Job Description

University of Utah Job Description

Job Summary

The University of Utah Chief Information Privacy Officer leads privacy strategy across a complex and dynamic institution that includes Utah’s flagship university; the state’s only academic health system, a health plan; robust academic and human subjects research programs; and numerous commercial and public-service operations. The Chief Information Privacy Officer serves as the enterprise authority on privacy and directs investigations; manages regulatory obligations under applicable state, federal, and international laws; and leads a team to ensure consistent, effective, and compliant privacy practices. This position requires exceptional leadership and strategic vision to maintain a robust, university-wide privacy program in a highly regulated, multifaceted environment.

Qualifications

Applicants must demonstrate the potential ability to perform the essential functions of the job as outlined in the position description.

Applicants must demonstrate the potential ability to perform the essential functions of the job as outlined in the position description.

Disclaimer

This job description has been designed to indicate the general nature and level of work performed by employees within this classification.  It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to the job.

Essential Functions

Duties and Responsibilities

• Maintain and apply current knowledge of industry standards, best practices, trends, and regulatory requirements.
• Research, analyze, interpret, and develop guidance related to complex and evolving federal, state, and international privacy laws.
• Hire, develop, and lead a team of high performing privacy experts; manage staff and provide leadership to achieve the university’s privacy goals and vision for data privacy.
• Oversee the development and execution of a university-wide privacy education strategy.
• Coordinate appropriate response to data privacy incidents and investigations. Meet regulatory deadlines and requirements, including those related to breach notification and reporting.
• Chair or co-chair privacy committees, subcommittees, or privacy projects; participate as a member of privacy adjacent committees as necessary.
• Oversee development, implementation, and maintenance of policies, procedures, and guidance related to data privacy.
• Lead interactions with state and regulatory authorities on privacy matters, including the Utah Office of Data Privacy, the HHS Office for Civil Rights, Department of Education, and others as applicable.
• Collaborate with other risk and compliance stakeholders including the Information Security Office, Risk Management, Health Information Management, the Institutional Review Board, the Registrar’s Office, Internal Audit, and the Office of General Counsel.
• Conduct privacy risk assessments and privacy impact assessments in compliance with regulatory and legal requirements. Oversee privacy auditing and monitoring activities.
• Identify, oversee, and execute strategic projects with enterprise impact; enable collaboration among internal teams and external stakeholders to achieve mutually beneficial outcomes.
• Provide budgetary oversight for the Privacy Team—advise on salary decisions and ensure appropriate purchasing approvals and spend stewardship.
• Lead the creation and submission of the university’s annual Privacy Program Report required under GDPA. Drive continuous improvement by analyzing findings, identifying gaps, and implementing strategies to strengthen the university’s privacy program.

Problem Solving

Knowledge, Skills, Abilities, and Experience

• Ability to navigate highly complex and overlapping regulatory environments, including HIPAA, FERPA, Part 2, GDPR, PIPL, the Common Rule, and Utah’s GDPA. Must possess the ability to determine which laws and standards apply in specific contexts, and the judgment to identify the most effective compliance approach.
• Demonstrated ability to work independently, exercise leadership, negotiate effectively, and influence change.
• Exceptional communication skills, with the ability to produce clear and persuasive oral and written content. Ability to deliver presentations confidently to executive leadership and large audiences.
• Demonstrate strong professional and interpersonal skills, including the ability to interact effectively with individuals at all levels of the organization.
• Experience leading teams and motivating high-performing individuals.
• Ability to effectively prioritize work and meet deadlines.