Associate General Counsel, Privacy, Product & AI

Overview

This role is responsible for day-to-day ownership of privacy and AI governance programs for a healthcare technology organization supporting family-led care at home. The position sits at the intersection of strategy and execution in a high-tempo environment where regulatory expectations can shift quickly.

This is a senior, build-and-lead role reporting to the General Counsel. You will scale the existing HIPAA Privacy program, own the AI governance program, manage key legal frameworks (including BAAs and privacy/data-use terms), and partner closely with Product, Engineering, Operations, Clinical, Security, IT, and Compliance leadership.

Responsibilities

• Own privacy program operations for both patient data and payor data, including:
  • HIPAA compliance
  • State privacy and consumer health data law compliance
  • BAA program management
  • Data mapping and ROPA
  • Privacy incident response, breach assessment, notification, and individual rights workflows
  • Program design, operation, measurement, and continuous improvement
• Own the AI governance program, including:
  • Responsible AI policy suite
  • AI inventory
  • AI use case intake and review process
  • Model risk classification
  • Ongoing monitoring and AI incident response
  • Ongoing evolution as the regulatory and deployment landscape changes
• Own the AI use case review framework, risk tiering, and SLAs for internal generative and agentic AI tools and AI-powered product features (including chart update, documentation extraction, and clinical decision support)
  • Provide final legal sign-off
  • Escalate enterprise-level risk decisions to the General Counsel
• Set regulatory change management strategy across federal and state privacy, health data, and AI law
  • Translate horizon scanning into program and product decisions
• Own the BAA program end-to-end, including:
  • Standard templates
  • Fallback positions
  • Vendor risk integration
  • Downstream subcontractor flow-downs
• Lead privacy and data-use terms in payor relationships, including:
  • Data use agreements
  • MCO and state Medicaid privacy and security requirements
  • Payor security diligence
  • Enable Legal to accelerate deals rather than act as a gate
• Serve as the senior legal partner to Product, Engineering, Operations, and Clinical teams on privacy, AI, and product-regulatory implications of new and existing features, including:
  • Patient- and caregiver-facing disclosures
  • Consumer protection and communications rules
  • Review PRDs, design documents, and model cards; participate in design reviews; influence the roadmap
• Partner with Security and IT on HIPAA Security Rule compliance and security certifications/attestations payors require (e.g., SOC 2, HITRUST)
• Lead privacy and AI incident response, including:
  • Investigation and breach analysis
  • Regulator and individual notification
  • Post-incident program remediation
• Own the privacy and AI sections of the Board package and present privacy and AI risk to the Board of Directors or its designated committee
• Manage outside privacy and AI counsel relationships, including scope, budget, and quality of work product
• Hire, develop, and lead the privacy and AI team as it grows
• Serve as the organization’s HIPAA Privacy Officer
  • Partner with General Counsel and Compliance leadership on training and awareness programs
  • Integrate privacy and AI controls into the broader compliance program

Requirements

• JD from an accredited law school
• Active bar membership in good standing in at least one U.S. jurisdiction
• 8+ years of legal experience, in-house and/or at a leading law firm, including:
  • 6+ years of substantial privacy work
  • Hands-on AI governance experience
  • In-house experience at a healthcare or healthcare technology company is strongly preferred
• Deep working command of HIPAA/HITECH, including the Privacy, Security, and Breach Notification Rules, with demonstrated experience building HIPAA Privacy programs
• Deep working command of U.S. state privacy and consumer health data laws and the emerging U.S. state AI law landscape
• Demonstrated track record at a growth-stage or similarly resource-constrained organization of building or materially rebuilding (not only operating) at least two of the following:
  • (a) a HIPAA privacy program
  • (b) an AI governance program, including responsible AI policy design, AI use case review framework, model risk classification, and AI-related product review
  • (c) end-to-end privacy incident response, including regulator-facing notification and post-incident remediation
• Experience hiring, developing, and leading lawyers or privacy professionals, or clear readiness to build and lead a team
• Strong written communication and credibility to take and defend positions with executives, the Board, regulators, and outside counsel
  • Experience advising senior executives
  • Experience presenting to a Board of Directors
• Comfort operating in a fast-growth environment with imperfect data and parallel priorities, including writing policy yourself before handing it off

Preferred Qualifications

• Experience advising on healthcare AI deployment, including FDA SaMD/CDS analysis, clinical decision support governance, patient-facing AI disclosures, and HHS Section 1557 requirements for patient care decision support tools
• Familiarity with 42 CFR Part 2, the 21st Century Cures Act information blocking rules, and state Medicaid confidentiality requirements
• Familiarity with NIST AI RMF, ISO/IEC 42001, and other AI assurance frameworks
• Prior work with state Medicaid agencies, MCOs, or other government payors on privacy or data use matters
• IAPP certifications (CIPP/US, AIGP or CIPM)
• Sense of humor and steady temperament under pressure

Compensation & Benefits

• Compensation range: $250K - $275K
• Competitive compensation packages that reflect the value of the role
• Comprehensive health coverage options, including a $0 deductible PPO and a company-funded HSA
  • Employer-paid life and disability insurance
• Paid time off, including 10 paid company holidays
• Financial savings benefits:
  • HSA contributions
  • Optional FSA and commuter benefits
  • Full coverage of all 401(k) account fees (employer match not currently offered)
• Paid parental leave

Employment is contingent upon successful completion of a background check, satisfactory references, and any required documentation.

Location

Full-Time Hybrid opportunity based in San Francisco or remote.