System Director, Privacy Officer

About the role

The System Director, Privacy Officer is responsible for the implementation of a comprehensive patient privacy program for UVM Health. This position oversees and supervises the Office of Compliance, Privacy and Internal Audit's privacy staff to ensure privacy and data protection compliance and provides leadership and subject matter expertise to drive the continued improvement and implementation of the system's privacy program.

Responsibilities

• Provide guidance and education to physicians and non-physician practitioners, clinical department leaders, and other workforce members regarding compliance with federal and state rules, regulations, and laws on HIPAA and other privacy-related practices
• Maintain expertise in federal and state regulations, as well as the regulations of other authorities, and ensure that UVM Health is compliant with those standards
• Participate in annual risk assessments and the development and execution of an annual compliance workplan
• Perform audits and analyses; assist in implementation of recommendations
• Provide education both within the department and throughout the System on all HIPAA and other privacy-related matters
• Provide strategic leadership and enterprise-wide oversight of the UVM Health privacy program, ensuring effective implementation of a comprehensive privacy framework that complies with federal and state laws, regulations, and standards
• Direct a cross-functional team, including direct supervision of privacy staff across the network
• Drive policy, operational, and cultural improvements related to patient privacy
• Partner with executive leadership, legal counsel, information security, and operational leaders to embed privacy into system-wide initiatives, guide decision-making, and proactively manage the organization's compliance posture
• Allocate resources and lead cross-functional projects
• Ensure staff and leaders across the network are educated, supported, and held accountable for privacy practices
• Participate in the annual compliance risk assessment and work plan
• Design, execute, and continuously improve the network's privacy monitoring, training, and breach response programs