Senior Privacy Counsel

What you'll do

• Advise on HIPAA risk analyses, risk management, compliance, and breach notification; partner with security and compliance teams to track and remediate risks.
• Advise product and data engineering teams on HIPAA de-identification for research, machine learning model training, and data licensing; negotiate Business Associate Agreements and assess vendor privacy risks.
• Support privacy policies and training, incident response, and privacy-related litigation matters.

What they ask for

• Juris Doctor (J.D.) from an accredited U.S. law school and an active license to practice law in at least one U.S. state; eligible for Illinois In-House Counsel registration.
• At least 5 years of legal experience concentrated in healthcare data privacy, including hands-on HIPAA compliance experience.
• Practical experience contributing to HIPAA Security Rule Risk Analyses, risk mitigation plans, and OCR compliance frameworks.
• Familiarity with HIPAA Breach Notification Rule four-factor risk evaluations and incident response workflows.

Nice to have

• In-house experience; familiarity with U.S. consumer and state privacy frameworks, international privacy regulations, NIST Cybersecurity Framework (CSF) or ISO 27001, and privacy risks involving genomic data, laboratories, or AI/ML health-data training.
• IAPP CIPP/US, CIPP/E, or CIPM certification.

Pay

$175,000-$210,000 USD base salary

Tools

HIPAA, HITECH, CCPA/CPRA, GDPR, Standard Contractual Clauses, Data Privacy Framework, NIST Cybersecurity Framework (CSF), ISO 27001

AI focus

Advise on de-identification and data use for machine learning model training, and evaluate privacy risks involving AI products and AI/ML training on health data.