Privacy Impact Assessment Specialist 0485-1415

Toronto - Canada

Monthly Salary: Not Disclosed

Posted on: 23 hours ago

Vacancies: 1 Vacancy

Job Summary

HM Note: This hybrid contract role is three (3) days in office. Candidate resumes must include first and last name email and telephone contact information.

Description

Background Information:

The purpose of this procurement is to acquire two Senior Privacy (PIA) Specialists to provide dedicated privacy subject matter expert to assist with supporting privacy matters related to a number of key Information Technology and data and analytics projects.
Ontario Health (OH) is seeking Privacy resources to ensure that Ontario Health maintains compliance with its legal and contractual privacy obligations and builds privacy into the design of projects that involve personal health information (PHI) thus reducing risk for the organization and protecting the trust and privacy of individuals whose PHI we manage.

Deliverables:

Over the duration of the engagement the Senior Privacy (PIA) Specialist will support work already in progress as well as new work on Privacy Impact Assessments;
Work with the project and product teams on risk mitigation of PIA findings as required under PHIPA;
Support work related to update and/or developing new agreements;
Other duties as required. Note that knowledge of current privacy and data protection policy and legislation especially Ontarios Personal Health Information Protection Act (PHIPA) will be critical to ensure success.

Must haves:

Minimum of 5 years health privacy experience conducting privacy impact assessments on medium to high complexity projects and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp;
Minimum 5 years direct operational level privacy experience preferably in a health sector and/or IT environment
Minimum 5 years experience developing privacy policies and procedures requirements or controls
Holds an undergraduate or graduate degree in health policy IT security law or a related discipline
Familiarity with the Personal Health Information Protection Act 2004 (PHIPA) and its related requirements for Prescribed Entities Prescribed Persons Health Information Network Providers (HINP) and Electronic Service Providers (ESP)
Familiarity with EMR (Electronic Medical Record) or HIS (Health Information System) infrastructure design and data flows
Familiarity with Application Programming Interface (API) functionality and management
Familiarity with Public Key Infrastructure (PKI)

Responsibilities:

The Senior Privacy Impact Assessment (PIA) Specialist will lead and support various IT and data and analytics initiatives including:

Develop privacy policies and procedures
Conduct privacy impact assessments for medium to high complex initiatives
May be required to support investigating privacy incidents patient inquiries and privacy requests of any kind
Identify and assess privacy risks
Provide privacy advisory and support to business teams
Lead and/or participate in OH regional or provincial committees or project teams as the privacy Subject Matter Expert
Identify privacy requirements
Develop strong relationships with various internal and external stakeholders to foster a culture of privacy
Respond and provide advice and legislative interpretation for information and access requests consent management requests complaints or inquiries appeals and privacy issues under the Personal Health Information Protection Act 2004 and the Freedom of Information and Protection of Privacy Act. and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp;
Support privacy program projects and activities to improve the efficiency and effectiveness of the Privacy Office
Develop and deliver privacy training for Ontario Health
Other duties as required

Desired Skills:

Completion of a university undergraduate or masters degree in health policy IT security law or a related discipline
Demonstrated knowledge and experience of access and privacy requirements and practices preferably related to the health and public sectors
Recognized security certification or designation is an asset
Excellent knowledge of privacy and security concepts trends and issues. This will include an understanding of their impact on business processes as well as skill with interpretation and communication of principles and compliance requirements
Knowledge and ability to interpret Ontarios Personal Health Information Protection Act 2004 (PHIPA)
Knowledge and ability to interpret Ontarios Freedom of Information and Protection of Privacy Act (FIPPA)
Analytical skills to understand the current and future access and privacy implications of policies decisions and business initiatives and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp; and nbsp;
Thorough understanding of privacy-by-design and best practices
Experience with conducting and/or providing oversight for Privacy Impact Assessments and Privacy Threshold Assessments including developing privacy requirements risk mitigation plans corporate policies and developing and/or delivering training content
Knowledge of technology architecture and infrastructure digital health solutions and services enterprise and corporate IT including information and cyber security preferred
Working knowledge of digital health technologies and information security industry standards
Excel in a fast-paced and project focused environment
Exceptional analytic and creative problem-solving abilities
Good understanding of related disciplines such as IT system design policy development (privacy or security) business architecture legal processes Freedom of Information administration business analysis risk management project management
Knowledge of Information Technology concepts and processes that impact the protection of personal information including (but not limited to) Internet tools system interfaces information security information architecture and data flows
Excellent Communication skills both verbal and written and strong stakeholder engagement skills
Time Management with the ability to manage tight deadlines and prioritize multiple projects

Required Experience / Evaluation Criteria: and nbsp; and nbsp;

Minimum 3 years health privacy experience conducting privacy impact assessments (PIAs) on medium to high complexity projects. 20 Points
Minimum 5 years direct operational level privacy experience in a health sector and/or IT environment or both. 20 and nbsp;Points
Minimum 5 years experience in developing privacy policies and procedures requirements or controls. 20 and nbsp;Points
Minimum 5 years experience drafting and reviewing privacy requirements for data sharing agreements. 15 and nbsp;Points
Familiarity with the Personal Health Information Protection Act (PHIPA) and requirements related to Prescribed Person Authority Prescribed Entity Authority Health Information Network Provider (HINP) and Electronic Service Provider (ESP). 10 and nbsp;Points
Familiarity with Application Programming Interface (API) functionality and management. 7.5 and nbsp;Points
Familiarity with Electronic Medical Record (EMR) or Hospital Information System (HIS) infrastructure design and data flows. 7.5 and nbsp;Points

Total Evaluation Criteria: 100 Points

Deliverables

The Senior Privacy Impact Assessment (PIA) Specialist will be required to work with the appropriate teams to: and nbsp;

Conduct/complete Privacy Threshold Assessments and associated documentation
Conduct/complete Privacy Impact Assessments and associated documentation
Provide Privacy Consultation on a diverse range of complex multi-stakeholder health privacy issues and Information Technology (IT) initiatives throughout the product/service development and deployment life cycle
Develop risk mitigation plans
Create or inform the creation of data flow diagrams and associated privacy controls and compliance requirements
Review and advise on agreements including data sharing agreements

Knowledge Transfer Details:

The resource will ensure full knowledge transfer is provided to the Ontario Health team before end of engagement. Some of this might occur at the end of the engagement but will also be shared as information is obtained/consolidated. Key deliverables will be shared with team.
The resource must provide all related documentation as part of knowledge transfer protocol. Documents will be reviewed by the appropriate leads and signed off by manager/director.
The resource will work collaboratively with the Ontario Health team throughout the assignment and ensure key deliverables milestones and documentation are shared.
A walkthrough of any demos development etc. will be required before the end of the engagement.

Must Haves: and nbsp;

Minimum of 5 years health privacy experience conducting privacy impact assessments on medium to high complexity projects and nbsp; and nbsp; and nbsp; and nbsp;
Minimum 5 years experience developing privacy policies and procedures requirements or controls and nbsp;
Familiarity with the Personal Health Information Protection Act 2004 (PHIPA) and its related requirements for Prescribed Entities Prescribed Persons Health Information Network Providers (HINP) and Electronic Service Providers (ESP) and nbsp;

and nbsp; and nbsp;

Nice to Have: and nbsp; and nbsp; and nbsp;

Minimum 5 years direct operational level privacy experience preferably in a health sector and/or IT environment and nbsp;
Familiarity with EMR (Electronic Medical Record) or HIS (Health Information System) infrastructure design and data flows and nbsp;
Familiarity with Application Programming Interface (API) functionality and management and nbsp;
Familiarity with Public Key Infrastructure (PKI) and nbsp;

HM Note: This hybrid contract role is three (3) days in office. Candidate resumes must include first and last name email and telephone contact information.DescriptionBackground Information:The purpose of this procurement is to acquire two Senior Privacy (PIA) Specialists to provide dedicated privacy...