Systemwide Privacy Officer

UPMC; Pittsburgh (Allegheny County); On-site; USD 180,000 - 240,000; Full time

Job summary

UPMC is seeking an experienced privacy leader to guide our system-wide privacy strategy as the Systemwide Privacy Officer, overseeing governance, regulatory compliance, data use, and protection of individual rights across the enterprise.

The role requires developing, implementing and overseeing the organization’s clinical privacy program, partnering with Legal, IT, Security and HR to embed privacy by design, manage risks, and build a culture of responsible data use.

Job description

Purpose:

UPMC is looking for an experienced privacy leader to guide and advance our system-wide privacy strategy. The Systemwide Privacy Officer is responsible for the privacy program, including governance, regulatory compliance, data use, and protection of individual rights. The incumbent is responsible for developing, implementing and overseeing the organization’s clinical privacy strategy. The role ensures compliance with the Privacy laws, drives data protection governance, manages risks and builds a culture around the responsible use and protection of data. Functional areas and disciplines of responsibility include: UPMC system-wide information privacy, special projects and accountabilities requested by the CCO.

If you're looking to bring your privacy expertise, strategic thinking, and leadership to a role with system-wide impact, we encourage you to apply and help shape the future of privacy across our organization!

Responsibilities:

• Define and execute a comprehensive clinical privacy program aligned with business goals, regulatory requirements, and industry best practices.
• Provide guidance and assist in the identification, implementation and maintenance of organization information privacy policies and procedures in coordination with organization management to comply with the Health Insurance Accountability Act of 1996, and other federal, and state privacy laws.
• Co-chair or participate in, providing leadership on privacy, regulatory, and responsible-data-use matters.
• Lead privacy risk assessments. Oversee initial and periodic information privacy risk assessments and assist in compliance monitoring activities in coordination with the entity's other compliance functions.
• Work with the Office of Ethics and Compliance, and legal counsel to ensure the organization has and maintains appropriate privacy and confidentiality consent, authorization forms, and information notices and materials reflecting current organization and legal practices and requirements.
• Develop and deliver privacy training and awareness programs in support of UPMC’s clinical operation. Oversee and ensure delivery of initial and privacy training and orientation to all employees, volunteers, medical and professional staff, contractors, alliances, business associates, and other appropriate third parties.
• Participate in the development, implementation, and ongoing compliance monitoring of all trading partner and business associate agreements, to ensure all privacy concerns, requirements, and responsibilities are addressed.
• Define privacy requirements governing appropriate privacy related access to protected health information, in coordination with management, operations, Information Security, and Information Technology. Technical access controls, system administration, and security monitoring remain the responsibility of Information Security and Information Technology.
• Work cooperatively with the HIM Directors and other applicable organization units in overseeing patient rights to inspect, amend, and restrict access to protected health information when appropriate.
• Oversee the development and adherence to a process for receiving, documenting, tracking, investigating, and taking action on all complaints concerning the organization's privacy policies and procedures in coordination and collaboration with other similar functions and, when necessary, legal counsel.
• Ensure compliance with privacy practices and consistent application of sanctions for failure to comply with privacy policies for all individuals in the organization's workforce, extended workforce, and for all business associates, in cooperation with Human Resources, administration, and legal counsel as applicable.
• Initiate, facilitate, and promote activities to foster information privacy awareness within the organization and related entities.
• Serve as a liaison to the University of Pittsburgh IRB and as the privacy liaison for users of clinical and administrative systems, limited to questions involving permissible use, disclosure, individual rights, and other privacy requirements.
• Work with all organization personnel involved with any aspect of release of protected health information, to ensure full coordination and cooperations under the organization's policies and procedures and legal requirements.
• Maintain current knowledge of applicable federal and state privacy laws and accreditation standards.
• Serve as the information privacy consultant to the organization for all departments and appropriate entities.
• Partner with Security, Legal, IT and HR to embed privacy by-design into systems and processes.
• Serve as the primary point of contact for regulators, auditors, and external partners. Coordinate with UPMC staff and external agencies in any privacy-related compliance reviews or investigations.
• Work with UPMC administration to represent the organization's information privacy interests with external parties (state or local government bodies) who undertake to adopt or amend privacy legislation, regulation, or standard.
• Perform such tasks and assume such accountabilities as requested by the Chief Compliance Officer.
• Prepare status reports for the Chief Compliance Officer as requested. Attend individual and group staff meetings as requested.
• Coordinate all Privacy-related audit related activities including defining Privacy audit requirements and overseeing privacy compliance audits, in collaboration with the Vice President, Billing, Monitoring and Risk Assessment.
• Review, analyze, and negotiate privacy- on Privacy related contract terms concerning, data use, disclosure, individual rights, and regulatory obligations related to Privacy in connection with information technology purchases, service agreements, joint ventures, and new business initiatives. Information Security is responsible for cybersecurity requirements and technical security assessments.
• Address and resolve questions as they arise on a day-to-day basis in the hospital and other UPMC entities as requested, including regular and extensive telephone and face-to-face consultations which often require research and analysis under exigent circumstances.
• Develop and report enterprise privacy metrics, trends, and key risk indicators to executive leadership and the Audit and Compliance Committee of the UPMC Board of Directors.
• Participate on ERM steering committee – Integrate privacy risks into the ERM framework and reporting structure. Define privacy requirements for data inventories and data-flow mapping within the Health Services Division and collaborate with the CISO, Information Technology, Data Governance, and business owners. Technical asset inventories and system-security documentation remain the responsibility of Information Security and Information Technology.
• Collaborate with the CISO on issues related to for the HSD Division Establish privacy governance requirements for the collection, use, retention, disclosure, and destruction of data.
• Partner with Information Security, Information Technology, Records Management, Legal, and business owners on implementation of technical and operational controls.)
• Lead the privacy and regulatory components of incident response, including breach determination, notification strategy, regulatory interaction, documentation, and privacy remediation.
• Partner with the CISO and other stakeholders on technical investigation, containment, forensics, recovery, and technical root-cause analysis.
• Provide oversight of privacy risks related to AI, advanced analytics, and secondary use of data.
• Lead enterprise culture initiatives that reinforce accountability for responsible data use.