Privacy Program Specialist, Consultant

Blue Shield of California•Oakland, CA

2d•Hybrid

About The Position

The Privacy Program Specialist, Consultant supports the Privacy Office in advancing and enforcing Blue Shield’s Privacy Program. The program oversees compliance by Blue Shield and its affiliated covered entities, including Blue Shield of California Promise Health Plan, with state and federal privacy laws and regulations such as HIPAA, HITECH, and California’s CMIA. This position reports to the Privacy Office Manager or Director and primarily handles privacy inquiries, including individual rights requests, privacy complaints, and requests for privacy guidance. The specialist manages assigned cases from regulatory analysis through follow-up and documentation; identifies matters for escalation; and may direct business units in root-cause analysis and mitigation or remediation. The role also advises internal clients on PHI disclosures and proposed projects involving PHI, supports privacy education and policy development, monitors program compliance, and conducts privacy assessments. As business needs arise, the specialist may assist with Business Associate Agreements, lead investigations, and liaise with regulatory enforcement agencies on reviews, audits, and related matters.

Requirements

Bachelor’s degree, or a high school diploma/GED and four years of additional relevant experience in lieu of a degree.
At least seven years of prior relevant experience in healthcare privacy, healthcare compliance, health information management functions related to fulfilling individual rights requests, or another related field.
Deep working knowledge and application of California state and federal privacy laws, including HIPAA/HITECH, CMIA, minor consent laws, and privacy-related consumer protection laws such as the Telephone Consumer Protection Act (TCPA).
Solid understanding of Department of Health Care Services (DHCS) and Centers for Medicare and Medicaid Services (CMS) privacy requirements.

Nice To Haves

Privacy compliance experience in a health plan, including familiarity with Privacy Impact Assessments, health information management, auditing and monitoring, investigating, managing and reporting privacy incidents, and corporate compliance training.
CIPP/US certification or HCCA CHPC certification.

Responsibilities

Support the Privacy Office’s oversight of compliance with applicable state and federal privacy laws, including HIPAA and HITECH.
Lead assigned privacy inquiries, primarily involving individual rights requests and questions, privacy complaints, and requests for privacy guidance.
Manage assigned cases, including regulatory analysis, prompt follow-up, and timely, accurate case-file documentation.
Identify matters requiring escalation and, when appropriate, direct business units in root-cause analysis and mitigation and remediation efforts.
Evaluate ad hoc internal requests to disclose protected health information (PHI) to third parties or allow third parties to access or use Blue Shield PHI, and determine whether the requests are appropriate.
Advise internal clients as a subject matter expert about proposed projects and enterprise-wide initiatives involving access to, use of, or disclosure of Blue Shield PHI.
Develop and help implement workforce privacy trainings, privacy policies, desk-level procedures, resource guides, job aids, and other educational tools.
Audit and monitor Privacy Program compliance; develop and implement corrective action plans (CAPs) for the Privacy Office; advise on privacy-related components of CAPs issued by other business units; and conduct Privacy Impact Assessments and Data Protection Impact Assessments.
When internal business needs arise, assist with negotiating Business Associate Agreements, lead privacy investigations, and liaise with regulatory enforcement agencies regarding technical assistance letters, investigation compliance reviews, audits, and other related reviews.
Perform other duties as assigned.