Corporate Counsel, Privacy and Data Security

agilon health is seeking a strategic privacy and data security attorney to help shape our enterprise approach to responsible data use, healthcare privacy, data governance, and emerging technology.

This is a senior individual contributor role with enterprise-wide visibility. The attorney in this role will serve as a trusted advisor to Legal, Compliance, IT, Security, Product, Clinical, Finance, HR, and business leaders, helping the organization navigate complex privacy, security, healthcare, and technology issues while enabling innovation and scalable growth.

What You’ll Do

• Lead legal guidance for enterprise privacy, data security, and data governance strategy.
• Advise on compliant data collection, use, sharing, retention, classification, and deletion practices involving PHI, healthcare data, consumer data, and business data.
• Partner with cross-functional leaders on product development, analytics, vendor procurement, marketing, data sharing, digital tracking, and technology-enabled healthcare initiatives.
• Develop scalable privacy frameworks, playbooks, policies, guardrails, and practical tools that help the business operate within clear legal boundaries.
• Set legal standards for data protection terms in healthcare and technology agreements, including BAAs, DPAs, SaaS agreements, licensing agreements, information security terms, and vendor agreements.
• Lead or support privacy and data security incident response, including breach analysis, notification strategy, vendor investigations, regulatory filings, and communications with affected parties or regulators.
• Advise on AI governance, responsible AI use, digital health, emerging technology, and evolving regulatory expectations.
• Support regulatory audits, inquiries, and examinations involving privacy, data security, HIPAA/HITECH, state privacy laws, HHS OCR, FTC, CMS, or state attorneys general.

What You’ll Bring

• JD and active license to practice law.
• Typically 8-10+ years of progressively responsible legal experience, with meaningful focus on privacy, data security, healthcare regulatory, technology, or data governance matters.
• Strong knowledge of U.S. privacy and data security laws, including HIPAA/HITECH, CCPA/CPRA, and evolving state privacy laws
• Proven ability to develop and operationalize privacy governance frameworks, policies, playbooks, and scalable processes
• Experience managing a high volume of diverse contract types (services agreements, BAAs, SaaS, NDAs, EULAs, licensing agreements, and similar)
• Experience leading or supporting privacy and data security incident response, including breach analysis, regulatory notification, and vendor investigations
• Experience participating in or supporting regulatory audits or examinations by state or federal regulators

Preferred:

• Prior healthcare regulatory experience, with particular familiarity with Medicare Advantage, CMS requirements, value-based care models, or primary care-oriented healthcare delivery
• Experience supporting technology-enabled healthcare products, data platforms, or digital health initiatives
• Familiarity with AI/ML governance frameworks, algorithmic accountability, and legal considerations related to emerging technologies
• Experience leading privacy program integration following a merger, acquisition, or significant organizational change
• Experience advising on the use of protected health information (PHI) in clinical, operational, analytics, or value-based care contexts

Compensation Note

Salary range shown is a guideline. Individual compensation packages can vary based on factors unique to each candidate, such as skill set, experience, and qualifications.