Associate General Counsel, Privacy, Product & AI

Abby Care is building the leading AI-native platform for family-led care, addressing America’s growing care crisis. Millions of family caregivers need support without proper tools, training, or recognition. Abby Care combines clinical oversight with an AI-powered platform to train, enable, and support family caregivers in delivering high-quality care at home. The platform helps health plans and government partners better understand, verify, and improve care in the home, expanding access to care and ensuring effective use of public dollars.

The role of Associate General Counsel, Privacy, Product & AI involves owning Abby Care’s privacy and AI governance programs. Reporting to the General Counsel, this senior, build-and-lead role requires setting program strategy, running day-to-day operations, and serving as a subject matter expert in privacy and AI governance. You will:

• Own Abby Care’s privacy program for both patient data and payor data, including HIPAA compliance, state privacy and consumer health data law compliance, BAA program, data mapping and ROPA, privacy incident response, breach assessment and notification, and individual rights workflows.
• Own Abby Care’s AI governance program, including responsible AI policy suite, AI inventory, AI use case intake and review process, model risk classification, ongoing monitoring, and AI incident response.
• Set regulatory change management strategy across federal and state privacy, health data, and AI law, translating horizon scanning into program and product decisions.
• Lead privacy and data-use terms in payor relationships, including data use agreements, MCO and state Medicaid privacy and security requirements, and payor security diligence.
• Serve as the senior legal partner to Product, Engineering, Operations, and Clinical teams on privacy, AI, and product-regulatory implications of new and existing features.
• Partner with Security and IT on HIPAA Security Rule compliance and security certifications and attestations payors require (e.g., SOC 2, HITRUST).
• Lead privacy and AI incident response, including investigation, breach analysis, regulator and individual notification, and post-incident program remediation.
• Own the privacy and AI sections of the Board package and present privacy and AI risk to the Board of Directors.
• Manage outside privacy and AI counsel relationships, including scope, budget, and quality of work product.
• Hire, develop, and lead the privacy and AI team as it grows.
• Serve as Abby Care’s HIPAA Privacy Officer, and partner with the General Counsel and Compliance leadership on training and awareness programs.

Success Metrics:

In your first six months, you will take full operational ownership of the privacy and AI governance programs, complete a program assessment, set the 12-month work plan, and align the GC and Compliance leadership on it. The AI use case review process will be documented, in operation, and meeting SLAs you set. The BAA program will have a refreshed template, a clear playbook, and a current portfolio.

In your first twelve months, Abby Care's privacy program will operate against documented standards you own, with active monitoring, a current data map, a refreshed BAA portfolio, and a tested incident response workflow. The AI governance program will be operating end-to-end, having reviewed every AI use case in production and in the active product pipeline.

In year two, the privacy and AI programs will run on a predictable cadence, with measurable improvements year over year and meaningful leverage from the growing team. You will be the company's internal authority on healthcare AI deployment, manage the outside privacy counsel relationship directly, and present to the Board of Directors.

Requirements:

• A JD from an accredited law school and active bar membership in good standing in at least one U.S. jurisdiction.
• 8+ years of legal experience, including 6+ years of substantial privacy work and hands-on AI governance experience. In-house experience at a healthcare or healthcare technology company is strongly preferred.
• Deep working command of HIPAA/HITECH and a demonstrated track record of building HIPAA Privacy programs.
• Deep working command of U.S. state privacy and consumer health data laws and the emerging U.S. state AI law landscape.
• A demonstrated track record at a growth-stage organization of building or materially rebuilding at least two of: a HIPAA privacy program, an AI governance program, or end-to-end privacy incident response.
• Experience hiring, developing, and leading lawyers or privacy professionals, or a clear readiness to build and lead a team.
• Strong written communication and the credibility to take and defend a position with executives, the Board, regulators, and outside counsel.
• Comfort operating in a fast-growth environment with imperfect data, parallel priorities, and the need to write the policy yourself before handing it off.

Nice to Have:

• Experience advising on healthcare AI deployment, including FDA SaMD/CDS analysis, clinical decision support governance, patient-facing AI disclosures, and HHS Section 1557 requirements.
• Familiarity with 42 CFR Part 2, the 21st Century Cures Act information blocking rules, and state Medicaid confidentiality requirements.
• Familiarity with NIST AI RMF, ISO/IEC 42001, and other AI assurance frameworks.
• Prior work with state Medicaid agencies, MCOs, or other government payors on privacy or data use matters.
• IAPP certifications (CIPP/US, AIGP, or CIPM).
• A sense of humor and a steady temperament under pressure.