Privacy Attorney

Gainwell Technologies LLC•Any city, OH

21h•$129,200 - $184,500•Remote

About The Position

The Privacy Attorney / Privacy Officer serves as the primary customer contact for privacy on large healthcare customer accounts and is responsible for account compliance with HIPAA Privacy and Security Rules and state privacy laws. The role advises Gainwell staff and executives on applicable state and federal privacy laws and manages complex matters such as internal and external audit responses, contract analysis, and interactions with regulators. The position reports to the Corporate Privacy Officer. The role implements and oversees account-specific privacy programs, including policies and procedures, quality improvement projects, incident investigations, risk assessments, and staff training. It provides subject matter expertise on HIPAA, state and local privacy laws, and government health program requirements; advises product teams on privacy regulations and Privacy-By-Design; and reviews new technologies, analytics, and AI use cases with AI governance and information security teams. The position investigates privacy incidents, conducts impact assessments, supports compliance with reporting requirements, conducts monitoring assessments, and maintains HIPAA compliance documentation. It also supports individuals exercising privacy rights, advises on Business Associate Agreement provisions and contract requirements, and contributes to Corporate privacy initiatives. The role may require responding to privacy and security emergency incidents outside normal business hours, including nights and weekends. This is a remote opportunity.

Requirements

5–7 years of experience in healthcare privacy, including overseeing privacy, confidentiality, and release-of-information policies and developing, conducting, and reporting on privacy risk assessments.
Law degree from an ABA-accredited law school.
Licensed to practice law in at least one U.S. state.
Strong written and verbal communication skills, including the ability to explain complex legal and regulatory requirements to executives, technical teams, and clients.
Ability to manage multiple priorities in a fast-paced environment.
Possess and maintain a privacy certification from HCCA, IAPP, AHIMA, or an equivalent organization.

Nice To Haves

CIPP/US certification is preferred.
Experience in a healthcare payer or insurance setting, or in a state or federal agency, is preferred.
AI Governance experience is preferred.

Responsibilities

Serve as the primary customer point of contact for privacy on large healthcare customer accounts and oversee account compliance with HIPAA Privacy and Security Rules and state privacy laws.
Interpret and apply privacy and confidentiality requirements for government health programs, including Medicaid safeguarding requirements, substance use disorder records, federal tax information, and CMS and state agency contract requirements.
Advise staff and executives on state and federal privacy laws; manage audit responses, contract analysis, and interactions with regulators.
Advise product teams on privacy regulations and Privacy-By-Design principles.
Review new technologies, analytics, and AI use cases with AI governance and information security teams to support compliance with privacy and emerging AI laws.
Investigate and report privacy-related incidents, assess incident impact, and drive compliance with federal and state reporting requirements.
Develop and deliver privacy and security awareness training, including onboarding and annual training, and maintain training completion records.
Conduct monitoring assessments to ensure staff compliance with privacy and security policies and procedures.
Promote a culture of privacy compliance that encourages staff to report concerns and incidents.
Author and maintain HIPAA compliance documentation, including privacy policies, health information management procedures, Incident Response Plans, Privacy Impact Assessments, and related controls.
Respond outside normal business hours, including nights and weekends, to privacy and security emergency incidents that may affect company and client operations.
Assist clients with requests from individuals exercising privacy rights, including access and amendment requests and privacy complaints.
Work with the client Contracting Officer to support contract initiatives and deliverables, and provide guidance on Business Associate Agreement provisions and related privacy and security contract requirements.
Support Corporate privacy initiatives, documentation, and training as requested by the Corporate Privacy Officer.
Perform additional duties as needed to support Gainwell or client account needs.