Associate General Counsel – Privacy

The Opportunity

The Associate General Counsel – Privacy is the principal legal architect responsible for the strategy, governance, and management of Aeroflow Health's enterprise privacy program. Reporting directly to the General Counsel, this leader evaluates privacy and data protection requirements, advises executive and business leaders, and translates regulatory obligations into an effective program across business units and applicable subsidiaries. The role also serves as the designated HIPAA Privacy Officer for entities identified by the Company and directs the personnel and resources supporting the program.

Enterprise Privacy Strategy and Program Management

• Establish and execute a multiyear privacy strategy, annual work plan, and governance framework aligned with Aeroflow's risk profile, growth plans, and business objectives.
• Direct privacy program operations, personnel, and external resources; recommend staffing, budget, technology, and other investments to the General Counsel.
• Set enterprise privacy policies, accountability standards, and performance measures; oversee implementation, training, monitoring, and corrective action through designated staff and business owners.
• Lead privacy risk assessments and prioritize remediation across business units, subsidiaries, acquisitions, and new services; report material risks and resource needs to leadership.

Regulatory Evaluation and Executive Counsel

• Interpret HIPAA, HITECH, applicable state privacy and consumer health data laws, and other relevant requirements; determine applicability to entities, services, data flows, and proposed activities.
• Evaluate legislative, regulatory, enforcement, and litigation developments; assess business impact and direct appropriate changes to policies, systems, contracts, and operating practices.
• Provide legal advice to the General Counsel, executive leadership, and business leaders on complex privacy issues, regulatory exposure, and risk mitigation options.
• Establish privacy requirements for strategic initiatives, acquisitions, new markets, and products; communicate recommendations and unresolved risks clearly to decision makers.

Data Governance and Technology

• Set privacy review standards for AI, tracking technologies, marketing, analytics, patient portals, vendors, and data sharing; provide legal evaluation of significant or novel uses before implementation.
• Advise on consent, authorizations, de-identification, permitted data uses, retention, and secondary use; partner with IT, Security, and data leaders to embed requirements into systems and workflows.
• Lead negotiation of material privacy and data protection terms, including business associate agreements, and establish standards for vendor privacy diligence and contracting.

Incident Oversight and Regulatory Response

• Direct legal evaluation of significant privacy incidents, breach risk assessments, and notification obligations; oversee investigation strategy, mitigation, and remediation with the General Counsel and incident response leaders.
• Establish escalation criteria for complaints and incidents; advise on complex or systemic matters referred by designated privacy contacts and evaluate trends for enterprise risk.
• Oversee the accuracy and timeliness of required notices and regulatory responses; manage privacy regulatory inquiries and coordinate outside counsel under the General Counsel's direction.

Program Accountability and Leadership

• Establish and oversee processes for patient rights requests and complaint resolution, including designated operational contacts, response standards, documentation, and escalation procedures.
• Direct privacy personnel and business owners in implementing policies, training, monitoring, and remediation; evaluate effectiveness through metrics and targeted reviews.
• Partner with the Head of Audit and Compliance on independent assurance and shared risks, and with the Security Officer on safeguards and security risk assessments.
• Provide regular reporting to the General Counsel and executive leadership, and board or committee reporting as appropriate, on program maturity, emerging risks, incidents, and remediation.

Skills for Success

• Juris Doctor (JD) from an accredited law school required.
• Active bar membership in good standing in at least one U.S. jurisdiction and eligibility to practice as in-house counsel in the applicable jurisdiction.
• At least eight years of relevant legal experience, including substantial healthcare privacy counseling and demonstrated leadership of a privacy program or significant privacy initiatives.
• Deep knowledge of HIPAA and applicable federal and state privacy requirements; proven ability to evaluate regulatory applicability and translate complex requirements into business decisions and program strategy.
• Experience directing privacy risk assessments, incident evaluation, regulatory responses, vendor negotiations, and implementation of privacy controls.
• Strong executive judgment, communication, and management skills; ability to influence leaders, develop staff, prioritize resources, and oversee work across multiple business functions.

You Might Also Have

• Experience with DME, telehealth, digital health, multistate healthcare operations, acquisitions, or enterprise privacy program development.
• Experience evaluating AI, tracking technologies, consumer health data, and complex data sharing arrangements.
• CHPC, CIPP/US, or CIPM certification.