Associate General Counsel – Privacy Greater Asheville, NC Area

Aeroflow Health – Associate General Counsel - Privacy

Aeroflow Health is a national leader in home medical equipment and clinical services. We combine technology, operational excellence, and compassionate expertise to deliver essential products and care directly to patients’ homes. At Aeroflow Health, we make healthcare accessible by taking a wholistic approach to how we care for our patients.

We are equally passionate about taking care of our employees. Recognized as one of the fastest-growing healthcare companies in the U.S., an Inc. 5000 honoree, and a certified Great Place to Work®, Aeroflow continues to seek ways they can be one of the nation’s top employers. As we continue to grow, we remain committed to building an exceptional workplace where talented professionals are empowered, supported, and inspired to make a meaningful impact every day.

The Opportunity

The Associate General Counsel – Privacy is the principal legal architect responsible for the strategy, governance, and management of Aeroflow Health’s enterprise privacy program. Reporting directly to the general Counsel, this leader evaluates privacy and data protection requirements, advises executive and business leaders, and translates regulatory obligations into an effective program across business units and applicable subsidiaries. The role also serves as the designated HIPAA Privacy Officer for entities identified by the Company and directs the personnel and resources supporting the program. This position sets program priorities, establishes decision and escalation standards, and oversees implementation. Designated privacy or operational personnel handle routine privacy complaint intake and patient communications, with significant or complex matters escalated to this attorney for legal evaluation and direction.

Your Primary Responsibilities

Enterprise privacy strategy and program management

• Establish and execute a multiyear privacy strategy, annual work plan, and governance framework aligned with Aeroflow’s risk profile, growth plans, and business objectives.
• Direct privacy program operations, personnel, and external resources; recommend staffing, budget, technology, and other investments to the General Counsel.
• Set enterprise privacy policies, accountability standards, and performance measures; oversee implementation, training, monitoring, and corrective action through designated staff and business owners.
• Lead privacy risk assessments and prioritize remediation across business units, subsidiaries, acquisitions, and new services; report material risks and resource needs to leadership.

Regulatory evaluation and executive counsel

• Interpret HIPAA, HITECH, applicable state privacy and consumer health data laws, and other relevant requirements; determine applicability to entities, services, data flows, and proposed activities.
• Evaluate legislative, regulatory, enforcement, and litigation developments; assess business impact and direct appropriate changes to policies, systems, contracts, and operating practices.
• Provide legal advice to the General Counsel, executive leadership, and business leaders on complex privacy issues, regulatory exposure, and risk mitigation options.
• Establish privacy requirements for strategic initiatives, acquisitions, new markets, and products; communicate recommendations and unresolved risks clearly to decision makers.

Data governance and technology

• Set privacy review standards for AI, tracking technologies, marketing, analytics, patient portals, vendors, and data sharing; provide legal evaluation of significant or novel uses before implementation.
• Advise on consent, authorizations, de-identification, permitted data uses, retention, and secondary use; partner with IT, Security, and data leaders to embed requirements into systems and workflows.
• Lead negotiation of material privacy and data protection terms, including business associate agreements, and establish standards for vendor privacy diligence and contracting.

Incident oversight and regulatory response

• Direct legal evaluation of significant privacy incidents, breach risk assessments, and notification obligations; oversee investigation strategy, mitigation, and remediation with the General Counsel and incident response leaders.
• Establish escalation criteria for complaints and incidents; advise on complex or systemic matters referred by designated privacy contacts and evaluate trends for enterprise risk.
• Oversee the accuracy and timeliness of required notices and regulatory responses; manage privacy regulatory inquiries and coordinate outside counsel under the General Counsel’s direction.

Program accountability and leadership

• Establish and oversee processes for patient rights requests and complaint resolution, including designated operational contacts, response standards, documentation, and escalation procedures.
• Direct privacy personnel and business owners in implementing policies, training, monitoring, and remediation; evaluate effectiveness through metrics and targeted reviews.
• Partner with the Head of Audit and Compliance on independent assurance and shared risks, and with the Security Officer on safeguards and security risk assessments.
• Provide regular reporting to the General Counsel and executive leadership, and board or committee reporting as appropriate, on program maturity, emerging risks, incidents, and remediation.
• Employee has an individual responsibility for knowledge of and compliance with laws, regulations, and policies.
• Compliance is a condition of employment and is considered an element of job performance.
• Maintain HIPAA/patient confidentiality.

Skills for Success

• Juris Doctor (JD) from an accredited law school required. Active bar membership in good standing in at least one U.S. jurisdiction and eligibility to practice as in-house counsel in the applicable jurisdiction.
• At least eight years of relevant legal experience, including substantial healthcare privacy counseling and demonstrated leadership of a privacy program or significant privacy initiatives.
• Deep knowledge of HIPAA and applicable federal and state privacy requirements; proven ability to evaluate regulatory applicability and translate complex requirements into business decisions and program strategy.
• Experience directing privacy risk assessments, incident evaluation, regulatory responses, vendor negotiations, and implementation of privacy controls.
• Strong executive judgment, communication, and management skills; ability to influence leaders, develop staff, prioritize resources, and oversee work across multiple business functions.

You might also have

• Experience with DME, telehealth, digital health, multistate healthcare operations, acquisitions, or enterprise privacy program development.
• Experience evaluating AI, tracking technologies, consumer health data, and complex data sharing arrangements.
• CHPC, CIPP/US, or CIPM certification.

What we look for

We are looking for high motivated talented individuals who have the ability…

• What are you looking for someone to bring to the team – what adjectives describe this person?
• Motivated, outside of the box thinker, talented, strong will, team work, etc.
• What can the candidate expect as far as the team environment is concerned?
• Autonomy, training, growth opportunities, etc.

What Aeroflow Offers

Competitive Pay, Health Plans with FSA or HSA options, Dental, and Vision Insurance, Optional Life Insurance, 401K with Company Match, 12 weeks of parental leave for birthing parent/ 4 weeks leave for non-birthing parent(s), Additional Parental benefits to include fertility stipends, free diapers, breast pump, Paid Holidays, PTO Accrual from day one, Employee Assistance Programs and SO MUCH MORE!!

Here at Aeroflow, we are proud of our commitment to all of our employees. Aeroflow Health has been recognized both locally and nationally for the following achievements:

• Family Forward Certified
• Great Place to Work Certified
• 5000 Best Place to Work award winner
• HME Excellence Award
• Sky High Growth Award

If you’ve been looking for an opportunity that will allow you to make an impact, and an organization with unlimited growth potential, we want to hear from you!

Aeroflow Health is an equal opportunity employer that is committed to diversity and inclusion in the workplace. We prohibit discrimination and harassment of any kind based on race, color, sex, religion, sexual orientation, national origin, disability, genetic information, pregnancy, or any other protected characteristic as outlined by federal, state, or local laws.

We value transparency and candidate safety throughout the hiring process. Aeroflow recruiters may reach out through platforms such as LinkedIn or Indeed; however, all interviews and/or offer coordination and sensitive information requests will occur only through our official communication channels. You will never be asked to provide personal data outside our secure application portal, and all interview or offer details will come from an @aeroflowinc.com email address. We do not conduct interviews via text message or instant-messaging apps. If you have concerns, please contact our Talent Acquisition team for verification