Systemwide Privacy Officer

UPMC•Pittsburgh, PA

About The Position

UPMC is seeking an experienced privacy leader to guide and advance its system-wide privacy strategy. The Systemwide Privacy Officer is responsible for the privacy program, including governance, regulatory compliance, data use, and protection of individual rights. The role develops, implements, and oversees the organization’s clinical privacy strategy, ensuring compliance with privacy laws, advancing data protection governance, managing risks, and building a culture of responsible data use. Areas of responsibility include system-wide information privacy and special projects and accountabilities requested by the Chief Compliance Officer. The officer defines and executes the clinical privacy program; advises on privacy policies and procedures; leads risk assessments, training, compliance monitoring, audits, and incident-response privacy functions; and serves as a privacy consultant and liaison to internal teams, regulators, auditors, external partners, and the University of Pittsburgh IRB. The role partners with Legal, Security, Information Technology, Human Resources, Records Management, and business owners on privacy governance, data use, privacy-by-design, and risk management. Cybersecurity architecture, engineering, operations, technical access controls, and technical security assessments are outside the role’s responsibility. The officer reports privacy metrics, trends, and key risk indicators to executive leadership and the Audit and Compliance Committee of the UPMC Board of Directors, participates in the ERM steering committee, and undertakes additional tasks and accountabilities requested by the Chief Compliance Officer.

Requirements

Bachelor’s degree in healthcare administration, privacy, compliance, law, health information management, business, or a related healthcare, privacy, or compliance field.
At least 8 years of progressively responsible experience in healthcare privacy, compliance, data governance, or a related area.
At least 5 years of management experience.
Broad-based understanding of health privacy laws, regulations, and information security concepts.
Strong communication, interpersonal, and problem-solving skills.
Ability to influence senior stakeholders and translate complex privacy concepts into business-friendly language.

Nice To Haves

Relevant graduate degree(s), such as a Juris Doctor, M.B.A., master’s, or Ph.D.
Experience with compliance and/or privacy law and related topics.
Working knowledge of information systems and cybersecurity concepts sufficient to identify privacy implications and collaborate effectively with the CISO and Information Technology.
Broad-based understanding of computers, software, and technology in a complex heterogeneous computing environment.

Responsibilities

Define and execute a comprehensive clinical privacy program aligned with business goals, regulatory requirements, and industry best practices.
Guide the identification, implementation, and maintenance of information privacy policies and procedures in coordination with organization management, consistent with HIPAA and other federal and state privacy laws.
Co-chair or participate in committees and provide leadership on privacy, regulatory, and responsible-data-use matters.
Lead initial and periodic privacy risk assessments and assist with compliance monitoring in coordination with other compliance functions.
Work with the Office of Ethics and Compliance and legal counsel to maintain appropriate privacy and confidentiality consent and authorization forms, information notices, and related materials.
Develop and deliver privacy training and awareness programs, and oversee initial privacy training and orientation for employees, volunteers, medical and professional staff, contractors, alliances, business associates, and other appropriate third parties.
Participate in developing, implementing, and monitoring trading partner and business associate agreements to address privacy requirements and responsibilities.
Define privacy requirements for appropriate access to protected health information in coordination with management, operations, Information Security, and Information Technology.
Work with HIM Directors and applicable organization units to oversee patient rights to inspect, amend, and restrict access to protected health information when appropriate.
Oversee processes for receiving, documenting, tracking, investigating, and acting on privacy complaints, in coordination with related functions and legal counsel when necessary.
Ensure compliance with privacy practices and consistent application of sanctions for violations, in cooperation with Human Resources, administration, and legal counsel as applicable.
Promote information privacy awareness within the organization and related entities.
Serve as liaison to the University of Pittsburgh IRB and as privacy liaison for users of clinical and administrative systems on permissible use, disclosure, individual rights, and other privacy requirements.
Coordinate with personnel involved in releasing protected health information to ensure compliance with organizational policies and legal requirements.
Maintain current knowledge of applicable federal and state privacy laws and accreditation standards.
Serve as the organization’s information privacy consultant for departments and appropriate entities.
Partner with Security, Legal, IT, and HR to embed privacy by design into systems and processes.
Serve as the primary contact for regulators, auditors, and external partners, and coordinate privacy-related compliance reviews and investigations.
Represent the organization’s information privacy interests with external parties, including state or local government bodies considering privacy legislation, regulations, or standards.
Perform additional tasks and accountabilities requested by the Chief Compliance Officer, prepare status reports as requested, and attend staff meetings as requested.
Coordinate privacy-related audit activities, define privacy audit requirements, and oversee privacy compliance audits in collaboration with the Vice President, Billing, Monitoring and Risk Assessment.
Review, analyze, and negotiate privacy-related contract terms concerning data use, disclosure, individual rights, and regulatory obligations in connection with technology purchases, service agreements, joint ventures, and new business initiatives.
Respond to day-to-day privacy questions from hospitals and other UPMC entities, including through extensive telephone and face-to-face consultation, research, and analysis under exigent circumstances.
Develop and report enterprise privacy metrics, trends, and key risk indicators to executive leadership and the Audit and Compliance Committee of the UPMC Board of Directors.
Participate on the ERM steering committee and integrate privacy risks into the ERM framework and reporting structure.
Define privacy requirements for data inventories and data-flow mapping within the Health Services Division and collaborate with the CISO, Information Technology, Data Governance, and business owners.
Collaborate with the CISO on Health Services Division issues and establish privacy governance requirements for data collection, use, retention, disclosure, and destruction.
Partner with Information Security, Information Technology, Records Management, Legal, and business owners to implement technical and operational controls.
Lead privacy and regulatory components of incident response, including breach determination, notification strategy, regulatory interaction, documentation, and privacy remediation.
Partner with the CISO and other stakeholders on technical investigation, containment, forensics, recovery, and technical root-cause analysis.
Oversee privacy risks related to AI, advanced analytics, and secondary use of data.
Lead enterprise culture initiatives that reinforce accountability for responsible data use.