Job Title: Senior Privacy Specialist
Location: Toronto, Ontario, Hybrid
Duration: Contract to March 31, 2027, with potential extension
Key Responsibilities:
Our client is seeking an experienced Senior Privacy Specialist to provide privacy subject matter expertise supporting complex digital health and Information Technology initiatives involving personal health information (PHI).
The successful resource will provide privacy consultation throughout the product and service development and deployment lifecycle, helping ensure privacy requirements are identified, risks are appropriately addressed, and privacy-by-design principles are incorporated into digital health initiatives.
- Conduct Privacy Impact Assessments and Privacy Threshold Assessments for low to high-complexity initiatives.
- Provide privacy consultation on complex, multi-partner digital health and IT initiatives.
- Identify and assess privacy risks and develop appropriate risk mitigation plans.
- Develop privacy policies, procedures, requirements, and controls.
- Draft and review privacy requirements for data sharing agreements.
- Review agreements and provide privacy advice related to data sharing.
- Create or contribute to data-flow diagrams and identify associated privacy controls and compliance requirements.
- Conduct Privacy by Design reviews and provide privacy advice throughout project lifecycles.
- Provide advice and legislative interpretation related to PHIPA and FIPPA.
- Provide privacy advisory support to business and project teams.
- Support privacy incidents, patient inquiries, complaints, consent management matters, and other privacy requests as required.
- Participate in regional, provincial, and organisational committees or project teams as the Privacy Subject Matter Expert.
- Build relationships with internal and external partners to foster a strong culture of privacy.
- Develop and deliver privacy training.
- Support broader privacy programme initiatives and activities.
What you must bring to this role:
- Minimum 5 years of healthcare experience conducting privacy assessments and reviews on medium-to-high complexity projects.
- Minimum 5 years of direct, operational-level privacy experience within a health sector and/or IT environment.
- Minimum 5 years of experience developing privacy policies and procedures, privacy requirements, or privacy controls.
- Minimum 5 years of experience drafting and reviewing privacy requirements for data sharing agreements.
- Familiarity with Application Programming Interface (API) functionality and management.
- Familiarity with Electronic Medical Record (EMR) or Hospital Information System (HIS) infrastructure, design, and data flows.
- Strong understanding of privacy-by-design principles and privacy/security concepts.
- Excellent analytical, written, and verbal communication skills.
- Strong stakeholder engagement skills with the ability to manage multiple priorities and tight deadlines.
Assets:
- Demonstrated experience with Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), including requirements relating to Health Information Network Providers (HINPs) and Electronic Service Providers (ESPs).
- A university undergraduate or graduate degree in health, policy, IT, security, law, or a related discipline.
- Experience working with prescribed statuses under PHIPA.
- Familiarity with OntarioMD EMR certification.
- Recognised security certification or designation.
- Knowledge of technology architecture and infrastructure, digital health solutions, enterprise IT, information security, and cyber security.
- Knowledge of Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA).
Deliverables:
- Privacy consultation on complex, multi-partner health privacy and IT initiatives.
- Completed Privacy Threshold Assessments and Privacy Impact Assessments with associated documentation.
- Privacy risk mitigation plans.
- Data-flow diagrams and associated privacy controls and compliance requirements.
- Privacy reviews and advice relating to data sharing agreements.
- Privacy by Design reviews and recommendations for digital health initiatives.
- Additional privacy programme activities as assigned.
Contract Details:
- Start Date: November 23, 2026
- Current End Date: March 31, 2027
- Initial Allocation: 125 business days
- Extension: Option to extend for up to an additional 250 business days
- Work Arrangement: Hybrid, with onsite attendance required at the Hiring Manager’s discretion
- Location: Toronto, Ontario
Only those who meet the mandatory qualifications will be contacted.
How to Apply
If you are an experienced Senior Privacy Specialist with substantial healthcare privacy experience, please submit your resume clearly outlining how, where, and when you acquired the experience relevant to the mandatory requirements above.
Your resume should specifically demonstrate your experience with healthcare privacy assessments, operational privacy, privacy policies and controls, data sharing agreements, PHIPA/HINP/ESP requirements, APIs, and EMR/HIS environments, including dates and sufficient project detail to substantiate the required years of experience.
Robertson values diversity and is committed to creating an inclusive workplace. We invite all qualified individuals to apply.
