Privacy Specialist

Join the Texas Health and Human Services Commission (HHSC) and be part of a team committed to creating a positive impact in the lives of fellow Texans. At HHSC, your contributions matter, and we support you at each stage of your life and work journey. Our comprehensive benefits package includes 100% paid employee health insurance for full-time eligible employees, a defined benefit pension plan, generous time off benefits, numerous opportunities for career advancement and more. Explore more details on the Benefits of Working at HHS webpage.

Functional Title: Privacy Specialist

Job Title: Program Specialist VI

Agency: Health & Human Services Comm

Department: OCC Privacy Division

Posting Number: 20802

Closing Date: 09/27/2026

Posting Audience: Internal and External

Occupational Category: Legal

Salary Range: $5,250.00 - $6,250.00

Pay Frequency: Monthly

Salary Group: TEXAS-B-23

Shift: Day

Additional Shift:

Telework: Eligible for Telework

Travel: Up to 5%

Regular/Temporary: Regular

Full Time/Part Time: Full time

FLSA Exempt/Non-Exempt: Exempt

Facility Location:

Job Location City: AUSTIN

Job Location Address: 4601 W GUADALUPE ST

Other Locations:

MOS Codes: 16GX,60C0,611X,612X,63G0,641X,712X,86M0,8U000,OS,OSS,PERS,YN,YNS

Brief Job Description:

The Privacy Specialist (Program Specialist Vl) reports to the HHSC Privacy Director and performs moderately advanced consultative services and technical assistance work for internal and external agency partners during the course of privacy investigations. Work involves leading or participating in investigations of actual or suspected privacy incidents; collecting and validating data for tracking incident trends and identifying opportunities and solutions for risk management and mitigation; researching privacy practices and responses to emerging trends privacy-related issues and problems; providing coordinated responses to regulatory investigations, inquiries, and audits; developing reports and visualizations for leadership; preparing privacy-related trainings and educational materials; and assisting with the development, maintenance, and review of privacy-related manuals, policies, and procedures. This position works under minimal supervision, with considerable latitude for the use of initiative and independent judgment.

Essential Job Functions (EJFs):

• Leads or participates in privacy incident response activities, including triage and investigation, regulatory research, third party contractual obligations, risk assessment, breach determination, remediation, notification, prevention, and analysis. Coordinates with internal and external agency partners to investigate incidents, document investigation findings, and share recommendations. Maintains privacy-related compliance records for federal audits and compiles relevant information for required reporting to federal officials. Validates data and prepares briefing materials for leadership. (40%)
• Provides technical assistance to other program areas to facilitate the implementation of policy or program changes that may be impacted by privacy issues. Plans and conducts detailed, complex research and analyses of privacy complaints, including analysis of compliance with rules, policies, laws, regulations, operational procedures, and policies. Collects, validates, and documents findings, reports, and other information to identify operational trends and potentially emerging operational issues related to privacy and privacy-related issues. Reports relevant changes and their implications to division leadership. Reports privacy breaches to the federal government, as required. (30%)
• Utilizes Archer eGRC and data visualization software to develop reports for leadership. Assists with the development, maintenance, and review of privacy-related manuals, policies, and procedures. Serves as Archer eGRC backup for application development, testing, and production. (20%)
• Researches and monitors current and emerging regulatory requirements related to privacy, including potential implications of statutory or policy changes. Researches and monitors industry best practices in order to make recommendations for the development and improvement of privacy-related processes and activities. (10%)

Knowledge, Skills and Abilities (KSAs):

Knowledge of:

• HHSC divisions, business, and program areas.
• Medicaid, CHIP, SNAP, and TANF.
• Federal and state privacy laws, regulations, and rules (e.g., HIPAA; Texas Identity Theft Enforcement and Protection Act), including applicable reporting and breach notification requirements and timelines.
• Personally Identifiable Information (PII), Protected Health Information (PHI), Sensitive Personal Information (SPI), and other confidential or sensitive information types.
• Privacy incident and breach investigation principles, including incident identification, assessment, documentation, mitigation, and resolution.
• Root cause analysis and corrective action principles.

Skill in:

• Investigating privacy incidents and gathering, reviewing, and evaluating relevant facts and evidence.
• Analyzing complex or incomplete information and identifying privacy risks, compliance concerns, and additional information needed to complete an investigation.
• Preparing professional written communications, investigative summaries, reports, and recommendations.
• Managing multiple investigations and assignments simultaneously while meeting regulatory and organizational deadlines.
• Reviewing and organizing supporting documentation such as emails, policies, procedures, system records, and contractual requirements.
• Maintaining effective working relationships.

Ability to:

• Independently plan, conduct, and document incident investigations from initial report through resolution.
• Exercise sound judgment when facts are incomplete, conflicting, or evolving.
• Identify gaps or inconsistencies in available information and pursue appropriate follow-up.
• Handle confidential and sensitive information with discretion and care.
• Organize complex facts and develop clear, logical, and well-supported conclusions.
• Recognize matters that require escalation to management or other agency partners.
• Prioritize assignments based on risk, regulatory requirements, and established deadlines.
• Adapt to changing facts, priorities, regulatory requirements, and organizational needs.

Registrations, Licensure Requirements or Certifications:

Certified Information Privacy Professional (CIPP/US), Certified Information Privacy Manager (CIPM), or equivalent certification is preferred.

Initial Screening Criteria:

Education: Bachelors degree in a relevant field is preferred.

Experience: Experience performing professional work involving investigation, analysis, compliance, auditing, risk assessment, case review, regulatory review, quality assurance, program policy, legal or policy research, or other work requiring the evaluation of facts, application of standards or requirements, professional judgment, and written documentation of findings, conclusions, or recommendations is required.

Additional Information:

N/A

Review our Tips for Success when applying for jobs at DFPS, DSHS and HHSC.

Active Duty, Military, Reservists, Guardsmen, and Veterans:

Military occupation(s) that relate to the initial selection criteria and registration or licensure requirements for this position may include, but not limited to those listed in this posting. All active-duty military, reservists, guardsmen, and veterans are encouraged to apply if qualified to fill this position. For more information please see the Texas State Auditor's Job Descriptions, Military Crosswalk and Military Crosswalk Guide at Texas State Auditors Office - Job Descriptions.

ADA Accommodations:

In compliance with the Americans with Disabilities Act (ADA), HHSC and DSHS agencies will provide reasonable accommodation during the hiring and selection process for qualified individuals with a disability. If you need assistance completing the on-line application, contact the HHS Employee Service Center at 1-888-894-4747. If you are contacted for an interview and need accommodation to participate in the interview process, please notify the person scheduling the interview.

Pre-Employment Checks and Work Eligibility:

Depending on the program area and position requirements, applicants selected for hire may be required to pass background and other due diligence checks.

HHSC uses E-Verify. You must bring your I-9 documentation with you on your first day of work. Download the I-9 Form

Telework Disclaimer:

This position may be eligible for telework. Please note, all HHS positions are subject to state and agency telework policies in addition to the discretion of the direct supervisor and business needs.