Job Title: Accountable Privacy Executive / Privacy Program Executive – PHIPA/FIPPA/PIPEDANote:Only candidates who have resided in Toronto continuously for the previous 5 years will be considered; occasional travel to client sites in Ontario required)Job Description:We're seeking an Accountable Privacy Executive to hold executive-level accountability for the privacy program across a major digital health transformation engagement. This is a named, signing-authority role — you'll own privacy governance, compliance attestations, and breach management end-to-end for services involving personal health information (PHI).Day-to-Day Responsibilities:Serve as the named Accountable Privacy Executive, holding executive accountability for privacy across all in-scope services, systems, and personnelSign and maintain privacy attestations, declarations, and compliance certifications (Attachment 1 requirements 1.7.15 and 1.7.18), keeping supporting evidence audit-readyEstablish and oversee the privacy governance framework, policies, and operating procedures for PHI collection, use, disclosure, retention, and disposalEnsure ongoing compliance with PHIPA, FIPPA, and PIPEDA, along with provincial privacy/security policiesDirect Privacy Impact Assessments (PIAs), coordinate Threat Risk Assessments (TRAs), and embed privacy-by-design into solution architectureOwn privacy breach and incident management end-to-end — containment, investigation, root cause analysis, remediation trackingChair privacy governance forums; act as single escalation point for privacy risks and decisions between delivery and client stakeholdersAdvise client executives and clinical stakeholders on privacy risk posture and regulatory exposureEmbed privacy obligations into contracts, data sharing agreements, and vendor onboardingOversee privacy training, confidentiality undertakings,



and role-based access governance for all PHI-access resourcesLead privacy audits, self‐assessments, and readiness reviews; respond to regulator and third‐party assurance requests, including IPC reviewsReport privacy program performance, KRIs, incidents, and remediation status to executive sponsorsRequired Qualifications:10+ years in privacy, data protection, or information governance, with robust focus on regulated environments (healthcare, public sector, or consulting)5+ years in an executive or named accountable capacity (CPO, Privacy Director, Accountable Privacy Executive, or equivalent), including signing authority for attestations7+ years hands‐on experience with Canadian privacy legislation — PHIPA, FIPPA, PIPEDA5+ years conducting/overseeing PIAs and coordinating TRAs for enterprise or province‐wide systems5+ years leading privacy breach/incident management, including regulator notification and executive reporting5+ years in consulting or client‐facing advisory roles with executive stakeholder managementDemonstrated accountability track record under contractual/regulatory frameworks5+ years exposure to frameworks such as NIST Privacy Framework, ISO/IEC 27001/27701, HITRUST3+ years working with health information custodians, prescribed entities, or health information network providersActive privacy certification: CIPP/C, CIPM, or CIPTBachelor's degree in Law, Health Informatics, Information Management, Business, Engineering, Technology, Information Systems, or related field (Master's or J.D. a plus)Nice to Have:Consulting experience within the Canadian public healthcare sectorExperience supporting IPC Ontario reviews or prescribed entity triennial reviewsAdditional certifications: CISSP, CISM, CISA, CHPC, or legal qualification in privacy/health lawBilingual proficiency in English and French #J-18808-Ljbffr

📌 Privacy Program Executive – Phipa/Fippa/Pipeda (Toronto)
🏢 United Software Group
📍 Toronto