Lead, Privacy

Pour obtenir une traduction en français de l'offre d'emploi suivante, veuillez envoyer un courriel à . Les demandes seront traitées dans un délai de trois jours ouvrables et la période de dépôt des demandes sera prolongée de trois jours.

To obtain a French translation of the following job posting, please email . Requests will be addressed within three business days, and the application window will be extended by three business days.

At Ontario Health, we are committed to developing a strong organizational culture that connects and inspires all team members across the province. Our vision is that together, we will be a leader in health and wellness for all. Our mission is to connect the health system to drive improved and equitable health outcomes, experiences and value. How we work together is reflected through our five values: integrity, inspiration, tenacity, humility and care.    

What Ontario Health offers:   

Achieving your career goals is a priority to us. Benefits of working at Ontario Health may include the following based on employment type:  

• Fully paid medical, dental and vision coverage from your first day  

• a health care spending or wellness spending account

• a p remium defined benefit pension plan  

• three personal days and two float days annually  

• three weeks' vacation to start (for individual contributors), increasing to four weeks after two years

• c areer development opportunities  

• a collaborative values-based team culture  

• a wellness program

• a hybrid working model  

• p articipation in Communities of Inclusion   

Want to make a difference in your career?  Consider this opportunity.   

Here is what you will be doing:

Reporting to the Manager, Privacy, the Privacy Lead is responsible for the continued development, operation, improvement and execution of the privacy program for Ontario Health; in particular all relevant privacy activities specific to the provincial Electronic Health Record (EHR) and related programs. The Privacy Lead will enable the Privacy team and relevant business units and programs in meeting all privacy requirements under the Personal Health Information Protection Act, 2004 (PHIPA), applicable agreements, policies and procedures, best practices, and Privacy by Design principles. The Privacy Lead is responsible for the continued monitoring of the privacy program activities to ensure they meet evolving privacy requirements, in particular those applicable to Ontario Health as a Prescribed Organization under PHIPA.

The Privacy Lead will use their privacy assurance and operational experience with their knowledge of privacy, legal and regulatory requirements to act as a senior privacy subject matter expert. This role is expected to provide privacy consultation, advice, and privacy impact assessments for both development initiatives and ongoing maintenance functions in relation to the programs, processes, and technologies underlying the provincial EHR. The Privacy Lead will be a key point of privacy contact for a multitude of EHR projects and programs. This role will also support prioritization of key privacy engagements, review, update, and implementation of standard operating procedures (SOPs), practices, management of privacy risks, and advancement of privacy knowledge and understanding for all Ontario Health team members involved in delivering the EHR and related programs.

The Privacy Lead will work closely with the Manager, Privacy, the Privacy Operations Officer, and the Chief Privacy Officer and other Ontario Health leaders and contributors. The Privacy Lead is expected to build internal and external relationships and liaise extensively with members of the Privacy team and functional teams across OH.

The Privacy Lead will play an important role in championing a culture of privacy at Ontario Health and enabling compliance with Ontario Health's complex privacy requirements.

Here is what you will need to be successful:

As a Privacy Lead, you will have the opportunity to:

• Operate and support the continued development of privacy program activities for Ontario Health's business unit that:

  • Is fully aligned and harmonized with the Ontario Health enterprise privacy program.

  • Ensures compliance with complex legislative and contractual requirements/obligations.

  • Embeds privacy best practice and Privacy by Design principles into business unit operations as well as new initiatives/projects.

  • Includes an agreements framework that aligns with Ontario Health' standardized contractual approaches.

  • Tracks, monitors, and remediates identified risks.

  • Identifies and addresses privacy education needs of the business unit.

  • Includes up-to-date and relevant SOPs to support operational compliance.

• Monitor the effectiveness of the privacy program, identifying gaps and addressing newly identified areas of risk as required.

• Manage the continued operation of the privacy program, adjusting and expanding the program as required to accommodate business needs.

• Conduct end-to-end PIAs on the business unit's existing programs and services to identify risks and develop and execute risk treatment plans, engaging subject matter experts from other portfolios or functional teams (e.g., Information Security, etc.) as needed.

• Support new projects and initiatives for the business unit by providing expert privacy advisory services, conducting PIAs and leading risk mitigation efforts.

• Develop and implement strategies to effectively prioritize the management of competing areas of risk, while supporting business objectives.

• Perform incident management, investigation, containment, and remediation for the business unit.

• Liaise with Legal, Information Security, and other teams as required to inform agreement structures and ensure a harmonized and standardized approach to data protection and information management across the organization.

• Proactively and effectively engage members of the Strategy, Planning, Privacy & Analytics Portfolio Leadership team as required to address areas of high risk or sensitivity.

• Monitor and stay current on relevant privacy, legal, technology and other matters that may impact Ontario Health's privacy program and risk posture.

Education and Experience

• Completion of a university (bachelor) program; holds an undergraduate or master's degree in health, policy, IT, security, law or related disciplines, or equivalent education/experience with evidence of continuing professional development in privacy.

• Recognized access and privacy designation (Certified Information Privacy Professional (CIPP/C) or other relevant privacy designation) is preferred.

• Recognized security certification is an asset.

• Minimum 5 years of direct operational level privacy experience, with 2-3 recent years focused in public sector healthcare privacy.

• Experience conducting privacy impact assessments and interpreting complex legislation, developing recommendations for risk mitigation, assigning responsibility for risk mitigation tasks and activities, and monitoring to completion.

• Experience developing and/or leading privacy program and operational activities including, for example, privacy breach management, training and awareness, and privacy risk management.

• Experience leading working groups, projects, or programs.

Knowledge and Skills

• Extensive knowledge of Ontario's Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Health Information Protection Act, 2004 (PHIPA), privacy best practices and industry standards.

• Understanding of Prescribed Entity and/or Prescribed Person roles under PHIPA and related compliance requirements.

• Broad understanding of privacy concepts, trends, legislative and regulatory requirements, and emerging issues (e.g., de-identification, event auditing and monitoring, AI, privacy maturity models, etc.) and their potential impacts.

• Demonstrated ability to plan, develop and implement strategies to achieve privacy compliance, identify and remediate risk, and develop and grow a culture of privacy.

• Proficient in Microsoft based work environment (i.e., Word, PowerPoint, Excel, Teams).

• Strong organizational skills and ability to establish and manage priorities with a superior commitment to follow-through, employing a risk-based approach where appropriate.

• Excellent interpersonal skills with ability to build collaborative relationships with internal and external stakeholders.

• Excellent written communication skills, including the ability to draft policies, briefing notes, and risk assessments.

• Ability to effectively communicate with and present to a diverse range of stakeholders, including executive leaders, portfolio leaders, and subject matter experts for functional areas such as Information Security, Legal and Architecture.

#LN-AH1

#LI-Hybrid

Employment Type:

Contract Length:

Salary Band:

External Application Deadline Date:

All applicants must be a resident of Ontario to be considered for roles at Ontario Health.

Ontario Health encourages applications from candidates who are First Nations, Métis, Inuit, and urban Indigenous; Francophone; members of Black and racialized groups; 2SLGBTQIA+ communities; trans and nonbinary individuals; and people living with disabilities.

Ontario Health is an accessible employer, and we offer accommodation in all aspects of employment, including the recruitment process. If you require a disability related accommodation in order to participate in the recruitment process, please email and a member of the team will connect with you within 48 hours.