Director, Privacy Officer

Blue Cross & Blue Shield of Rhode Island•Providence, RI

1d•$133,300 - $213,300

About The Position

Provide enterprise leadership and oversight for BCBSRI’s privacy program. Serve as Privacy Officer and advisor on privacy risk, regulatory obligations, and emerging issues. Direct privacy governance, policies, controls, investigations, training, monitoring, and remediation to protect confidential information and ensure compliance with corporate, federal, and state privacy requirements. The role leads the development and ongoing governance of the enterprise privacy program, including policies, procedures, and controls governing access to, use of, disclosure of, and accounting for protected health information. It directs investigations and risk-based monitoring, oversees remediation, advises organizational leaders, and sets privacy training and education strategy. The Director also leads, coaches, and develops privacy staff and cross-functional partners.

Requirements

Bachelor’s degree in Business Administration, Health Care Administration, Compliance, Law, or a related field, or an equivalent combination of education and relevant leadership experience.
Knowledge of state and federal confidentiality, privacy, and security laws and regulations, including HIPAA and the Rhode Island Confidentiality of Health Care Communications and Information Act.
Knowledge of compliance and ethics principles.
Ability to interpret and understand federal and state health insurance regulations.
Ability to perform root cause analysis.
Ability to create and monitor corrective action plans.
Ability to develop and execute enterprise privacy strategy and translate regulatory requirements into business priorities, governance, controls, and measurable outcomes.
Ability to assess enterprise privacy risk, analyze trends and root causes, define meaningful metrics, and present clear recommendations to senior leadership.
Strong written and verbal communication skills, including the ability to communicate complex privacy matters to executive, board, regulatory, and operational audiences.
Ability to lead cross-functional teams and establish effective partnerships with Legal, Compliance, Information Security, Human Resources, Operations, and business leadership.
Strong organizing skills, with the ability to prioritize and respond to shifting deadlines.
Ability to manage competing enterprise priorities, drive timely decisions, and sustain accountability.
Seven or more years of progressive experience in health care privacy, regulatory compliance, or a related field, including five or more years leading teams, programs, or complex enterprise initiatives.

Nice To Haves

Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM), or comparable privacy certification.

Responsibilities

Serve as Privacy Officer and enterprise subject matter expert on privacy, advising on obligations, regulatory developments, material risks, and recommended actions.
Direct development, implementation, and ongoing governance of the enterprise privacy program, including policies, procedures, and controls for protected health information.
Ensure privacy strategy and program priorities align with enterprise objectives and applicable corporate, federal, and state requirements.
Direct investigations of suspected privacy violations, complaints, and incidents; determine escalation and remediation requirements and coordinate with relevant functions and business leadership.
Ensure timely mitigation, documentation, trend analysis, and reporting of material privacy matters.
Oversee a risk-based privacy monitoring and audit program; evaluate findings, require corrective action plans, monitor remediation, and escalate significant or recurring risks.
Provide guidance on privacy matters and maintain consistent application of privacy requirements across the organization.
Set enterprise strategy for privacy training, awareness, and education; oversee program development and delivery, evaluate effectiveness, and ensure timely communication of regulatory and policy changes.
Lead, coach, and develop privacy staff and cross-functional partners.
Perform other duties as assigned.