Job Purpose
The Manager, Health Information Privacy is responsible for leading the organization’s privacy program and supporting compliance with applicable privacy legislation, regulations, and organizational policies related to the collection, use, disclosure, retention, and protection of personal health information (PHI) and personal information within the shared services environment.
Working within a healthcare information systems (HIS) shared services organization, the Manager, Health Information Privacy provides operational leadership for privacy compliance, privacy risk management, breach response, privacy impact assessments, and privacy-related processes associated with shared systems and services supporting member hospitals.
The role works collaboratively with internal ONE HITS teams, vendors, and Member hospital representatives to support compliant privacy practices within ONE HITS systems and services.
The Manager, Health Information Privacy participates in shared governance and committee structures to communicate privacy-related changes, understand operational impacts to member hospitals, and support consistent privacy practices across shared service environments.
Roles and Responsibilities (Subject to Change)
Privacy Program Leadership
• Lead the development, implementation, maintenance, and continuous improvement of the organization’s privacy program.
• Develop and maintain privacy policies, procedures, standards, and guidelines aligned with organizational requirements and applicable legislation.
• Provide operational privacy guidance and support to internal teams and leadership.
• Support organizational compliance with applicable privacy legislation, including Personal Health Information Protection Act (PHIPA), and related healthcare privacy requirements.
Privacy Compliance & Risk Management
• Lead privacy risk assessments and Privacy Impact Assessments (PIAs) for systems, technologies, projects, and operational changes involving shared services and systems.
• Oversee privacy incident and breach management activities including investigation, containment, mitigation, documentation, and corrective action planning.
• Support audits, compliance reviews, investigations, and regulatory reporting requirements related to privacy matters.
• Monitor changes to privacy legislation, healthcare requirements, and industry best practices impacting shared systems and services.
• Develop and maintain privacy reporting, metrics, and supporting documentation.
Shared Services Operations Support
• Ensure compliance with PHIPA obligations applicable to Health Information Network Providers (HINPs) and Electronic Service Providers (ESPs)
• Lead and maintain Privacy Impact Assessments (PIAs) and support Threat Risk Assessments (TRAs) for shared services.
• Support development of member-facing privacy documentation, attestations, and privacy compliance reporting.
• Assess privacy implications of new services, integrations, vendors, and technology changes through a formal privacy review process
• Participate in committees and shared governance groups to communicate privacy-related changes, gather feedback, and understand impacts to member hospitals.
• Promote standardized privacy processes and controls within the shared services environment.
Education & Awareness
• Develop and support privacy education and awareness initiatives for staff and internal stakeholders.
• Promote a culture of confidentiality, accountability, and appropriate handling of personal health information.
• Provide guidance to employees regarding privacy responsibilities, confidentiality obligations, and organizational privacy practices.
Collaboration & Incident Response
• Collaborate with Information Security, Risk Management, Human Resources, Legal, and technical teams on matters involving privacy, access governance, investigations, and security incidents.
• Participate in organizational incident response activities involving privacy or unauthorized access to information.
• Support the review and management of access-related privacy concerns involving shared systems and services.
Education, Certifications and Licensing
• University degree in Health Information Management, Health Administration, Law, Information Management, Business Administration, or related field.
• Professional privacy certification is considered an asset (e.g., CIPP/C, CIPM, CHIMA).
Experience
• Minimum 5–7 years of progressive experience in healthcare privacy, health information management, compliance, or related fields.
• Experience working within healthcare, digital health, or healthcare information systems environments.
• Experience managing privacy incidents, investigations, risk assessments, and privacy compliance activities.
• Experience supporting shared services or complex healthcare technology environments is considered an asset.
• Previous leadership or management experience preferred.
Knowledge, Skills and Ability
• Strong knowledge of healthcare privacy legislation, regulations, and industry best practices.
• Understanding of healthcare information systems, electronic medical records, and digital health environments.
• Understanding of the relationship between privacy, cybersecurity, and information governance.
• Strong analytical, problem-solving, investigation, and risk assessment skills.
• Excellent communication, facilitation, and stakeholder relationship skills.
• Ability to manage sensitive and confidential matters with discretion and professionalism.
• Strong organizational, documentation, and project management skills.
• Ability to work collaboratively across technical, operational, and leadership teams.
Working Conditions
• Work from home office environment
• 37.5 hours per week
• Occasional on call, evening and/or weekend work as required
• Occasional travel may be required
