Privacy Consultant Lead

Sutter Health•Sacramento, CA

6d•$142,106 - $213,158•Onsite

About The Position

Supports and advances the Sutter Health privacy program by performing mid to advanced level privacy operations across assigned entities. Assists with program development, conducting investigations, managing auditing and monitoring activities, and supporting implementation of policies, training, and risk mitigation strategies. Ensures compliance with federal and state regulations governing the confidentiality, access, use, and disclosure of protected health information (PHI) and other sensitive data. May serve as a subject matter resource to entity leadership, workforce members, and project teams and may participate in committees and cross-functional initiatives.

Requirements

Equivalent experience will be accepted in lieu of the required degree or diploma
Bachelor’s degree in healthcare, information technology, business, compliance, or a related field.
CHPC – Certified in Healthcare Privacy Compliance required within one year of hire.
8 years recent relevant experience
Experience must include privacy operations, compliance, healthcare workflows, and investigation responsibilities.
In‑depth working knowledge of HIPAA privacy regulations and applicable state/federal laws governing PHI.
Working knowledge of healthcare operations, including clinical workflows, revenue cycle, billing/coding, and healthcare compliance requirements.
Ability to analyze problems from legal, clinical, operational, and human‑resource perspectives.
Understanding of strategies for protecting electronic health records, data integrations, and clinical system workflows.
Strong project management skills to support planning, execution, and monitoring of privacy initiatives.
Demonstrated ability to operate effectively in a dynamic, multi‑facility healthcare environment.
Strong communication and presentation skills with ability to interact with staff, leaders, clinicians, and physicians.
Ability to influence others and support compliance without direct authority.
Proficiency with personal computing tools (presentations, spreadsheets, documents).
Ability to interpret, analyze, and present complex data in meaningful ways for varied audiences.
Demonstrated teamwork, leadership, and mentoring capabilities.
Strong organizational skills with the ability to build consensus and support change initiatives.

Responsibilities

Supports and advances a comprehensive privacy compliance program consistent with the seven elements of an effective compliance program.
Assists in developing and maintaining privacy policies in alignment with federal and state laws.
Ensures operational processes support patient rights (notice of privacy practices, access, amendment requests, accounting of disclosures, restrictions).
Coordinates business associate agreement (BAA) documentation and tracking in the contract database.
Maintains required documentation of privacy program elements in accordance with retention requirements.
Provides consultation to management and workforce members on privacy questions and requirements.
Participates in entity or regional compliance committees through routine presentations regarding privacy‑related activities, metrics, and risks. Includes the creation of presentation materials.
Provides highly independent “out of office” coverage for entity privacy officer.
Actively leads and drives the outcomes of formally established workgroups, initiatives, or projects.
Develops and delivers training on privacy policies and procedures for new hires and ongoing workforce education.
Contributes to annual or ad‑hoc updates to privacy training content and awareness campaigns.
Ensures compliant documentation of all completed training.
Ensures workforce members meet confidentiality acknowledgement requirements.
Independently conducts and documents privacy investigations, including root‑cause analysis and remediation recommendations.
Ensures timely reporting of incidents to patients and government agencies as required by state and federal regulations.
Supports consistent sanction processes for violations in partnership with human resources.
Independently supports responses to inquiries from regulators and compliance review activities.
Participates in training and execution of the privacy incident response plan.
Conducts privacy risk assessments utilizing standardized methodologies.
Performs routine auditing and monitoring of systems containing PHI to identify inappropriate access or risk patterns.
Develops corrective action plans and monitors completion of mitigation activities.
Identifies workflow and process improvement opportunities and collaborates with stakeholders to implement changes.
Maintains awareness of regulatory updates, industry standards, and monitoring priorities impacting privacy.
Performs and documents privacy impact assessments for systems, vendors, and new initiatives.
Maintains accurate records of privacy review activities within the governance, risk, and compliance (GRC) platform.
Assists with developing and maintaining privacy risk inventories, controls, and remediation tracking.
Contributes to privacy metrics, dashboards, and scorecards to support leadership decision‑making.
Upholds confidentiality of privacy‑related data and supports secure handling of sensitive information.
Participates in developing or revising system policies, standardized processes, training programs, and risk mitigation strategies.
Contributes to building and enhancing methodologies for risk quantification, auditing, monitoring, and reporting.