Lead Privacy Compliance Analyst

Blue Cross and Blue Shield Association•Chicago, WA

1d•$143,300 - $207,800•Hybrid

About The Position

The Lead Privacy Compliance Analyst provides thought leadership in privacy and is responsible for establishing and maintaining privacy processes, policies, standards, and procedures. The role supports privacy investigations and incident response and leads organization-wide privacy training and awareness efforts. It also assists with governance, risk, and compliance processes, including IT control management and compliance, policy management, third-party risk management, SOC 2 attestation, NIST Cybersecurity and HITRUST framework alignment, security awareness, risk assessment methodology and execution, and data loss prevention. The position develops and maintains privacy governance and compliance controls to minimize organizational risk and ensure compliance with HIPAA and other state and federal requirements. It establishes methods for identifying privacy control gaps through departmental and vendor reviews, compliance testing, and metrics. The role also oversees initiatives involving de-identification, masking, and encryption of PHI and PII; maintains incident response guidance and plans; reviews access to and release of sensitive information; and helps safeguard BCBSA data through manual and automated controls. The analyst collaborates with BCBS organizations to share practices and supports privacy and information security programming at Blue National Summits. The role helps assess third-party vendor compliance, including reviewing questionnaires, coordinating with Legal and Procurement on disputes, ranking vendor risk, and leading or participating in on-site audits.

Requirements

Bachelor's degree in Information Technology or a related field, or equivalent work experience.
At least 7 years of experience in privacy, information security, planning, administration, audit, or resource and compliance management.
Experience supporting privacy initiatives; implementing or maintaining policies, processes, and procedures; and implementing training and awareness programs.
Experience with unified control frameworks, policy management, internal and external audit management, and data loss prevention.
Working experience managing third-party risk.
Experience working with GRC technology, such as Archer or Open Pages.
Full understanding of healthcare privacy legal and regulatory requirements, including federal and state mandates for safeguarding PHI and PII, and experience with HIPAA.
Working knowledge of integrating security compliance requirements and artifacts into project management lifecycles and the SDLC.
Knowledge and experience in project and change management.
Relationship, facilitation, presentation, and communication skills, including the ability to collaboratively plan, document, and present privacy risks and achieve buy-in from system custodians and business owners.
Certified Information Privacy Professional (CIPP) certification from IAPP.

Nice To Haves

Master's degree or MBA.
Knowledge of the BCBS system and its practices.
Knowledge of vendor management and contract administration.
AI literacy and an understanding of generative AI tools, including appropriate business applications and limitations.

Responsibilities

Develop and maintain privacy governance and compliance controls, including a formal privacy program and its processes, policies, standards, and procedures.
Ensure compliance with HIPAA and other applicable state and federal regulatory requirements.
Establish processes to identify privacy control gaps through departmental and third-party reviews and audits, regulatory compliance testing, and analysis of metrics.
Develop and maintain a formal privacy and information security training program, supplementing online training with classroom and individual training.
Use reports and metrics to demonstrate training compliance and effectiveness.
Provide direction and oversight for initiatives involving de-identification, masking, and encryption of PHI and PII.
Maintain the BCBSA System-wide Incident Response Guidance, Privacy Response Plan, and related listservs; periodically exercise the plan internally and with external stakeholders.
Oversee and periodically review access to and release of PHI and PII.
Collaborate with BCBS organizations to share best practices and lead or assist with establishing the Privacy and Information Security track for Blue National Summits.
Help ensure third-party vendor compliance by reviewing questionnaires, engaging Legal and Procurement on disputes, ranking vendor risk, and leading or participating in on-site vendor audits.
Help maintain a framework of controls that safeguards sensitive BCBSA data and oversee compliance through manual and automated processes and reporting metrics.
Assist with governance, risk, and compliance processes, including IT control management and compliance, policy management, third-party risk management, SOC 2 attestation, NIST Cybersecurity and HITRUST alignment, security awareness, risk assessment, and data loss prevention.