Manages the Sutter Health's information security and risk management functions while managing the actions of the privacy and information risk management team. Develops, implements, and monitors Sutter Health's vendor management program activities, including actions related to risk management, due diligence, contract provisions, vendor reviews, and requirements. Supervises and monitors periodic risk assessments and key elements of the vendor management program. Oversees technical security-related research and analysis and translates the results into meaningful input for Privacy and Information Security leadership to ensure effective coordination of privacy and security activities. Ensures adherence to applicable federal and state regulations. Establishes and/or reviews information security policies, procedures, standards, and guidelines to support Sutter Health business initiatives in alignment with regulatory requirements, security best practices, and evolving technologies.
Well defined understanding of risk management from a technology perspective, including detailed knowledge of current hardware, software, and database technologies used for privacy and information security risk management in a healthcare system, including firewalls, encryption, intrusion detection, and other tools.
Solid understanding of current privacy and security policies including applicable state and federal regulations related to Protected Health Information such as National Institute of Standards and Technology (NIST), Health Insurance Portability and Accountability Act/Health Information Technology for Economic and Clinical Health Act (HIPAA/HITECH), Federal Information Procession Standards (FIPS), and other industry related security standards, regulations, and best practices.
Working knowledge of management of an effective privacy program, including training, monitoring, conducting and documenting investigations, addressing violations, and monitoring corrective actions.
Developed project management skills, including the ability to initiate, plan, execute, and control activities to meet requirements and timelines of regional and system-wide initiatives or projects potentially impacted by new or changing regulations.
Business acumen and advanced analytic skills, with the ability to collect data, analyze information, reach practical conclusions, recommend corrective actions, resolve conflicts, and institute effective changes.
Attention to detail, superior problem solving and strategic planning skills the ability to analyze data, identify trends, provide insights to staff and affiliates, and recommend creative and actionable solutions in challenging situations.
Exceptional communication (written/verbal), interpersonal, and presentation skills to explain complex technical or sensitive information clearly and professionally to diverse audiences and all levels of internal and external constituencies.
Proficient computer skills and competency in related software applications for presentations, spreadsheets, and word processing including Microsoft Office Suite (Excel, Power Point, Word, and Project) and relational database management systems.
Manage people, cross-functional teams, and organizational dynamics while overseeing and prioritizing multiple projects simultaneously in a a dynamic and challenging environment.
Work independently, as well as part of a multidisciplinary team, while demonstrating organization skills to efficiently and effectively conduct reviews and assessments within established time-frames and government regulations.
Identify and resolve technical, operational and organizational problems using policies, procedures and department plans.
Foster a collaborative environment, to influence individuals or groups with diverse opinions and to enlist cooperation without direct control/authority.
Negotiate effectively with staff, internal departments, senior management, injured employees, external agencies, and organizations.
Maintain strict confidentiality and ensure the privacy of each patient’s protected health information (phi) as well as the confidentiality of all privacy and risk management data.
Build collaborative relationships with peers, other departments, stakeholders, and external agencies, to achieve regulatory and accreditation compliance.
This position is work from home eligible.
Qualified applicants with arrest and conviction records will be considered for employment. Applicants for specific positions are still required to disclose certain convictions during the application process, and those convictions may also be considered in determining eligibility for employment in accordance with applicable law.
