Privacy Lead Consultant

Job Description Summary

This role leads BCBSA's privacy compliance efforts, ensuring alignment with HIPAA, state, and international regulations. Builds and operationalizes privacy programs, drives awareness, and supports incident response across the enterprise.

Responsibilities

• Build and operationalize BCBSA's privacy program, including conducting privacy impact assessments, HIPAA risk assessments, and responding to privacy incidents.
• Collaborate across BCBSA on privacy‑related matters with legal, information security, enterprise risk management, and data governance on privacy‑related contracting, risk identification, and mitigation.
• Support the BCBSA Incident Response process, including the BCBSA Privacy Response Plan, engagement with Blue System colleagues on system‑wide incident response, and conduct regular exercises of incident response plans.
• Participate in the development and operationalization of BCBSA's privacy training program, supplementing online training with classroom and individual sessions; lead or assist with privacy training and educational sessions internally and externally.
• Provide subject‑matter expertise on privacy regulations and requirements, including HIPAA Privacy and Security Rules, state privacy laws, and emerging domestic and international privacy obligations.
• Assist the Compliance and Privacy Official with privacy investigations, including intake, analysis, documentation, and resolution of privacy complaints and potential violations.
• Support and coordinate privacy incident response and breach notification activities, including fact‑finding, regulatory analysis, internal coordination, and external notifications as required.
• Serve as a point of contact for privacy‑related matters across the enterprise, guiding business areas, legal, compliance, IT, and other stakeholders.
• Assess and advise on privacy risks associated with vendors, third parties, and Business Associates, including supporting contract reviews, negotiations, and risk mitigation strategies.
• Engage with external stakeholders—regulators, counsel, vendors, or partners—when responding to privacy incidents, investigations, or inquiries.
• Support the integration of privacy requirements into business processes, projects, and initiatives, including privacy‑by‑design and privacy‑by‑default practices.
• Monitor regulatory developments and emerging privacy risks, providing impact assessments and recommendations to leadership.
• Support audits, examinations, and assessments related to privacy, and coordinate responses to internal and external audit requests.
• Contribute to enterprise risk management and compliance activities related to privacy, including issue tracking, corrective actions, and reporting.
• Develop and maintain privacy metrics, documentation, and artifacts to support governance, oversight, and continuous improvement.
• Collaborate across BCBSA to promote consistent, compliant handling of personal and protected information.

Qualifications

• Bachelor's Degree in Compliance, Audit, Business, or equivalent experience; Juris Doctor preferred.
• Seven or more years of experience in privacy, planning, administration, audit, or compliance management roles.
• Comprehensive understanding of legal and regulatory requirements relating to privacy in the healthcare sector, including Federal and State mandates and requirements to safeguard Protected Health Information (PHI) and/or Personally Identifiable Information (PII).
• Experience with the Health Insurance Portability and Accountability Act (HIPAA).
• Knowledge of project and change management, vendor management, and contract administration.
• Strong relationship, facilitation, presentation, and communication skills; ability to collaborate, document, and present privacy risks to achieve buy‑in from system custodians and business owners.
• Certified Information Privacy Professional (CIPP) – IAPP certification required.

Salary Range

$130,609.00 – $187,868.65