Job Description
Job Summary:
The Senior Privacy Impact Assessment Specialist is responsible for providing expert privacy guidance and support on complex health sector and IT projects involving personal health information (PHI). This role ensures compliance with legal and contractual privacy obligations, leads privacy impact assessments, develops privacy policies, and embeds privacy-by-design principles to mitigate risks and protect individual privacy.
Responsibilities:
- Lead and conduct privacy impact and threshold assessments for medium to high complexity initiatives.
- Develop and maintain privacy policies, procedures, and controls aligned with regulatory requirements.
- Provide privacy advisory support and legislative interpretation to business teams and stakeholders.
- Investigate privacy incidents, patient inquiries, and privacy requests as needed.
- Identify and assess privacy risks and develop mitigation strategies.
- Participate in agency, regional, or provincial committees as the privacy subject matter expert.
- Develop and deliver privacy training programs.
- Support privacy program initiatives to enhance office efficiency and effectiveness.
- Review and advise on data sharing agreements and privacy-related documentation.
- Collaborate with internal and external partners to promote a culture of privacy.
Required Skills:
- Minimum 5 years operational privacy experience in health sector and/or IT environments.
- At least 5 years conducting privacy impact assessments on medium to high complexity projects.
- Experience developing privacy policies, procedures, requirements, or controls.
- Strong knowledge of the Personal Health Information Protection Act, 2004 (PHIPA) and related regulations.
- Experience drafting and reviewing privacy requirements for data sharing agreements.
- Undergraduate or graduate degree in health, policy, IT, security, law, or related discipline.
- Familiarity with Electronic Medical Record (EMR) or Hospital Information System (HIS) infrastructure and data flows.
- Understanding of Application Programming Interface (API) functionality and management.
Desired Skills:
- Recognized security certification or designation.
- Knowledge of technology architecture, digital health solutions, and enterprise IT security.
- Experience with Health Information Network Providers (HINP) and Electronic Service Providers (ESP) requirements.
- Familiarity with OntarioMD EMR certification.
- Strong analytical and problem-solving skills in privacy and security contexts.
- Excellent communication and stakeholder engagement abilities.
- Time management skills to handle multiple projects and deadlines.
Rated Criteria:
- Health care experience conducting privacy assessments on medium to high complexity projects - 20 Points
- Operational level privacy experience in health sector and/or IT environment - 20 Points
- Experience developing privacy policies, procedures, requirements, or controls - 20 Points
- Experience drafting and reviewing privacy requirements for data sharing agreements - 15 Points
- Knowledge and application of PHIPA, including HINP and ESP requirements - 10 Points
- Familiarity with API functionality and management - 8 Points
- Familiarity with EMR or HIS infrastructure, design, and data flows - 7 Points
Total: 100 Points Deliverables:
- Privacy consultation on complex, multi-partner health privacy and IT initiatives.
- Completed Privacy Threshold and Impact Assessments with associated documentation.
- Privacy risk mitigation plans informed by assessments.
- Data flow diagrams and privacy controls to ensure compliance.
- Review and advisory support on data sharing agreements and privacy-by-design documentation.
- Participation in privacy program activities and training development.
Must Haves:
- Minimum 5 years health care experience conducting privacy assessments on medium to high complexity projects.
- Minimum 5 years operational privacy experience in health sector and/or IT environment.
- Minimum 5 years experience developing privacy policies, procedures, requirements, or controls.
- Minimum 5 years experience drafting and reviewing privacy requirements for data sharing agreements.
- Experience with PHIPA, including HINP and ESP requirements; experience with prescribed statuses is an asset.
- Familiarity with API functionality and management.
- Familiarity with EMR or HIS infrastructure, design, and data flows.
Public Sector Experience:
Must have
Job Tags
Work at office