Senior Counsel - Data Governance, Privacy and Cybersecurity

Our team members are at the heart of everything we do. At Cencora, we are united in our responsibility to create healthier futures, and every person here is essential to us being able to deliver on that purpose. If you want to make a difference at the center of health, come join our innovative company and help us improve the lives of people and animals everywhere.

Apply today!

Cencora is seeking a Corporate Counsel II (Senior Counsel) with experience advising and providing strategic leadership in data governance, privacy, cybersecurity, and AI as they apply to our Managed Services Organization (“MSO”), which serves clinical practice groups in the retinal space across the United States.

This role reports to the Assistant General Counsel, Privacy, Responsible Data, & Technology within Cencora’s legal team and serves as a key legal resource to MSO legal and business teams on the design, launch, and operation of MSO technology-based services, including the collection, use, sharing, and protection of sensitive health information and other regulated data.

This role requires an energetic, agile legal expert who will collaborate closely with our MSO medical professional teams, clinical operations, product/technology experts, information security, compliance, and commercial teams to enable MSO offerings while managing risk in a highly regulated healthcare environment.

The successful candidate will deliver business-oriented legal services and project management across MSO initiatives, including conducting privacy-by-design and security-by-design reviews; analyze prospective and retrospective research protocols from privacy and technology law angles; review and enable prioritized data sharing and interoperability arrangements; evaluate and drive AI projects and governance; and ensure incident response readiness and swift mitigation response for MSO platforms and associated vendor ecosystems.

Primary Duties and Responsibilities:

• Serve as a key counsel for MSO data governance, privacy, AI, and cybersecurity matters, including advising on MSO data flows and operating models; the use and protection of PHI and other sensitive data; and compliance with applicable U.S. federal and state privacy and security requirements (e.g., HIPAA/HITECH and state consumer health privacy laws, as applicable).
• Counsel MSO business owners on privacy, security, and AI requirements for new and existing MSO offerings, including product counseling for MSO platforms, analytics, care/therapy services support, population health insights, and other data-enabled services.
• Draft, review, and negotiate MSO-facing privacy and security contractual terms, including BAAs, DPAs, data sharing agreements, service agreements, and vendor/partner security addenda; advise on third-party risk management, subcontractor flow-downs, and MSO client requirements.
• Partner with MSO information security and technology teams to support MSO security program needs (e.g., NIST-aligned controls, HITRUST/ISO considerations where required).
• Assist in MSO incident response preparedness and legal support; advise on breach assessment and notification obligations; and coordinate with privacy, security, compliance, communications professionals, and client teams on incident-related MSO client, patient, and/or regulatory communications.
• Support MSO governance and reporting, and assist in responses to MSO client audits, questionnaires, and regulatory inquiries relating to privacy and cybersecurity representations.
• Establish and maintain strong relationships and clear escalation paths with MSO stakeholders (clinical/medical, operations, product/engineering, security, compliance, commercial, and other legal and compliance colleagues) to drive consistent, scalable…