Collective Health

Security Engineer

• Stay apprised of changing state and federal laws and direct the business on practical implementation of privacy, security, and AI requirements for business operations, vendor engagements, and product development.
• Proactively translate state and federal privacy, security, and AI laws into actionable strategies, product requirements and contract terms for business and product teams and assist in development of training and awareness programs.
• Advise regulatory attorneys on privacy, security, and AI implications of healthcare related laws, such as ERISA and the ACA, as they relate to third party administrator functions, claims data, and required communications.
• Draft and negotiate privacy, security and AI terms and agreements, i.e., Business Associate Agreements, Data Security Agreements, and working with commercial attorneys to align terms with product capabilities and company processes while effectively managing privacy, AI, and security risks.
• Empower business and sales teams by providing expert guidance on privacy, security, and AI questions in Requests for Proposals and customer questionnaires.
• Provide strategic legal review, guidance and contract terms for data use, ownership, indemnification, and limitations of liability aligned with state and federal privacy, AI, and security laws and best practice to support the development and evolution of products.
• Remain current on evolving AI laws to educate and provide support to the business to ensure ongoing compliance with privacy, security, and AI-specific regulation, framework, policies, and guidance.
• Proactively identify and mitigate security and AI risks associated with new product features and commercial initiatives, ensuring 'security by design' and 'privacy by design' principles are embedded from conception and engage with product and engineering teams on new development initiatives, providing clear, practical legal guidance.
• Direct teams in the legal classification of AI systems, assessment of risks, and AI governance frameworks, including development of policies and procedures for ethical AI development, deployment, use, and risk mitigation, ensuring responsible innovation and addressing potential biases and fairness in product offerings.
• Guide cross-functional stakeholders on AI principles such as governance, transparency, accountability, and human-oversight.
• Work cross-functionally on a privacy and data governance program (covering data classification, retention, quality, access and disposal) ensuring compliance and enabling data-driven product innovation.
• Act as a legal partner to the Privacy Officer and the Chief Information Security Officer to proactively advise on federal and state privacy and data security obligations, applicable external certifications and benchmarking frameworks (e.g., HITRUST, NIST, NYDFS, SOC2), including participating in tabletop exercises.
• Assist with drafting, updating, and operationalizing cybersecurity, and data protection policies, procedures, standards, and guidelines and support third party risk management, due diligence and contracting.
• Advise and support, as requested by the Privacy Officer and/or Chief Information Security Officer, escalated privacy and/or cyber incidents, lawsuits, regulatory inquiries, or government escalations including communications and outreach to customer, vendor and partner counsel.

Senior Privacy, Security & AI Counsel

Director

• Own the full lifecycle of the PHP relationship, working in close collaboration with internal teams, ensuring projects are delivered on time and within scope.
• Serve as a primary senior contact for partner stakeholders, developing strong and trust-based relationships while ensuring alignment on operational priorities, experience goals, and performance excellence
• Identify and define project scope, objectives, and deliverables in collaboration with stakeholders.
• Influence and align cross-functional teams across legal, client analytics, operations, product, and engineering to drive towards shared outcomes, while partnering closely with program management to provide strategic oversight of projects.
• Serve as trusted advisor to senior internal leaders, including the C-Suite, synthesizing partner insights, risks, and opportunities to drive growth
• Conduct post-engagement reviews to capture lessons learned and continuously improve delivery methodologies.

Partner Engagement Director

Manager

• Manage and oversee the Privacy Program in collaboration with the Chief Compliance Officer
• Lead a small privacy team
• Act as a subject matter expert on HIPAA and state privacy laws and related internal processes to educate on and ensure compliance with applicable regulations
• Monitor and respond to privacy questions and incidents, including conducting investigations and documenting findings
• Develop and implement privacy-related policies, procedures, controls, and training materials
• Develop and lead privacy monitoring and auditing activities
• Develop and track data analytics related to success of the privacy program and regulatory compliance
• Guide and support staff and management on privacy-related matters
• Collaborate with the organization's legal and compliance teams to identify and mitigate privacy risks
• Conduct periodic assessments of the organization's privacy practices according to industry standards and best practices to identify areas for improvement
• Stay up-to-date on privacy-related laws, rules, and regulations that impact health care and technology organizations
• Maintain confidentiality and privacy of member health information
• Provide other support for the organization's privacy program as needed

Senior Manager, Privacy Programs

Compliance

• Provide on-going guidance to the business on claims and compliance-related matters.
• Act as the primary SME for compliance matters related to claims administration, FWA and billing standards.
• Develop and oversee the internal auditing and monitoring programs to proactively identify risks.
• Oversee the response and strategy for client-driven external audits and regulatory inquiries.
• Collaborate with the Compliance team to create and implement the Annual Risk Assessment and Compliance Work Plan.
• Support the development and refinement of compliance policies that align with industry benchmarks.
• Establish and maintain a robust compliance reporting program.
• Prepare detailed reports and updates for the Compliance Officer to share with the Board of Directors and management.
• Bridge gap between healthcare claims adjudication workflows, product design and data engineering.

Senior Privacy, Security & AI Counsel

Partner Engagement Director

Senior Manager, Privacy Programs

Director, Compliance Programs