Privacy Program Specialist, Principal - Stellarus

Stellarus•Oakland, CA

2d•$155,248 - $232,996•Hybrid

About The Position

The Privacy Program Specialist, Principal works in Stellarus’s Privacy Office, which is part of the legal organization and oversees the company’s privacy program. The role helps shape and strengthen the program by translating privacy requirements into practical guidance and processes, partnering across the organization to identify and manage risks, embedding privacy considerations into business initiatives, and supporting responsible use of data. The position reports to the Chief Compliance & Privacy Officer of Stellarus. The role supports privacy governance, compliance oversight, risk management, stakeholder engagement, and day-to-day privacy operations. It oversees compliance with federal and state privacy laws, including HIPAA and HITECH, and supports protection of members’ protected health information. It also develops privacy policies, guidance, governance and accountability documents, communications, and educational tools. The position handles complex privacy complaints, incidents, investigations, and inquiries; reviews vendor, subcontractor, business partner, and data-sharing arrangements; monitors legal and industry developments; and supports privacy compliance monitoring, risk assessments, audits, regulatory inquiries, corrective actions, documentation, metrics, and tracking. It partners with Information Security, Compliance, Legal, and other stakeholders to address privacy and data protection risks and promote a culture of privacy and compliance.

Requirements

Bachelor’s degree, or a high school diploma/GED plus four years of additional relevant experience in lieu of a degree.
Ten years of prior relevant experience.
Extensive experience in healthcare, legal services, privacy, audit, or investigative services.
Mastery-level knowledge and understanding of state and federal privacy laws, including HIPAA/HITECH, CMIA, and privacy-related consumer protection laws such as TCPA.

Nice To Haves

Privacy certification such as CHPC, CIPP/US, or similar credentials.
Experience working in a healthcare technology environment.
Experience with privacy-by-design, product privacy, data governance, or privacy technology.

Responsibilities

Serve as an operational partner to the Chief Privacy Officer in administering and continuously improving the privacy program, including governance, compliance oversight, risk management, stakeholder engagement, and day-to-day operations.
Oversee compliance with federal and state privacy laws, including HIPAA and HITECH privacy requirements.
Implement, interpret, operationalize, support, and enforce the Privacy Program; assist with updates and revisions to maintain compliance with applicable laws and promote best practices for protecting members’ PHI.
Lead development and implementation of privacy policies, advisory guides, governance and accountability documents, communications, and educational tools.
Respond to complex privacy complaints and incidents; lead escalated investigations, document case files, direct root-cause analysis, address mitigation, and work with business units on corrective actions and remediation.
Respond to escalated and complex privacy-related inquiries.
Conduct privacy reviews of vendors, subcontractors, business partners, and data-sharing arrangements, including HIPAA Business Associate Agreements and other contractual privacy requirements, in partnership with Legal and business stakeholders.
Monitor developments in privacy laws, regulations, and industry practices and coordinate required program updates and process improvements.
Conduct and support privacy compliance monitoring, risk assessments, audits and audit responses, regulatory inquiries, corrective action plans, and maintenance of program documentation, reporting metrics, tracking systems, and compliance evidence.
Partner with Information Security, Compliance, Legal, and other stakeholders to address privacy and data protection risks, support enterprise compliance initiatives, and promote privacy and compliance across the organization.