We are so glad you are interested in joining Sutter Health!

Organization:

SHSO-Sutter Health System Office-Valley

Position Overview:

Supports and advances the Sutter Health privacy program by performing mid to advanced level privacy operations across assigned entities. Assists with program development, conducting investigations, managing auditing and monitoring activities, and supporting implementation of policies, training, and risk mitigation strategies. Ensures compliance with federal and state regulations governing the confidentiality, access, use, and disclosure of protected health information (PHI) and other sensitive data. May serve as a subject matter resource to entity leadership, workforce members, and project teams and may participate in committees and cross-functional initiatives.

(Intended for use by SHSO only)

Job Description:

These Principal Accountabilities, Requirements and Qualifications are not exhaustive but are merely the most descriptive of the current job. Management reserves the right to revise the job description or require that other tasks be performed when the circumstances of the job change (for example, emergencies, staff changes, workload, or technical development).

JOB ACCOUNTABILITIES:

Privacy Program Oversight

• Supports and advances a comprehensive privacy compliance program consistent with the seven elements of an effective compliance program.
• Assists in developing and maintaining privacy policies in alignment with federal and state laws.
• Ensures operational processes support patient rights (notice of privacy practices, access, amendment requests, accounting of disclosures, restrictions).
• Coordinates business associate agreement (BAA) documentation and tracking in the contract database.
• Maintains required documentation of privacy program elements in accordance with retention requirements.
• Provides consultation to management and workforce members on privacy questions and requirements.
• Participates in entity or regional compliance committees through routine presentations regarding privacy‑related activities, metrics, and risks. Includes the creation of presentation materials.
• Provides highly independent “out of office” coverage for entity privacy officer.
• Actively leads and drives the outcomes of formally established workgroups, initiatives, or projects.

Education & Training

• Develops and delivers training on privacy policies and procedures for new hires and ongoing workforce education.
• Contributes to annual or ad‑hoc updates to privacy training content and awareness campaigns.
• Ensures compliant documentation of all completed training.
• Ensures workforce members meet confidentiality acknowledgement requirements.

Investigations & Reporting

• Independently conducts and documents privacy investigations, including root‑cause analysis and remediation recommendations.
• Ensures timely reporting of incidents to patients and government agencies as required by state and federal regulations.
• Supports consistent sanction processes for violations in partnership with human resources.
• Independently supports responses to inquiries from regulators and compliance review activities.
• Participates in training and execution of the privacy incident response plan.

Risk Assessment, Auditing & Monitoring

• Conducts privacy risk assessments utilizing standardized methodologies.
• Performs routine auditing and monitoring of systems containing PHI to identify inappropriate access or risk patterns.
• Develops corrective action plans and monitors completion of mitigation activities.
• Identifies workflow and process improvement opportunities and collaborates with stakeholders to implement changes.
• Maintains awareness of regulatory updates, industry standards, and monitoring priorities impacting privacy.

Governance & Risk Management

• Performs and documents privacy impact assessments for systems, vendors, and new initiatives.
• Maintains accurate records of privacy review activities within the governance, risk, and compliance (GRC) platform.
• Assists with developing and maintaining privacy risk inventories, controls, and remediation tracking.
• Contributes to privacy metrics, dashboards, and scorecards to support leadership decision‑making.
• Upholds confidentiality of privacy‑related data and supports secure handling of sensitive information.

System Program Development

• Participates in developing or revising system policies, standardized processes, training programs, and risk mitigation strategies.
• Contributes to building and enhancing methodologies for risk quantification, auditing, monitoring, and reporting.

EDUCATION:
Equivalent experience will be accepted in lieu of the required degree or diploma

Bachelor’s degree in healthcare, information technology, business, compliance, or a related field.

CERTIFICATION & LICENSURE:

CHPC – Certified in Healthcare Privacy Compliance required within one year of hire.

TYPICAL EXPERIENCE:

8 years recent relevant experience

SKILLS AND KNOWLEDGE:

Experience must include privacy operations, compliance, healthcare workflows, and investigation responsibilities.

In‑depth working knowledge of HIPAA privacy regulations and applicable state/federal laws governing PHI.

Working knowledge of healthcare operations, including clinical workflows, revenue cycle, billing/coding, and healthcare compliance requirements.

Ability to analyze problems from legal, clinical, operational, and human‑resource perspectives.

Understanding of strategies for protecting electronic health records, data integrations, and clinical system workflows.

Strong project management skills to support planning, execution, and monitoring of privacy initiatives.

Demonstrated ability to operate effectively in a dynamic, multi‑facility healthcare environment.

Strong communication and presentation skills with ability to interact with staff, leaders, clinicians, and physicians.

Ability to influence others and support compliance without direct authority.

Proficiency with personal computing tools (presentations, spreadsheets, documents).

Ability to interpret, analyze, and present complex data in meaningful ways for varied audiences.

Demonstrated teamwork, leadership, and mentoring capabilities.

Strong organizational skills with the ability to build consensus and support change initiatives.

Job Shift:

Days

Schedule:

Full Time

Days of the Week:

Monday - Friday

Weekend Requirements:

As Needed

Benefits:

Yes

Unions:

No

Position Status:

Exempt

Weekly Hours:

40

Employee Status:

Regular

Sutter Health is an equal opportunity employer EOE/M/F/Disability/Veterans.

Pay Range is $142,105.60 to $213,158.40 / annual salary

The compensation range may vary based on the geographic location where the position is filled. Total compensation considers multiple factors, including, but not limited to a candidate’s experience, education, skills, licensure, certifications, departmental equity, training, and organizational needs. Base pay is only one component of Sutter Health’s comprehensive total rewards program. Eligible positions also include a comprehensive benefits package.