Vice President, US Privacy and Global Data Protection Officer

Spring Health is actively seeking a VP, Privacy Officer to join our team. Reporting to the General Counsel and partnering with the Security, Product, and Engineering teams, the VP, Privacy Officer will own the US and Global privacy strategy and lead our efforts in maintaining the highest standards of data protection. This is a full-time, remote-friendly position with a preference for candidates in the NYC area, with periodic travel to our NYC headquarters. What you’ll do: Serve as the designated US Privacy and Global Data Protection Officer, providing strategic leadership and vision for the company’s comprehensive privacy and data protection program. Lead and mentor the privacy legal team, including attorneys and privacy paraprofessional, to ensure cohesive US and Global operations. Develop creative and compliant legal strategies to navigate the intersection of healthcare privacy and cutting-edge AI, enabling the business to innovate while managing risk effectively. Architect and scale a comprehensive privacy framework that accommodates Spring Health’s expansion into new international markets while remaining compliant with GDPR, HIPAA, and local regulations. Act as the executive-level advisor on the privacy implications of emerging technologies, including the ethical and regulatory use of AI in clinical settings. Oversee the execution of enterprise-wide privacy risk assessments, ensuring that "Privacy by Design" is a fundamental component of the product development lifecycle. Direct the company’s response strategy for data incidents and breaches, including managing regulatory relationships and notification obligations. Collaborate with the Sales and Customer Success teams to serve as a high-level subject matter expert during complex contract negotiations with Fortune 500 clients. Define and maintain all external and internal privacy policies, ensuring transparency and trust with members, customers, and providers. Partner with the People Team to ensure internal data practices regarding employee information are handled with the same level of rigor as member data. What success looks like in this role: Successfully establish a risk-based governance framework for AI deployment that enables product velocity while maintaining strict privacy standards. Achieve 100% completion of annual HIPAA and global privacy training across the enterprise. Reduce privacy-related friction in the sales cycle by maintaining a comprehensive and updated Trust Center/Knowledge Base for customer inquiries. Implement a scalable, automated Privacy Impact Assessment (PIA) workflow. Successfully navigate and document compliance for two new international market entries within the first year. Maintain a zero-finding status on privacy controls during annual SOC2 Type II and HITRUST audits. What you’ll bring: JD from an accredited law school and active bar membership. 12+ years of legal experience, with at least 8 years in data privacy, security, and healthcare law. Track record of leading privacy teams in a high-growth tech environment. Expertise in HIPAA/HITECH, GDPR, CCPA/CPRA, and familiarity with LGPD or PIPEDA. Certifications such as CIPP/US, CIPP/E, CIPM, CIPT. Strong ability to translate complex legal requirements to non-legal stakeholders. Experience with AI/privacy in regulated settings. A mission-driven mindset for secure and ethical data practices. Base salary 236,250 - 290,000 USD; equity and benefits included. We value diversity and encourage applicants from underrepresented communities. Our privacy policy: https://springhealth.com/privacy-policy/ Spring Health is an equal opportunity employer.

The text above is the employer's original job description, extracted as written. Other details on this page, like salary, responsibilities, and requirements, are interpreted from that text by our system, not values the employer explicitly confirmed, so treat them as our best interpretation rather than verified facts.