Client: Supply Ontario – RQ00832
We are seeking a
Senior Privacy Impact Assessment Specialist with extensive experience in healthcare privacy assessments, privacy impact reviews, privacy policies and procedures, data-sharing agreements, and privacy compliance within healthcare and IT environments. The ideal candidate will have strong knowledge of Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), the Freedom of Information and Protection of Privacy Act (FIPPA), privacy-by-design principles, digital health technologies, and information security practices.
The successful candidate will provide privacy subject matter expertise for provincial healthcare and information technology initiatives, conduct privacy impact and threshold assessments, identify and mitigate privacy risks, review data-sharing agreements, and ensure compliance with applicable legal, contractual, and organizational privacy obligations.
Role Snapshot
- Job Title: RQ00832 – Privacy Impact Assessment Specialist – Senior
- Client: Supply Ontario
- Work Location: 525 University Avenue, Toronto, Ontario, Canada
- Work Arrangement: Hybrid – 3 Days Onsite, subject to the Hiring Manager’s discretion
- Estimated Start Date: November 23, 2026
- Estimated End Date: March 31, 2027
- Business Days: 125.00
- Extension: Option to extend for up to an additional 250 business days at the Agency’s discretion
- Hours: 7.25 hours per day, 5 days per week
- Public Sector Experience: Must Have
Must Have
- Minimum 5 years of healthcare experience conducting privacy assessments and reviews for projects of medium to high complexity.
- Minimum 5 years of direct operational-level privacy experience in a healthcare sector, IT environment, or both.
- Minimum 5 years of experience developing privacy policies, procedures, requirements, or controls.
- Minimum 5 years of experience drafting and reviewing privacy requirements for data-sharing agreements.
- Experience with the Personal Health Information Protection Act, 2004 (PHIPA), including requirements for Health Information Network Providers (HINPs) and Electronic Service Providers (ESPs). Experience working with prescribed statuses is considered an asset.
- Familiarity with Application Programming Interface (API) functionality and management.
- Familiarity with Electronic Medical Record (EMR) or Hospital Information System (HIS) infrastructure, design, and data flows.
Description
The purpose of this procurement is to acquire a Senior Privacy Specialist to provide dedicated privacy subject matter expertise to assist with supporting privacy matters related to a number of key Information Technology projects that include, but are not limited to, Provincial Health Services Directory, Electronic Health Record (EHR) initiatives, Provincial Viewers, and Patients before Paperwork initiatives.
The Agency is seeking a Privacy resource to ensure that the Agency maintains compliance with its legal and contractual privacy obligations and builds privacy into the design of projects that involve personal health information (PHI), thus reducing risk for the organization and protecting the trust and privacy of individuals whose PHI we manage.
Required Skills
- Minimum 5 years of direct operational-level privacy experience, preferably in a healthcare sector and/or IT environment.
- Holds an undergraduate or graduate degree in health, policy, IT, security, law, or a related discipline.
- Familiarity with Ontario MD EMR certification.
- Familiarity with EMR or HIS infrastructure, design, and data flows.
Responsibilities
The Senior Privacy Specialist will lead and support various initiatives, including, but not limited to, the following:
- Develop privacy policies and procedures.
- Conduct privacy impact assessments for initiatives of low to high complexity.
- May be required to support investigations of privacy incidents, patient inquiries, and privacy requests of any kind.
- Identify and assess privacy risks.
- Provide privacy advisory support to business teams.
- Lead and/or participate in Agency, regional, or provincial committees or project teams as the privacy Subject Matter Expert.
- Identify privacy requirements.
- Develop strong relationships with various internal and external partners to foster a culture of privacy.
- Respond to information and access requests, consent management requests, complaints or inquiries, appeals, and privacy issues under the Personal Health Information Protection Act, 2004 and the Freedom of Information and Protection of Privacy Act, and provide advice and legislative interpretation.
- Support privacy program projects and activities to improve the efficiency and effectiveness of the Privacy Office.
- Develop and deliver privacy training for the Agency.
- Perform other duties as required.
Desired Skills
- Recognized security certification or designation is an asset.
- Knowledge of technology architecture and infrastructure, digital health solutions and services, enterprise and corporate IT, including information and cybersecurity, is preferred.
Requires Competencies
- Completion of a university undergraduate or master’s degree in health, policy, IT, security, law, or a related discipline.
- Demonstrated knowledge and experience of access and privacy requirements and practices, preferably related to the health and public sectors.
- Excellent knowledge of privacy and security concepts, trends, and issues. This includes an understanding of their impact on business processes, as well as skill in interpreting and communicating principles and compliance requirements.
- Knowledge of and ability to interpret Ontario’s Personal Health Information Protection Act, 2004 (PHIPA).
- Knowledge of and ability to interpret Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA).
- Analytical skills to understand the current and future access and privacy implications of policies, decisions, and business initiatives.
- Thorough understanding of privacy-by-design principles and best practices.
- Experience conducting and/or providing oversight for Privacy Impact Assessments and Privacy Threshold Assessments, including developing privacy requirements, risk mitigation plans, corporate policies, and developing and/or delivering training content.
- Working knowledge of digital health technologies and information security industry standards.
- Ability to excel in a fast-paced and project-focused environment.
- Exceptional analytical and creative problem-solving abilities.
- Good understanding of related disciplines, such as IT system design, policy development (privacy or security), business architecture, legal processes, Freedom of Information administration, business analysis, risk management, and project management.
- Knowledge of Information Technology concepts and processes that impact the protection of personal information, including, but not limited to, Internet tools, system interfaces, information security, information architecture, and data flows.
- Excellent verbal and written communication skills and strong stakeholder engagement skills.
- Strong time-management skills, with the ability to manage tight deadlines and prioritize multiple projects.
Deliverables
The successful candidate will be responsible for the following deliverables:
- Provide privacy consultation on a diverse range of complex, multi-partner health privacy issues and Information Technology (IT) initiatives throughout the product/service development and deployment life cycle.
- Conduct and complete Privacy Threshold Assessments and Privacy Impact Assessments, along with associated documentation.
- Develop and inform privacy risk mitigation plans.
- Create or inform the creation of data flow diagrams and associated privacy controls and compliance requirements.
- Review and advise on agreements, including data-sharing agreements.
- Conduct Privacy by Design reviews of documentation and provide privacy advice related to digital health initiatives.
- Support privacy program activities as assigned.
Additional Terms and Working Conditions
- The term of this Engagement Assignment is 125 business days, with an option to extend for up to an additional 250 business days at the Agency’s discretion.
- The Engagement Assignment may be extended for unused business days at the Agency’s discretion.
- The resource will comply with the Agency’s policies and procedures.
- The resource will be issued an Agency laptop and is expected to provide at least one additional monitor, an external keyboard, and a mouse at their own expense.
- When working from their home location, the resource must have a private office space and is not permitted to work in an open communal space.
- The internet connection must be hard-wired and have suitable bandwidth to support the IT requirements of this role.
- If these conditions cannot be met within the resource’s home office space, the resource will transition to full-time in-office work, and the hybrid option will no longer be available.
- Agency systems cannot be accessed from outside the province of Ontario, and Agency assets, including laptops and related equipment, cannot be removed from the province of Ontario without prior written approval from the Agency.
- Assignment Type: This position is currently listed as Hybrid. The resource under this request will be required to work onsite at the Hiring Manager’s sole discretion.
- Onsite Requirement: 3 days onsite, subject to the Hiring Manager’s discretion.
- Public Sector Experience: Must Have.
How to Apply
If you are interested and your profile matches the requirements, kindly send the required documents to
hrsmss@smsoftconsulting.com by
Thursday, October 29, 2026, at 8:00 AM EST.
Mandatory Documents
- Updated Resume in Word format (Mandatory)
- Skills Matrix and References (Mandatory)
- Expected Hourly Rate (Mandatory)
- Visa Status (Mandatory)
- LinkedIn ID (Mandatory)
Without the mandatory documents, we cannot submit a candidate.
WhatsApp Group
For daily job updates, you can also join our WhatsApp group using the link below:
Join our WhatsApp Group
Email is the best way to reach us. 
