Privacy Officer

Nature of Work: The Privacy Officer reports to the Associate Vice President and Chief Compliance and Ethics Officer or above, provides leadership and guidance for a university department.

Typical Responsibilities: Reporting to the Associate Vice President and Chief Compliance and Ethics Officer, the Privacy Officer is responsible for the University’s Privacy Program including but not limited to daily operations of the program, development, implementation, and maintenance of policies and procedures, monitoring program compliance, investigation and tracking of incidents and breaches and ensuring compliance with federal and state laws and University policies and procedures. During declared campus emergencies, this position may be required to perform specific job related duties at a designated off campus location or place of residence.

Required Qualifications: This position requires either (a) Master’s degree from an acceptable accredited institution in a directly related area of specialization; (b) Bachelor’s degree from an acceptable accredited institution in a directly related area of specialization and two years of experience directly related to the job functions; or (c ) 6 years of direct experience.

 

• Builds a strategic and comprehensive Privacy Program that defines, develops, maintains and implements policies and processes that enable consistent, effective privacy practices which minimize risk and ensure the confidentiality of sensitive/confidential/personally identifiable information, paper and/or electronic, across all media types.
• Works with senior leadership and the Chief Compliance and Ethics Officer to establish governance for the privacy program.
• Serves in a leadership role for privacy compliance.
• Collaborates with the Chief Information Security Officer or designee to ensure alignment between security and privacy compliance programs including policies, practices, investigations, and acts as a liaison to the information systems department.
• Establishes, with the Chief Information Security Officer or designee, an ongoing process to track, investigate and report inappropriate access and disclosure of sensitive/confidential/personally identifiable information. Monitor patterns of inappropriate access and/or disclosure of such information.
• Performs or oversees initial and periodic information privacy risk assessment/ analysis, mitigation and remediation.
• Conducts related ongoing compliance monitoring activities in coordination with other compliance and operational assessment functions.
• Takes a lead role, to ensure the University has and maintains appropriate privacy and confidentiality consents, authorization forms and information notices and materials reflecting current organization and legal practices and requirements.
• Oversees, develops and delivers initial and ongoing privacy training to faculty, staff, and students.
• Establishes and administers a process for investigating and acting on privacy complaints.
• Performs required privacy breach risk assessment, documentation, and mitigation.
• Works with Human Resources to ensure consistent application of sanctions for privacy violations.
• Initiates, facilitates and promotes activities to foster information privacy awareness.
• Maintains current knowledge of applicable federal and state privacy laws and accreditation standards.
• Works with senior leadership, legal counsel, and other related parties to represent the University’s information privacy interests with external parties (state or local government bodies).
• Serves as an information privacy resource on records requests both internal and external to the University (including public records requests).
• Serves as a resource to the Office of the Registrar on FERPA and other privacy-related matters.
• If designated, serves as the HIPAA Privacy Officer for the university.
• Provides expertise on compliance with international privacy obligations, including GDPR; serves as point of contact if designated.
• Cooperates with the Office of Civil Rights, other legal entities, and University officers in any privacy compliance reviews or investigations.

Departmental Requirements

Ability to develop and maintain recordkeeping systems and procedures.

Strong verbal and written communication skills and the ability to present information effectively to groups.

Skill in examining and re-engineering operations and procedures, formulating policy, and developing and implementing new strategies and procedures.

Knowledge of computerized information systems.

Strong analytical and critical thinking skills and the ability to analyze, summarize, and effe