Director, Privacy Officer

Blue Cross & Blue Shield of Rhode Island•Providence, RI

About The Position

Provide enterprise leadership and oversight for the organization’s privacy program. Serve as Privacy Officer and advisor on privacy risk, regulatory obligations, and emerging issues. Direct privacy governance, policies, controls, investigations, training, monitoring, and remediation to protect confidential information and ensure compliance with corporate, federal, and state privacy requirements. BCBSRI offers flexible work arrangements, including remote and hybrid opportunities, with schedules depending on the role. The organization is headquartered in downtown Providence. Remote work is permitted from specified states, subject to Human Resources approval.

Requirements

Bachelor’s degree in Business Administration, Health Care Administration, Compliance, Law, or a related field, or an equivalent combination of education and relevant leadership experience.
Knowledge of state and federal confidentiality, privacy, and security laws and regulations, including HIPAA and the Rhode Island Confidentiality of Health Care Communications and Information Act.
Knowledge of compliance and ethics principles.
Ability to interpret and understand federal and state health insurance regulations.
Ability to perform root cause analysis.
Ability to create and monitor corrective action plans.
Ability to develop and execute enterprise privacy strategy and translate regulatory requirements into business priorities, governance, controls, and measurable outcomes.
Ability to assess enterprise privacy risk, analyze trends and root causes, define meaningful metrics, and present clear recommendations to senior leadership.
Strong written and verbal communication skills, including the ability to communicate complex privacy matters to executive, board, regulatory, and operational audiences.
Ability to lead cross-functional teams and establish effective partnerships with Legal, Compliance, Information Security, Human Resources, Operations, and business leadership.
Strong organizing skills, with the ability to prioritize and respond to shifting deadlines.
Ability to manage competing enterprise priorities, drive timely decisions, and sustain accountability.
Seven or more years of progressive experience in health care privacy, regulatory compliance, or a related field, including five or more years leading teams, programs, or complex enterprise initiatives.

Nice To Haves

Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM), or comparable privacy certification.

Responsibilities

Serve as Privacy Officer and enterprise subject matter expert on privacy.
Advise on privacy obligations, regulatory developments, material risks, and recommended actions.
Direct development, implementation, and ongoing governance of the enterprise privacy program, including policies, procedures, and controls governing access to, use of, disclosure of, and accounting for PHI.
Ensure privacy strategy and program priorities align with enterprise objectives and applicable corporate, federal, and state requirements.
Direct investigations involving suspected privacy violations, complaints, and incidents.
Determine escalation and remediation requirements; coordinate with Legal, Compliance, Information Security, Human Resources, and business leadership; and ensure timely mitigation, documentation, trend analysis, and reporting of material matters.
Oversee a risk-based privacy monitoring and audit program.
Evaluate findings, require corrective action plans, monitor remediation, and escalate significant or recurring privacy risks.
Provide guidance on privacy matters and maintain consistent application of privacy requirements across the organization.
Set the enterprise strategy for privacy training, awareness, and education; oversee program development and delivery, evaluate effectiveness, and ensure timely communication of regulatory and policy changes.
Lead, coach, and develop privacy staff and cross-functional partners.
Perform other duties as assigned.