Associate General Counsel – Privacy

Aeroflow Health•Asheville, NC

About The Position

The Associate General Counsel – Privacy is Aeroflow Health’s principal legal architect for the strategy, governance, and management of the enterprise privacy program. Reporting directly to the General Counsel, this leader evaluates privacy and data protection requirements, advises executive and business leaders, and translates regulatory obligations into an effective program across business units and applicable subsidiaries. The role serves as the designated HIPAA Privacy Officer for entities identified by the Company and directs the personnel and resources supporting the program. The position sets program priorities, decision and escalation standards, and oversees implementation. Designated privacy or operational personnel handle routine privacy complaint intake and patient communications; significant or complex matters are escalated to this attorney for legal evaluation and direction. The role establishes enterprise privacy strategy and governance, evaluates regulatory developments, advises on complex privacy risks, and sets requirements for strategic initiatives, acquisitions, new markets, products, technology, vendors, and data sharing. It oversees privacy risk assessments, significant incident and breach evaluations, regulatory responses, patient rights and complaint processes, personnel, and program reporting. The Associate General Counsel partners with the General Counsel, executive leadership, Audit and Compliance, Security, IT, and business owners to implement and assess the privacy program.

Requirements

Juris Doctor (JD) from an accredited law school.
Active bar membership in good standing in at least one U.S. jurisdiction and eligibility to practice as in-house counsel in the applicable jurisdiction.
At least eight years of relevant legal experience, including substantial healthcare privacy counseling and demonstrated leadership of a privacy program or significant privacy initiatives.
Deep knowledge of HIPAA and applicable federal and state privacy requirements, with the ability to assess regulatory applicability and translate complex requirements into business decisions and program strategy.
Experience directing privacy risk assessments, incident evaluation, regulatory responses, vendor negotiations, and implementation of privacy controls.
Strong executive judgment, communication, and management skills, including the ability to influence leaders, develop staff, prioritize resources, and oversee work across multiple business functions.

Nice To Haves

Experience with DME, telehealth, digital health, multistate healthcare operations, acquisitions, or enterprise privacy program development.
Experience evaluating AI, tracking technologies, consumer health data, and complex data sharing arrangements.
CHPC, CIPP/US, or CIPM certification.

Responsibilities

Establish and execute a multiyear privacy strategy, annual work plan, and governance framework aligned with the company’s risk profile, growth plans, and business objectives.
Direct privacy program operations, personnel, and external resources, and recommend staffing, budget, technology, and other investments to the General Counsel.
Set enterprise privacy policies, accountability standards, and performance measures; oversee implementation, training, monitoring, and corrective action through designated staff and business owners.
Lead privacy risk assessments and prioritize remediation across business units, subsidiaries, acquisitions, and new services; report material risks and resource needs to leadership.
Interpret HIPAA, HITECH, applicable state privacy and consumer health data laws, and other relevant requirements, determining their applicability to entities, services, data flows, and proposed activities.
Evaluate legislative, regulatory, enforcement, and litigation developments; assess business impact and direct appropriate changes to policies, systems, contracts, and operating practices.
Advise the General Counsel, executive leadership, and business leaders on complex privacy issues, regulatory exposure, and risk mitigation options.
Establish privacy requirements for strategic initiatives, acquisitions, new markets, and products, and communicate recommendations and unresolved risks to decision makers.
Set privacy review standards for AI, tracking technologies, marketing, analytics, patient portals, vendors, and data sharing; legally evaluate significant or novel uses before implementation.
Advise on consent, authorizations, de-identification, permitted data uses, retention, and secondary use; partner with IT, Security, and data leaders to embed requirements into systems and workflows.
Lead negotiation of material privacy and data protection terms, including business associate agreements, and establish standards for vendor privacy diligence and contracting.
Direct legal evaluation of significant privacy incidents, breach risk assessments, and notification obligations; oversee investigation strategy, mitigation, and remediation with the General Counsel and incident response leaders.
Establish escalation criteria for complaints and incidents; advise on complex or systemic matters referred by designated privacy contacts and evaluate trends for enterprise risk.
Oversee the accuracy and timeliness of required notices and regulatory responses; manage privacy regulatory inquiries and coordinate outside counsel under the General Counsel’s direction.
Establish and oversee processes for patient rights requests and complaint resolution, including designated operational contacts, response standards, documentation, and escalation procedures.
Direct privacy personnel and business owners in implementing policies, training, monitoring, and remediation; evaluate effectiveness through metrics and targeted reviews.
Partner with the Head of Audit and Compliance on independent assurance and shared risks, and with the Security Officer on safeguards and security risk assessments.
Provide regular reporting to the General Counsel and executive leadership, and board or committee reporting as appropriate, on program maturity, emerging risks, incidents, and remediation.
Maintain knowledge of and comply with laws, regulations, and policies as an individual responsibility; maintain HIPAA and patient confidentiality.