Privacy Specialist, Privacy Compliance, Access and Freedom of Information Department - Permanent Full-Time (1.0)

Job Description

Ottawa is built on un-ceded Algonquin Anishinaabe territory. The peoples of the Algonquin Anishinabek Nation have lived on this territory for millennia and we honour them and this land. Their culture and presence have nurtured and continue to nurture this land. CHEO also honours all First Nations, Inuit and Métis peoples and their valuable past and present contributions to this land. CHEO is one of the few stand-alone, global leaders in pediatric health and is home to more than 6,500 staff, clinicians, scientists and researchers, as well as volunteers – all of whom work together to help children and youth achieve their best lives. Within its own walls and through partnerships with community providers, CHEO has transformed from a 20th century acute care hospital into a 21st century integrated child and youth health system. Ranked in the top 1% of Canadian hospitals for the digitization of its clinical infrastructure, CHEO combines excellence in clinical care, research, and education to advance seamless care that’s provided where, when, and how it is needed. CHEO’s Research Institute is dedicated to world-class clinical, translational, and basic science research covering a wide range of children’s health concerns. CHEO has been named Canada’s best health-care employer by Forbes in 2024, 2025 and 2026 and is ranked second among Canadian hospitals on its list of Canada’s Best Employers for multiple consecutive years. For the 14th consecutive year in a row, the editors of Canada's Top 100 Employers has recognized CHEO as a top employer in the National Capital Region. Every year CHEO helps more than 500,000 children and youth from Eastern Ontario, western Quebec, Nunavut and Northern Ontario.

Position Summary

The Privacy Specialist plays a critical role in ensuring the protection of identifiable information in accordance with applicable laws in Ontario and Canada (including but not limited to Ontario’s Personal Health Information Protection Act (PHIPA). The Specialist leads the development, implementation, and monitoring of privacy policies, procedures, and practices. The Specialist conducts privacy impact assessments (PIAs), investigates privacy incidents, engages with individuals and organizations to ensure personal rights around data handling are upheld, and supports privacy training and auditing initiatives. Working collaboratively with internal teams, legal and information security colleagues, and external partners, the Specialist promotes a culture of privacy, compliance, and continuous improvement.

Compensation Pay Range

$49.02-$57.65

Main Responsibilities

• Regularly monitor, analyze, interpret, and make recommendations around how the organization can operationalize privacy legislation and related orders, decisions, and guidance from the privacy commissioner.


• Lead the development, revision, and maintenance of privacy policies, procedures, and practices.


• Participate in and contribute to organizational submissions and responses during reviews by the privacy commissioner.


• Develop and enhance standard operating procedures (SOPs) for the calculation and tracking of privacy indicators.


• Consult with supervisors, legal counsel, management, and colleagues to promote and implement privacy policies and practices.


• Investigate privacy incidents and complaints in collaboration with leadership, legal counsel, and other internal and external stakeholders.


• Support root cause analysis and the development of corrective and preventive actions, and review and monitor recommendations related to privacy incidents and breaches.


• Conduct and support PIAs for new or modified programs, systems, and technologies.


• Identify privacy risks and recommend mitigation strategies through a robust PIA process.


• Plan, log, monitor, review, and update PIAs and recommendations in accordance with requirements from the privacy commissioner and with emerging practices.


• Contribute to identifying, logging, and addressing privacy risks in collaboration with internal teams and privacy and/or security committees.


• Identify opportunities to enhance privacy training through ongoing review of orders, decisions, and guidance from the privacy commissioner.


• Provide guidance and support on privacy-related inquiries, initiatives, and training.


• Support the development and implementation of privacy audit plans.


• Analyze trends in audit results and prepare reports on privacy compliance and risks.


• Engage with patients and individuals when exercising their individual rights around data handling and/or ensure individual rights are supported in policies, practices, and procedures.


• Respond to unique access requests not in the domain of another team, such as release of information, and/or freedom of information requests.


• Lead the management of consent collection and the processing of withdrawals of consent, and/or ensure consent requirements are addressed in policies, practices, and procedures.


• Respond to and/or monitor inquiries and complaints about privacy and the handling of identifiable information.


• Lead the submission of required reports and statistics to the privacy commissioner.


• Act as a CHEO privacy representative on internal and external working groups (depending on the role, such as the MyChart User Advisory, Canadian Epic Privacy User Group, Prescribed Person and Prescribed Entity privacy group).


• Perform work in accordance with the provisions of the Occupational Health and Safety Act and Regulations and all CHEO corporate/departmental policies and procedures related to


• Occupational Health and Safety.


• Perform other related duties as required and assigned.

Qualifications

• Bachelor’s Degree in health information management, law, public policy, or a related field (Essential)


• Professional certification in privacy or in information privacy (e.g. CIPP/C from IAPP, CHPS from AHIMA) (Preferred)


• Three (3) years’ experience in privacy, health information, or compliance roles (Essential)


• Strong knowledge of and experience with Ontario’s PHIPA and other applicable privacy legislation (e.g., FIPPA, PIPEDA) (Preferred)


• Experience conducting PIAs and managing privacy breaches (Preferred)


• Strong knowledge of regulatory processes of Ontario’s Information and Privacy Commissioner (Preferred)


• Excellent analytical, communication, and problem‑solving skills (Essential)


• Ability to work independently and collaboratively in a fast‑paced environment (Essential


• Criminal Record Check (Level 1) (Essential)

Effective March 29, 2021, CHEO will conduct a more comprehensive pre‑screening and evaluation process. This process may include more varied and multidimensional testing such as a written test, practical exam, or other assessment. All candidates who meet the essential and preferred qualifications may be tested.

Bilingualism (French/English) will be validated by a language proficiency assessment conducted by a third party provider. Candidates will be required to meet the minimum linguistic profile prior to the date of hire.

Should you require accommodation during any phase in the recruitment process, please contact Human Resources at View email address on apply.j-vers.com. All information received in relation to accommodation will be kept confidential and will be handled in compliance with the Accessibility for Ontarians with Disabilities Act.

CHEO values diversity and is an equal opportunity employer. We are committed to providing an inclusive and barrier‑free work environment, starting with the hiring process and welcome interest from all qualified applicants.

We thank all those who apply, however, only those to be interviewed will be contacted.