Senior Privacy Counsel

Tempus AI•Chicago, IL

21h•Onsite

About The Position

Tempus is seeking a Senior Privacy Counsel to manage privacy risks and drive regulatory compliance across its healthcare, clinical, and AI platform operations. This role involves serving as a lead HIPAA advisor, partnering with Information Security, Compliance, and Product teams to maintain robust data protection standards while advancing real-world data innovation. The Senior Privacy Counsel will be a key contributor to Tempus’ health data privacy function, reporting directly to the Chief Privacy Officer, and advising on privacy risk management and regulatory compliance initiatives. The position emphasizes HIPAA Risk Analysis, Risk Management, and Breach Notification frameworks, requiring collaboration with various teams to evaluate privacy risks across clinical laboratories, diagnostic tools, and AI products.

Requirements

Juris Doctor (J.D.) degree from an accredited U.S. law school.
Active license to practice law in at least one U.S. state (and eligible for Illinois In-House Counsel registration).
At least 5 years of legal experience with a core concentration in healthcare data privacy.
Significant hands-on experience with HIPAA compliance within a health system, life sciences company, health tech firm, or top-tier law firm practice group.
In-house experience is strongly preferred.
Practical experience contributing to HIPAA Security Rule Risk Analyses, risk mitigation plans, and OCR compliance frameworks.
Ability to collaborate effectively with Chief Information Security Officers (CISOs), IT security engineers, and data architects to translate technical risk assessments into pragmatic legal strategies.
Familiarity with assisting in four-factor risk evaluations under the HIPAA Breach Notification Rule and contributing to incident response workflows.

Nice To Haves

Familiarity with U.S. consumer privacy frameworks and state-specific health privacy laws (e.g., CCPA/CPRA, Washington My Health My Data Act, and state omnibus privacy legislation).
Working knowledge of international privacy regulations, particularly the EU/UK General Data Protection Regulation (GDPR), including processing special category health/genomic data, consent standards, and international cross-border data transfer mechanisms (Standard Contractual Clauses, Data Privacy Framework).
Certified Information Privacy Professional / US (CIPP/US), CIPP/E, or Certified Information Privacy Manager (CIPM) from the IAPP.
Familiarity with NIST Cybersecurity Framework (CSF) or ISO 27001 mappings to HIPAA Security Rule requirements.
Experience evaluating privacy risks associated with genomic data, CLIA/CAP accredited laboratory workflows, or AI/ML model training on health data.

Responsibilities

Serve as a key legal partner in the review and execution of organization-wide HIPAA Security Rule Risk Analyses.
Contribute to evaluating potential vulnerabilities to the confidentiality, integrity, and availability of Electronic Protected Health Information (ePHI) across cloud platforms, laboratory systems, and software tools.
Partner with Information Security and Compliance teams to track, remediate, and manage compliance risks arising from internal reviews, external audits, and third-party assessments.
Provide sound legal guidance on daily HIPAA/HITECH matters, supporting Privacy Rule compliance, Security Rule safeguards, and Breach Notification Rule protocols across various business units.
Partner with product and data engineering teams to advise on de-identification standards (Expert Determination and Safe Harbor) under HIPAA to facilitate secondary research, machine learning model training, and data licensing.
Draft, review, and negotiate complex Business Associate Agreements (BAAs).
Perform pre-vendor privacy risk evaluations and help establish legally sound data-handling boundaries for third-party service providers.
Assist in updating HIPAA policies, procedure manuals, and employee training modules to reflect regulatory changes and evolving risk analysis outcomes.
Assist with the legal analysis of potential security incidents or privacy events.
Assist and advise on privacy-related matters impacting litigation.