Principal Privacy Biostatistician - Risk Analytics

Truveta•Seattle, WA

About The Position

The Principal Privacy Biostatistician is the senior technical authority for statistical disclosure control across Truveta’s data platform and reports to the Senior Director of Risk Analytics. The role owns the platform-wide de-identification methodology framework, sets the standards used by the Risk Analytics team, and signs HIPAA Expert Determinations for the most complex, novel, and high-visibility data products. The position also serves as final reviewer and co-signer for determinations prepared by other team members. The successful candidate brings established experience exercising and defending Expert Determination signing authority. They will shape the organization’s approach to privacy risk across structured data, imaging, clinical notes, and emerging modalities such as genomic and AI/ML-derived data. The role partners across clinical informatics, Legal, Product, security, and engineering; represents Truveta’s privacy statistics expertise to external stakeholders; and develops colleagues toward independent signing authority. The position is based at Truveta’s headquarters in the Greater Seattle area; the posting also includes the designation “#LI-remote.” The base pay range is $160,000 to $180,000, with pay dependent on factors including location, job-related knowledge, skills, and experience. Certain roles may be eligible for incentive pay and stock options. Applicants must be authorized to work in the United States; visa or permit sponsorship is not available.

Requirements

PhD in biostatistics, statistics, epidemiology, or a related quantitative field, or a Master’s degree with equivalent depth of experience and demonstrated technical leadership.
At least 10 years of experience applying statistical methods to patient health information, including extensive hands-on statistical disclosure control and de-identification experience.
Prior formal experience signing HIPAA Expert Determinations, internally or as an external consultant or expert witness, with a documented case history across multiple data modalities.
Demonstrated experience defining and implementing de-identification methodology at an organizational or platform level, rather than only for individual datasets.
Deep experience with multiple non-structured data modalities, such as imaging and/or clinical notes, in addition to structured EHR or claims data, including risk across linked modalities.
Expert ability to reason across the HIPAA Privacy Rule and Security Rule boundary when estimating risk.
Exceptional written and verbal communication skills, including preparing audit-ready documentation and explaining complex risk concepts to executives, partners, and regulators.
Experience analyzing Real World Data in a research setting.
Demonstrated success mentoring senior technical staff and developing others toward independent signing authority.
Must be authorized to work in the United States; the company is unable to sponsor work visas or permits.

Nice To Haves

Experience defending Expert Determinations in regulatory, audit, litigation, or expert-witness settings.
Experience designing and governing process Expert Determinations at scale.
Advanced hands-on experience with statistical disclosure control tools such as sdcMicro and dynamic or continuously revalidated risk methodologies.
Working familiarity with clinical informatics standards such as HL7, FHIR, and DICOM PS3.15 Annex E.
Hands-on experience with genomic data privacy, such as VCF-level re-identification risk and familial risk.
Peer-reviewed publications, conference presentations, or contributions to industry standards in privacy, disclosure control, or health data.
Experience building or leading a privacy statistics or risk analytics function.

Responsibilities

Set the vision and own the end-to-end statistical disclosure control framework, including methodological standards, risk thresholds, and documentation requirements.
Sign Expert Determinations for the most complex, novel, and high-visibility data products, applying accepted statistical and scientific principles and documenting the basis for finding re-identification risk to be very small.
Serve as final technical reviewer and co-signer for determinations prepared by Senior and staff Privacy Biostatisticians; establish and run peer review and case-defense processes.
Develop risk methodology for emerging data modalities, including genomic, linked multi-modality, and AI/ML-derived data, in partnership with clinical informatics, Legal, and Product.
Own and evolve profile-level risk justification methods, including dynamic k-anonymity thresholds, quasi-identifier importance ranking, suppression hierarchies, drift-triggered re-determination thresholds, and process-level Expert Determinations.
Integrate HIPAA Security Rule considerations into Privacy Rule risk determinations and partner with security and engineering leadership on infrastructure, architecture, and regulatory change strategy.
Partner with Legal and Contracts to define standards for supplementary recipient-side controls on higher-residual-risk modalities, while maintaining the statistical basis for the very-small-risk determination.
Represent Truveta as a privacy statistics subject-matter expert to health system members, customers, auditors, and regulators; contribute to publications, conference presentations, and industry standards.
Mentor and develop Senior and staff Privacy Biostatisticians and build a documented pathway toward independent signing authority.
Influence product and data strategy by identifying ways to improve data utility and usability while managing residual risk and mitigating controls.