Counsel, Health Data and Privacy

Overview

This role involves serving as Counsel, Health Data & Privacy within a Legal & Compliance team, focusing on HIPAA and health data privacy advisory, negotiation of data protection and healthcare-related agreements, and supporting global data protection compliance across clinical research and operational activities.

The ideal candidate will have strong experience with HIPAA and U.S. federal and state privacy laws, meaningful experience with GDPR and other international data protection frameworks, and demonstrated capability negotiating data protection and healthcare-related agreements. This position requires strategic and tactical involvement in health data governance, privacy compliance, and complex data contracting, collaborating closely with clinical, operational, procurement, and technology stakeholders.

Responsibilities

• Provide strategic and practical legal advice on global privacy and data protection laws, including GDPR, HIPAA, CCPA/CPRA, and other U.S. state and federal privacy laws.
• Advise on privacy and data protection implications of AI-enabled tools, machine learning systems, and other emerging technologies involving health and personal data.
• Conduct and draft legal risk assessments addressing automated processing, training data use, model outputs, human-in-the-loop safeguards, cross-border considerations, and evolving regulatory frameworks.
• Partner with clinical and operations teams to advise on privacy and data protection matters related to clinical research activities, including cross-border data transfers, site operations, and subject data rights.
• Draft, review, and negotiate data processing agreements, data transfer agreements, data sections of clinical trial agreements, licensing deals, and other contracts involving company, personal, or sensitive data.
• Act as a trusted legal advisor to teams across the organization to develop practical, risk-adjusted solutions that support compliance and responsible business growth.
• Draft, review, and negotiate a broad range of commercial agreements, including vendor agreements, services agreements, research collaborations, and data-driven partnerships.
• Support structuring of healthcare and data-driven initiatives to align legal risk with business objectives.
• Collaborate with operational and procurement stakeholders to facilitate efficient and compliant transactions.
• Proactively support and advise emerging business lines and new initiatives to drive business growth while mitigating risk.
• Perform other legal tasks and projects as assigned by legal leadership.

Requirements

• Juris Doctor (JD) or equivalent law degree from an accredited institution.
• 3-6+ years of legal experience, including substantive GDPR experience and direct involvement in HIPAA and U.S. privacy law.
• Licensed to practice law in at least one U.S. state and eligible for in-house corporate practice in state of residence.
• Strong working knowledge of HIPAA and U.S. health privacy laws, including advising on use and disclosure of PHI, research authorizations, and breach analysis.
• Demonstrated experience drafting and negotiating Business Associate Agreements (BAAs), Data Processing Agreements (DPAs), and data protection provisions in commercial agreements.
• Experience drafting or supporting AI and automated decision-making risk assessments, privacy impact assessments, or related governance documentation.
• Working knowledge of GDPR and international data transfer mechanisms, including controller/processor analysis and cross-border data considerations.
• Strong drafting, analytical, and negotiation skills with attention to detail.
• Business-oriented mindset balancing compliance obligations and commercial objectives.
• Ability to work collaboratively across clinical, operational, procurement, and technology teams.
• Sound judgment in escalating enterprise-level or reputational risk.
• Must be currently authorized to work in the United States without the need for sponsorship for a non-immigrant visa.

Preferred Qualifications

• Certified Information Privacy Professional (CIPP) or similar certifications preferred.

Compensation & Benefits

• Salary range: $140,000 - $170,000 USD per year (full-time).
• Paid Time Off (PTO) and company-paid holidays.
• 100% employer-paid medical, dental, and vision insurance plan options.
• Health Savings Account (HSA) and Flexible Spending Accounts (FSA).
• Bi-weekly employer contributions to HSA.
• Company-paid Short-Term Disability and Long-Term Disability insurance.
• 401(k) retirement plan with company match.

Location

• Remote position within the United States.
• Requires 100% remote work.
• Less than 10% travel, occasional planned travel may be required.

Additional Information

• Physical demands include the ability to use keyboards and other computer equipment.
• The organization is an equal opportunity employer and maintains an inclusive culture valuing diversity.
• No work visa sponsorship is available for this position.

Legal Notices

• Applicants in certain states should be aware of specific legal notices regarding background checks, drug testing, smoking policies, and lie detector tests as required by applicable state laws.