Principal Privacy Biostatistician - Risk Analytics

Truveta•Seattle, WA

1d•$160,000 - $180,000

About The Position

Truveta is seeking a principal-level statistical privacy expert to set disclosure risk strategy across its data platform, including structured data, imaging, clinical notes, and emerging modalities such as genomic data. The role owns the platform’s statistical disclosure control and de-identification methodology framework and serves as the senior technical authority for disclosure control across Truveta. Reporting to the Senior Director of Risk Analytics, the Principal Privacy Biostatistician signs HIPAA Expert Determinations for the most complex, novel, and high-visibility data products, and provides final review and co-signature for determinations prepared by other team members. The role establishes methodological standards, risk thresholds, documentation requirements, peer review, and case-defense processes. It also develops risk methods for new data modalities, integrates HIPAA Security Rule considerations into Privacy Rule risk determinations, and advises on recipient-side controls without treating them as substitutes for a statistical finding of very small risk. The role represents Truveta’s privacy statistics expertise to health system members, customers, auditors, regulators, and the scientific community. It mentors and develops Privacy Biostatisticians toward independent signing authority and influences product and data strategy to improve data utility while managing residual risk. The position is based out of Truveta’s headquarters in the Greater Seattle area; the posting also includes the designation “#LI-remote.”

Requirements

PhD in biostatistics, statistics, epidemiology, or a related quantitative field, or a master’s degree with equivalent depth of experience and demonstrated technical leadership.
At least 10 years of experience applying statistical methods to patient health information, including extensive hands-on statistical disclosure control and de-identification experience.
Prior formal HIPAA Expert Determination signing experience, internally or as an external consultant or expert witness, with a documented case history across multiple data modalities.
A proven record of defining and implementing de-identification methodology at an organizational or platform level.
Deep experience with multiple non-structured data modalities, such as imaging and/or clinical notes, in addition to structured EHR/claims data, including risk across linked modalities.
Expert-level ability to reason across the HIPAA Privacy Rule and Security Rule boundary when estimating risk.
Exceptional written and verbal communication skills, including producing documentation that stands alone under audit and explaining complex risk concepts to executives, partners, and regulators.
Experience analyzing Real World Data in a research setting.
Demonstrated success mentoring senior technical staff and developing others toward independent signing authority.

Nice To Haves

Experience defending Expert Determinations in regulatory, audit, litigation, or expert-witness settings.
Experience designing and governing process Expert Determinations at scale.
Advanced hands-on experience with SDC tools such as sdcMicro and dynamic or continuously revalidated risk methodologies.
Working familiarity with clinical informatics standards, including HL7, FHIR, and DICOM PS3.15 Annex E.
Hands-on experience with genomic data privacy, including VCF-level re-identification risk and familial risk.
Peer-reviewed publications, conference presentations, or contributions to industry standards in privacy, disclosure control, or health data.
Experience building or leading a privacy statistics or risk analytics function.

Responsibilities

Set the vision and own the end-to-end statistical disclosure control framework, including methodological standards, risk thresholds, and documentation requirements for the Risk Analytics team.
Sign Expert Determinations for the most complex, novel, and high-visibility data products under 45 CFR §164.514(b)(1), and document the reasoning to withstand audit, regulatory review, or legal challenge.
Serve as final technical reviewer and co-signer for Expert Determinations prepared by Senior and staff Privacy Biostatisticians.
Establish and run the peer review and case-defense process governing the team’s signing authority.
Lead risk methodology development for new and emerging modalities, including genomic, linked multi-modality, and AI/ML-derived data products, in partnership with clinical informatics, Legal, and Product.
Own and evolve profile-level risk justification methodology, including dynamic k-anonymity thresholds, quasi-identifier importance ranking, suppression hierarchies, drift-triggered re-determination thresholds, and process-level Expert Determinations.
Integrate HIPAA Security Rule posture into Privacy Rule risk determinations and partner with security and engineering leadership on infrastructure, architecture, and regulatory change strategy.
Partner with Legal and Contracts to define standards for supplementary recipient-side controls on higher-residual-risk modalities, while maintaining statistical determination of very small risk as the standard.
Represent Truveta as a privacy statistics subject-matter expert to health system members, customers, auditors, and regulators; contribute to publications, conference presentations, and industry standards.
Mentor and develop Senior and staff Privacy Biostatisticians and establish a documented path toward independent signing authority.
Influence product and data strategy by identifying opportunities to improve data utility and usability while managing residual risk and mitigating controls.