healthcare administration, compliance, public health, health information management, business administration, or related field

Certification in healthcare privacy or compliance (e.g., CHPC, CHPS) or ability to obtain within 1 year

CIPP / CIPM / CHC certifications (preferred)

Tools

GRC tools

Policy management systems

Reporting dashboards

Job description

The Privacy Specialist supports the organization’s privacy operations by performing privacy investigations and operational activities to help ensure compliance with applicable privacy laws and regulations governing patient health information. The role works across two core areas: conducting investigations, supporting risk assessments, and maintaining accurate, defensible documentation. The Privacy Specialist also coordinates workflows, supports reporting and regulatory readiness, and contributes to policy and process updates. In this role, the individual works with internal stakeholders across Legal, Compliance, Information Security, HIM, and operational teams to support consistent and compliant privacy practices. Each Privacy Specialist is assigned a primary functional alignment (Investigations or Operations) based on organizational needs and may support cross-functional activities as required.

Essential Job Statements

Privacy Investigations

• Conduct privacy incident investigations from intake through resolution, including fact gathering, interviews, and documentation
• Perform access reviews and analyze audit logs to evaluate potential inappropriate access or disclosure
• Apply HIPAA breach risk assessment standards to determine whether an impermissible use or disclosure occurred
• Develop findings, conclusions, and recommendations, and prepare clear, defensible documentation
• Coordinate with Legal, Compliance, Information Security, HIM, and operational teams during investigations
• Ensure timely case progression and closure in alignment with established timelines and documentation standards

Privacy Operations & Regulatory Support

• Coordinate and execute privacy operations activities, including tracking initiatives, maintaining workflows, and coordinating cross-functional activities
• Support development, review, and maintenance of privacy policies, procedures, and standards
• Prepare and maintain reports, dashboards, and metrics to support leadership visibility and risk monitoring
• Contributes to regulatory readiness activities, including audits, assessments, and documentation reviews
• Participate in enterprise initiatives (e.g., research privacy, vendor data use, interoperability, AI governance), supporting coordination and follow-up actions
• Identify and elevate operational gaps, risks, and opportunities for process improvement

Risk Assessment & Compliance Activities

• Conduct privacy and compliance risk assessments in collaboration with business owners
• Analyze trends from investigations, audits, and reports to identify risk areas and recommend mitigation strategies
• Contribute to policy updates and operational changes based on regulatory requirements and identified gaps
• Maintain accurate and complete documentation to support audit and regulatory review

Cross-Functional Collaboration

• Partner with stakeholders across Legal, Compliance, ISRM, HIM, IT/Epic, and operational teams
• Support training, education, and awareness activities based on identified risks and trends
• Serve as a resource for privacy-related inquiries within assigned functional areas

Continuous Improvement

• Identify opportunities to improve investigation workflows, reporting processes, and documentation standards
• Contribute to development of standardized templates, tools, and tracking mechanisms to improve consistency and efficiency
• Contribute to strengthening privacy operations and investigation practices across the organization

Patient Population: N/A

Employment Qualifications Required

Required Education: Bachelor’s degree in healthcare administration, compliance, public health, health information management, business administration, or a related field.

Preferred Education: Master’s degree in healthcare administration, compliance, public health, health information management, business administration, or a related field.

Licensing/ Certification Required: Certification in healthcare privacy or compliance (e.g., CHPC, CHPS) or ability to obtain within one year of hire.

Licensure/Certification Preferred: Additional certifications in privacy or compliance (e.g., CIPP, CIPM, CHC) are preferred. Familiarity with project coordination practices is preferred; PMP certification is not required.

Minimum Qualifications Years and Type of Required Experience: Minimum of 2 years of experience supporting healthcare privacy, compliance, health information management, or related functions within a healthcare organization or academic medical center.

Other Knowledge, Skills and Abilities Required

• Working knowledge of HIPAA Privacy Rule and familiarity with applicable healthcare privacy laws and regulations.
• Experience supporting program, project, or governance activities, including tracking workplans, milestones, and action items.
• Experience coordinating cross-functional activities in a matrixed environment under the direction of leadership.
• Ability to support development of dashboards, reports, and governance materials for leadership review.
• Strong written and verbal communication skills appropriate for professional and operational audiences.
• Ability to support initiatives, follow established processes, and elevate issues appropriately

Other Knowledge, Skills and Abilities Preferred

• Exposure to privacy governance and emerging risk areas (e.g., research privacy, vendor data use, interoperability, AI).
• Familiarity with privacy or compliance technology platforms (e.g., GRC tools, policy management systems, reporting dashboards).
• Experience supporting regulatory readiness activities, such as audits, assessments, or enterprise reporting

Working Conditions

Periods of high stress and fluctuating workloads may occur.

General office environment.

Required to car travel to off-site locations, occasionally in adverse weather conditions.

Physical Requirements

Physical Demands: N/A

Work Position: Sitting, Walking, Standing

Additional Physical Requirements/ Hazards

Physical Requirements: Manual dexterity (eye/hand coordination), Repetitive arm/hand movements, Finger Dexterity

Hazards: N/A

Compensation Range

$52,062.40 - $80,683.20 Actual salary offers will be based on several key factors to include relevant work experience, credentials, and qualifications.

EEO Employer/Disabled/Protected Veteran Who We Are Inventing better care, day by day by discovery Sound outrageous? It absolutely is. Sound impossible? That’s never stopped us before. Sound like hard work, intense research, collaboration with experts around the world, sheer brainpower meets unrelenting willpower? That’s. Exactly. Right. We’ll do whatever it takes to offer the best in care and empower the best in quality of life. And it’s an approach that works — whether it’s a patient who undergoes a new, life-saving procedure or a clinical researcher who finds promise in a new cancer treatment, exciting new medicine is happening at VCU Health.

We have it all:

• One college and four health sciences schools
• An academic medical center
• A Level I trauma center
• One of only two NCI-designated cancer centers in Virginia
• The region’s only full-service children’s hospital
• More than 800 physicians in 200 specialties
• With a community health center, dedicated research teams, facilities and valued partners in every field

Our medical teams are top notch. And we’re not too shy to boast of internationally known physicians, some recognized as the best in the country, top-ranked local specialists and all-around all-stars at every level. From our very first years to our most recent advancements, we are driven to learn more, dig deeper, teach passionately and never rest in order to be a true leader in discovering what’s possible in health and recovery. We are a comprehensive system of care and a pioneer of health. Read VCU Health Year In Review for more about our accomplishments.