Privacy Associate (Privacy Compliance Specialist, Sr)

Department Overview

The mission of the Information Technology Group (ITG) is to develop, implement and maintain technology-based services and solutions enabling OHSU to effectively manage information to accomplish its missions.

The Privacy Compliance Specialist Sr. supports the Office of the Chief Privacy Officer and is responsible for working with the OHSU community to facilitate institutional compliance and integrity with the policies, procedures, regulations, and guidelines pertaining to information privacy and security. The OHSU Information Privacy & Security program (IPSO) assists OHSU in the security, confidentiality, and integrity of OHSU confidential information, including protected health information (PHI). The position will serve as a subject matter expert in the Privacy Office, performing tasks including privacy projects implementation, privacy impact and risk assessments, facility reviews, responding to privacy related inquiries and assisting leadership in developing privacy strategies in support of the OHSU mission.
Function/Duties of Position

Advisory inquires, projects and risk management activities

Use expert knowledge of HIPAA and other Information Privacy and Security related federal and state laws and regulations and OHSU policies and procedures to effectively:

- Timely respond to requests for Information Privacy and Security inquiries with accurate and coherent guidance while maintaining compliance with all applicable policy, regulatory and legal requirements.

- Serve as an expert advisory on Information Privacy and Security policy requirements specific to human subject research activities.

-
Serve as a subject matter expert resource for information privacy and security policies and regulations for all missions including healthcare, academic and research.

-
Provide program support for all matters related to information privacy and security policy guidance; risk identification, risk assessment and risk management.

-
Tracks and monitors privacy program risks, developing and implementing strategies for mitigating identified risks.

-
Supports Privacy program goals and projects as assigned by leadership.

-
Provides accurate and effective training, education and performs outreach activities as assigned and in line with the Privacy program’s training plan.

-
Assist leadership with improving policies and processes including providing best practice and workflow guidance.

-
Observe due care, objectivity and respect for confidentiality of information.

- Conduct privacy reviews as directed by leadership or in line with the Privacy program, including conducting risk evaluations and facility reviews.

- Work with leadership and stakeholders to develop plans to address identified risks.

- Provide accurate and effective education and training as assigned and in line with the Privacy training program.

- Evaluate business practices in relation to current privacy policies and laws, and provide recommendations on risk reduction.

- Appropriately identify activities or practices that are high-risk and/or high-impact to the business that require escalation to leadership for review and guidance.

- Work with organizational partners to improve their compliance with regulations and IPS policies/procedures and support related projects as applicable.

- As directed by leadership, represent the Privacy Office on assignments for both internal and external constituencies on matters related to information privacy and security.

- Provide regulatory and policy guidance to ensure the appropriate and effective use of Epic and related systems to improve HIPAA compliance and controls related to ePHI.

- Serve as a subject matter expert/consultant on information privacy issues to all areas and all levels of the OHSU community.

- Manage assigned projects/tasks to ensure completion in a timely, complete and high-quality fashion.

HIPAA Compliance Subject Matter Expert

- Subject matter expert in relevant state and fed