Privacy Specialist

TX-HHSC-DSHS-DFPS•Austin, TX

7d•$5,250 - $6,250•Hybrid

About The Position

The Privacy Specialist (Program Specialist Vl) reports to the HHSC Privacy Director and performs moderately advanced consultative services and technical assistance work for internal and external agency partners during the course of privacy investigations. Work involves leading or participating in investigations of actual or suspected privacy incidents; collecting and validating data for tracking incident trends and identifying opportunities and solutions for risk management and mitigation; researching privacy practices and responses to emerging trends privacy-related issues and problems; providing coordinated responses to regulatory investigations, inquiries, and audits; developing reports and visualizations for leadership; preparing privacy-related trainings and educational materials; and assisting with the development, maintenance, and review of privacy-related manuals, policies, and procedures. This position works under minimal supervision, with considerable latitude for the use of initiative and independent judgment.

Requirements

Knowledge of HHSC divisions, business, and program areas.
Knowledge of Medicaid, CHIP, SNAP, and TANF.
Knowledge of Federal and state privacy laws, regulations, and rules (e.g., HIPAA; Texas Identity Theft Enforcement and Protection Act), including applicable reporting and breach notification requirements and timelines.
Knowledge of Personally Identifiable Information (PII), Protected Health Information (PHI), Sensitive Personal Information (SPI), and other confidential or sensitive information types.
Knowledge of Privacy incident and breach investigation principles, including incident identification, assessment, documentation, mitigation, and resolution.
Knowledge of Root cause analysis and corrective action principles.
Skill in investigating privacy incidents and gathering, reviewing, and evaluating relevant facts and evidence.
Skill in analyzing complex or incomplete information and identifying privacy risks, compliance concerns, and additional information needed to complete an investigation.
Skill in preparing professional written communications, investigative summaries, reports, and recommendations.
Skill in managing multiple investigations and assignments simultaneously while meeting regulatory and organizational deadlines.
Skill in reviewing and organizing supporting documentation such as emails, policies, procedures, system records, and contractual requirements.
Skill in maintaining effective working relationships.
Ability to independently plan, conduct, and document incident investigations from initial report through resolution.
Ability to exercise sound judgment when facts are incomplete, conflicting, or evolving.
Ability to identify gaps or inconsistencies in available information and pursue appropriate follow-up.
Ability to handle confidential and sensitive information with discretion and care.
Ability to organize complex facts and develop clear, logical, and well-supported conclusions.
Ability to recognize matters that require escalation to management or other agency partners.
Ability to prioritize assignments based on risk, regulatory requirements, and established deadlines.
Ability to adapt to changing facts, priorities, regulatory requirements, and organizational needs.
Experience performing professional work involving investigation, analysis, compliance, auditing, risk assessment, case review, regulatory review, quality assurance, program policy, legal or policy research, or other work requiring the evaluation of facts, application of standards or requirements, professional judgment, and written documentation of findings, conclusions, or recommendations is required.

Nice To Haves

Certified Information Privacy Professional (CIPP/US), Certified Information Privacy Manager (CIPM), or equivalent certification is preferred.
Bachelor's degree in a relevant field is preferred.

Responsibilities

Leads or participates in privacy incident response activities, including triage and investigation, regulatory research, third party contractual obligations, risk assessment, breach determination, remediation, notification, prevention, and analysis.
Coordinates with internal and external agency partners to investigate incidents, document investigation findings, and share recommendations.
Maintains privacy-related compliance records for federal audits and compiles relevant information for required reporting to federal officials.
Validates data and prepares briefing materials for leadership.
Provides technical assistance to other program areas to facilitate the implementation of policy or program changes that may be impacted by privacy issues.
Plans and conducts detailed, complex research and analyses of privacy complaints, including analysis of compliance with rules, policies, laws, regulations, operational procedures, and policies.
Collects, validates, and documents findings, reports, and other information to identify operational trends and potentially emerging operational issues related to privacy and privacy-related issues.
Reports relevant changes and their implications to division leadership.
Reports privacy breaches to the federal government, as required.
Utilizes Archer eGRC and data visualization software to develop reports for leadership.
Assists with the development, maintenance, and review of privacy-related manuals, policies, and procedures.
Serves as Archer eGRC backup for application development, testing, and production.
Researches and monitors current and emerging regulatory requirements related to privacy, including potential implications of statutory or policy changes.
Researches and monitors industry best practices in order to make recommendations for the development and improvement of privacy-related processes and activities.