Privacy Specialist, Privacy Compliance, Access and Freedom of Information Department – Permanent Full-Time (1.0)

The Privacy Specialist plays a critical role in ensuring the protection of identifiable information in accordance with applicable laws in Ontario and Canada (including but not limited to Ontario’s Personal Health Information Protection Act (PHIPA). The Specialist leads the development, implementation, and monitoring of privacy policies, procedures, and practices. The Specialist conducts privacy impact assessments (PIAs), investigates privacy incidents, engages with individuals and organizations to ensure personal rights around data handling are upheld, and supports  privacy training and auditing initiatives.

Working collaboratively with internal teams, legal and information security colleagues, and external partners, the Specialist promotes a culture of privacy, compliance, and continuous improvement.

Your responsibilities will include the following:

• →Regularly monitor, analyze, interpret, and make recommendations around how the organization can operationalize privacy legislation and related orders, decisions, and guidance from the privacy commissioner.
• →Lead the development, revision, and maintenance of privacy policies, procedures, and practices.
• →Participate in and contribute to organizational submissions and responses during reviews by the privacy commissioner.
• →Develop and enhance standard operating procedures (SOPs) for the calculation and tracking of privacy indicators.
• →Consult with supervisors, legal counsel, management, and colleagues to promote and implement privacy policies and practices.
• →Investigate privacy incidents and complaints in collaboration with leadership, legal counsel, and other internal and external stakeholders.
• →Support root cause analysis and the development of corrective and preventive actions, and review and monitor recommendations related to privacy incidents and breaches.
• →Conduct and support PIAs for new or modified programs, systems, and technologies.
• →Identify privacy risks and recommend mitigation strategies through a robust PIA process.
• →Plan, log, monitor, review, and update PIAs and recommendations in accordance with requirements from the privacy commissioner and with emerging practices.
• →Contribute to identifying, logging, and addressing privacy risks in collaboration with internal teams and privacy and/or security committees.
• →Identify opportunities to enhance privacy training through ongoing review of orders, decisions, and guidance from the privacy commissioner.
• →Provide guidance and support on privacy-related inquiries, initiatives, and training.
• →Support the development and implementation of privacy audit plans.
• →Analyze trends in audit results and prepare reports on privacy compliance and risks.
• →Engage with patients and individuals when exercising their individual rights around data handling and/or ensure individual rights are supported in policies, practices, and procedures.
• →Respond to unique access requests not in the domain of another team, such as release of information, and/or freedom of information requests.
• →Lead the management of consent collection and the processing of withdrawals of consent, and/or ensure consent requirements are addressed in policies, practices, and procedures.
• →Respond to and/or monitor inquiries and complaints about privacy and the handling of identifiable information.
• →Lead the submission of required reports and statistics to the privacy commissioner.
• →Act as a CHEO privacy representative on internal and external working groups (depending on the role, such as the MyChart User Advisory, Canadian Epic Privacy User Group, Prescribed Person and Prescribed Entity privacy group).
• →Perform work in accordance with the provisions of the Occupational Health and Safety Act and Regulations and all CHEO corporate/departmental policies and procedures related to
• →Occupational Health and Safety.
• →Perform other related duties as required and assigned.
  

• Bachelor’s Degree in health information management, law, public policy, or a related field (Essential)
• Professional certification in privacy or in information privacy (e.g. CIPP/C from IAPP, CHPS from AHIMA) (Preferred)
• Three (3) years’ experience in privacy, health information, or compliance roles (Essential)
• Strong knowledge of and experience with Ontario’s PHIPA and other applicable privacy legislation (e.g., FIPPA, PIPEDA) (Preferred)
• Experience conducting PIAs and managing privacy breaches (Preferred)
• Strong knowledge of regulatory processes of Ontario’s Information and Privacy Commissioner (Preferred)
• Excellent analytical, communication, and problem-solving skills (Essential)
• Ability to work independently and collaboratively in a fast-paced environment (Essential
• Criminal Record Check (Level 1) (Essential)
  

CHEO values diversity and is an equal opportunity employer. We are committed to providing an inclusive and barrier-free work environment, starting with the hiring process and welcome interest from all qualified applicants.

Should you require accommodation during any phase in the recruitment process, please contact Human Resources at TalentAcquisition@cheo.on.ca. All information received in relation to accommodation will be kept confidential and will be handled in compliance with the Accessibility for Ontarians with Disabilities Act.

We thank all those who apply, however, only those to be interviewed will be contacted.