The JobThe Privacy Manager, under the direction of the Chief Privacy Officer, manages assigned operational activities supporting SCAN's enterprise privacy program across health plans and affiliated health care entities. The role translates federal and state privacy requirements into practical procedures and controls, coordinates privacy risk and incident activities, and supports privacy by design in business operations, data use, artificial intelligence (AI), analytics, and technology initiatives. The Manager collaborates with Legal, Compliance, Information Security, IT, Data, Clinical, Product, Marketing, Human Resources, Procurement, and business teams to protect individuals, support responsible innovation, and promote privacy accountability.
You Will- Privacy Program Operations: Manage assigned day-to-day privacy program activities for SCAN health plans and affiliated health care entities. Implement established processes, controls, standards, and documentation supporting compliance across business and clinical operations.
- Privacy Risk Management: Perform and coordinate privacy impact assessments, risk assessments, audits, and gap analyses for products, vendors, technologies, data uses, and business changes. Maintain assigned risk register entries, track remediation, and escalate significant issues to Privacy leadership.
- Policy and Regulatory Implementation: Draft, update, and implement privacy policies, procedures, notices, standards, and operational guidance under Privacy leadership direction. Support implementation of HIPAA, HITECH, 42 CFR Part 2, federal health privacy requirements, and applicable state privacy, consumer health data, biometric, breach notification, and data security laws.
- Monitoring, Metrics, and Assurance: Conduct and coordinate monitoring and auditing activities related to privacy requirements, appropriate access, minimum necessary use, retention, data sharing, and individual rights. Prepare metrics, dashboards, and supporting materials for leadership, committees, audits, and regulatory inquiries.
- Privacy by Design and Business Partnership: Advise and collaborate with Legal, Compliance, Information Security, IT, Data and Analytics, Clinical, Product, Marketing, Human Resources, Procurement, and business teams to incorporate privacy requirements into projects, systems, contracts, digital experiences, communications, and operational workflows.
- Incident Response and Regulatory Support: Manage intake, investigation, risk assessment, documentation, mitigation, and closure of assigned privacy incidents. Coordinate corrective actions, support required notifications and regulatory responses, maintain defensible records, and escalate potential breaches or material issues to Privacy leadership.
- AI and Emerging Technology Governance: Assist with privacy reviews of AI, machine learning, automated decision systems, ambient technologies, online tracking technologies, and advanced analytics. Evaluate data sources, intended uses, transparency, human oversight, vendor practices, retention, secondary use, and individual impact; recommend safeguards and monitoring requirements.
- Training and Culture: Develop and deliver role-based training, practical guidance, communications, and awareness materials that make privacy requirements understandable and actionable. Support a culture of accountability, member trust, and responsible innovation.
- Data Governance, Individual Rights, and Vendor Oversight: Manage or support operational processes for data minimization, retention and deletion, individual privacy rights, consent and preference management, and third-party data sharing. Assist with privacy reviews of vendors, contracts, data use agreements, business associate arrangements, and higher-risk processing activities; escalate complex issues as appropriate.
- We seek Rebels who are curious about AI and its power to transform how we operate and serve our members.
- Actively support the achievement of SCAN's Vision and Goals.
- Other duties as assigned.
Your Qualifications- Bachelor's Degree in Healthcare Administration, Law, Business or related field or equivalent experience
- 5 or more years of progressively responsible experience in privacy, compliance, information security, legal, health care operations, data governance, or related field. Strong knowledge of HIPAA, HITECH, 42 CFR Part 2, state medical privacy and breach notification laws, comprehensive state consumer privacy laws, and emerging consumer health data and AI requirements is preferred.
- Demonstrated experience implementing privacy and security requirements, conducting privacy reviews and investigations, assessing privacy and regulatory risks, supporting incident response activities, and coordinating cross-functional initiatives is required.
- Experience applying privacy-by-design principles, evaluating emerging technologies, including artificial intelligence (AI), and supporting compliance with healthcare privacy and security regulations is preferred.
- Preferred Certifications or Licenses: CHPC, CIPP/US, CIPM, AIGP, or a comparable privacy, compliance credential preferred.
- Preferred 8 or more years of privacy, compliance, legal, data governance, information security, or related experience is preferred, particularly in health care, health insurance, digital health, or another highly regulated industry.
- Practical experience with privacy impact assessments, data inventories, individual rights, vendor oversight, incident response, regulatory inquiries, online tracking technologies, AI governance, and privacy-enhancing controls is also preferred.
- Familiarity with the NIST Privacy Framework, NIST AI Risk Management Framework, HITRUST, SOC 2, ISO standards, or similar frameworks is beneficial.
- Strong project management, organization, and change implementation capabilities
- Strong written and verbal communication, influence, and cross-functional collaboration skills
- Ability to interpret complex legal and technical requirements and convert them into practical operational controls
- Ability to prioritize multiple regulatory, operational, incident, technology, and project-based assignments
- Ability to handle sensitive and confidential information with discretion and maintain defensible documentation
What's in it for you?- Base Pay Range: $106,200 - $153,705 annually
- Work Mode: Mostly Remote
- An annual employee bonus program
- Robust Wellness Program
- Generous paid-time-off (PTO) along with 11 paid holidays per year, 1 floating holiday, birthday off, and 2 volunteer days
- Excellent 401(k) Retirement Saving Plan with employer match
- Robust employee recognition program
- Tuition reimbursement
- An opportunity to become part of a team that makes a difference to our members and our community every day!
We're always looking for talented people to join our team! Qualified applicants are encouraged to apply now!
