[Hiring] Director of Corporate Compliance and Privacy @Gravie

Role Description

We are seeking a Director of Corporate Compliance and Privacy to lead and mature our healthcare compliance and privacy programs. This leader will build and coach two managers, one for compliance and one for privacy, who each lead a team of junior-level professionals. The Director will partner closely with clinical, operational, technology, and business leaders and apply sound judgment in a complex, fast-changing regulatory environment. You will be a trusted advisor who helps the organization deliver care and grow responsibly while protecting health plan members, their data, the organization's integrity, and its reputation.

Key Responsibilities

• Program Leadership:
  • Design, implement, and continuously improve the compliance program in line with federal guidance.
  • Assess emerging healthcare regulatory and privacy risks and translate them into practical, risk-based controls.
  • Report regularly to executive leadership and the Board or Compliance Committee on program effectiveness, key risks, and trends.
• Privacy Program Leadership:
  • Oversee the privacy program, including HIPAA Privacy Rule compliance and state health privacy laws.
  • Direct privacy incident and breach response in coordination with Security, Legal, and business owners.
  • Oversee privacy reviews of new products, systems, vendors, and data uses.
  • Oversee the health plan member rights request program, ensuring timely handling of requests.
  • Serve as a point of contact for privacy regulators.
• Team Leadership:
  • Lead, develop, and hold accountable the Compliance Manager and the Privacy Manager.
  • Coach and mentor both managers to build their leadership capability.
  • Set shared priorities and clear division of work between the compliance and privacy teams.
  • Plan for resourcing, structure, and long-term capability of the function.
• Cross-Functional Partnership:
  • Build and maintain trusted relationships across the organization.
  • Embed compliance and privacy considerations early into business processes.
  • Influence stakeholders at all levels, including senior executives and clinical leaders.
• Enterprise Risk Management:
  • Operate the Compliance and Privacy programs as distinct risk levers.
  • Identify and assess compliance and privacy risks for inclusion in the enterprise risk register.
  • Translate risk analysis into clear recommendations for senior leadership.
• Judgment and Decision-Making:
  • Make timely, well-reasoned decisions in ambiguous situations.
  • Lead internal reviews and investigations, escalate significant matters appropriately.
• Monitoring, Auditing, and Reporting:
  • Own the enterprise risk-based compliance and privacy auditing and monitoring program.
  • Oversee hotline and case management, exclusion screening, and corrective action plan tracking.
  • Report on all aspects of the Compliance and Privacy programs.
  • Establish service level agreements (SLAs) for key compliance and privacy processes.
  • Develop metrics and dashboards for leadership visibility into compliance and privacy health.
  • Present program results and SLA performance to the Compliance Committee quarterly.
  • Manage relationships with regulators, external counsel, and auditors as needed.
• Project and Program Management:
  • Plan, prioritize, and deliver multiple concurrent compliance and privacy initiatives.
  • Set clear milestones, ownership, and status reporting for cross-functional projects.
  • Apply sound project management practices and tools to coordinate work across a distributed team.

Qualifications

• Bachelors degree in business or a related field.
• 10+ years of professional experience in healthcare compliance, privacy, legal, risk, audit, or a related field.
• 5+ years experience building, leading, and coaching teams.
• 5+ years of experience building and sustaining cross-functional partnerships.
• Project management experience leading complex, cross-functional initiatives.
• Strong judgment and decisiveness under uncertainty and time pressure.
• Working knowledge of healthcare regulatory requirements.
• Working knowledge of health privacy and security requirements.
• Experience conducting investigations and performing root cause analysis.

Preferred

• MBA, JD, or other advanced degree, or certification such as CHC, CHPC, CCEP, CIPP/US, CIPM, CFE, or PMP.
• Experience in healthcare or a comparable regulated environment.
• Experience leading both compliance and privacy functions.
• Experience scaling a compliance or privacy function in a growing organization.
• Familiarity with compliance and privacy technology, analytics, and case management tools.

Benefits

• Alternative medicine coverage.
• Flexible PTO.
• Up to 16 weeks paid parental leave.
• Paid holidays.
• 401k program.
• Transportation perks.
• Education reimbursement.
• 2 days of paid paw-ternity leave.