Sr. Counsel

Overview

A healthcare organization is seeking a Senior Counsel (Privacy & Data) to serve as the Privacy Officer and a key member of the Healthcare and Operations legal team. This role is responsible for the strategic development, implementation, and maintenance of the enterprise privacy program and plays a key role in the enterprise security program. The position ensures compliance with federal and state privacy and security laws, manages privacy risks, and promotes a culture of privacy and security awareness across owned, affiliated, and managed practices. The role also supports data initiatives including pharmaceutical real-world evidence (RWE) studies and related technology projects.

Responsibilities

• Develop, implement, and maintain comprehensive privacy policies and procedures.
• Oversee compliance with HIPAA, HITECH, and other applicable privacy laws and regulations across the organization and its subsidiaries and affiliates.
• Manage responses to platform privacy and security incidents and breaches, including investigation, mitigation, and notification.
• Serve as the primary point of contact for privacy-related inquiries and complaints from patients, employees, practices, and regulatory bodies.
• Collaborate with Compliance, Information Security, Product/Engineering, and other teams to ensure aligned and integrated privacy practices and product design.
• Partner in the development and maintenance of security compliance programs, policies, and procedures.
• Monitor legal and regulatory developments and industry best practices to update privacy and security programs proactively.
• Maintain documentation of privacy and security practices and decisions.
• Coordinate and support privacy audits, regulatory inquiries, and investigations.
• Identify, document, and mitigate privacy risks across business units.
• Maintain incident response protocols and coordinate breach investigations and notifications with Information Security.
• Partner with compliance on privacy training and awareness programs for employees and stakeholders.
• Promote a privacy-aware culture throughout the organization.
• Oversee data subject rights processes, including responding to access requests (DSARs) and other rights under privacy laws.
• Manage privacy aspects of vendor approval processes to ensure data protection and compliance.
• Review, draft, and negotiate pharmaceutical RWE and data-related agreements addressing technology, privacy, security, and other legal needs.
• Provide rapid, practical, business-oriented legal and commercial advice to stakeholders responsible for pharma data/RWE business lines.
• Lead the establishment and deployment of Artificial Intelligence (AI) compliance policies and procedures, including processes for safe and responsible AI use.
• Assist legal leadership with higher-level matters as needed.
• Perform additional responsibilities to support the mission of improving patient outcomes.

Requirements

• Juris Doctorate from an accredited law school.
• Membership in a state or DC bar.
• 7-10+ years of relevant privacy and legal experience in a law firm or corporate legal department.
• Minimum of 3 years in a senior legal role preferred.

Preferred Qualifications

• Certified Healthcare Privacy Compliance (CHPC) or equivalent certification.

Essential Competencies

• In-depth knowledge of U.S. privacy and security laws and regulations, including healthcare privacy and security programs.
• Familiarity with certified Electronic Health Record (EHR) regulations, healthcare anti-kickback, self-referral, fraud and abuse laws, and HIPAA.
• Proven success working in fast-paced, high-performing, results-driven environments.
• Ability to draft and close commercial agreements with minimal senior support.
• Strong decision-making skills and ability to communicate legal issues and solutions clearly and concisely.
• Self-starter capable of working efficiently with minimal supervision.
• Ability to manage and close complex projects.
• Proficiency with Microsoft Office Suite, compliance/legal tracking, and research systems (e.g., Ethico, HealthStream).
• Attendance is an essential job function.

Location

Not specified.

Compensation & Benefits

Not specified.