Director, Corporate Compliance & Privacy
Gravie · Remote
USD 147,000 to 196,300 per year
Hi, we’re Gravie. Our mission is to create health benefits that actually benefit small and midsize businesses and their employees. Our innovative benefit solutions and services are developed and delivered by a diverse group of unique people. We encourage you to be your authentic self - we like you that way.
ABOUT THE ROLE
We are seeking a Director of Corporate Compliance and Privacy to lead and mature our healthcare compliance and privacy programs. This leader will build and coach two managers, one for compliance and one for privacy, who each lead a team of junior-level professionals. The Director will partner closely with clinical, operational, technology, and business leaders and apply sound judgment in a complex, fast-changing regulatory environment. You will be a trusted advisor who helps the organization deliver care and grow responsibly while protecting health plan members, their data, the organization's integrity, and its reputation.
KEY RESPONSIBILITIES
PROGRAM LEADERSHIP:
- Design, implement, and continuously improve the compliance program in line with the elements of an effective compliance program described in federal guidance (e.g., HHS-OIG), including policies, training, monitoring, auditing, and reporting
- Assess emerging healthcare regulatory and privacy risks and translate them into practical, risk-based controls
- Report regularly to executive leadership and the Board or Compliance Committee on program effectiveness, key risks, and trends
PRIVACY PROGRAM LEADERSHIP:
- Oversee the privacy program, including HIPAA Privacy Rule compliance, state health privacy and consumer data privacy laws, and privacy policies, notices, and training
- Direct privacy incident and breach response in coordination with Security, Legal, and business owners, including risk assessments and required notifications
- Oversee privacy reviews of new products, systems, vendors, and data uses, including privacy impact assessments and business associate agreements
- Oversee the health plan member rights request program, ensuring timely, compliant handling of requests for access, amendment, accounting of disclosures, restrictions, and confidential communications, in accordance with HIPAA and applicable state law.
- Serve as a point of contact for privacy regulators, and work with the Security Officer to align privacy and security controls
TEAM LEADERSHIP:
- Lead, develop, and hold accountable the Compliance Manager and the Privacy Manager, who each manage junior-level team members
- Coach and mentor both managers to build their leadership capability, set clear goals, and develop strong succession pipelines
- Set shared priorities and clear division of work between the compliance and privacy teams, and make sure they coordinate on overlapping issues
- Plan for resourcing, structure, and long-term capability of the function, including a distributed and remote team
CROSS-FUNCTIONAL PARTNERSHIP:
- Build and maintain trusted relationships across the organization
- Embed compliance and privacy considerations early into business processes and decisions as a collaborative partner rather than a gatekeeper
- Influence stakeholders at all levels, including senior executives and clinical leaders, without relying solely on formal authority
ENTERPRISE RISK MANAGEMENT:
- Operate the Compliance and Privacy programs as distinct risk levers within the purview of the Chief Compliance Officer, working in close coordination with Enterprise Risk Management and Internal Audit, and with business leaders, to integrate compliance and privacy risks into the enterprise risk framework.
- Identify and assess compliance and privacy risks and provide them to Enterprise Risk Management for inclusion in the enterprise risk register, coordinating with Internal Audit and business leaders to ensure risks are consistently rated, owned, and addressed.
- Translate risk analysis into clear recommendations and risk-acceptance decisions for senior leadership
JUDGMENT AND DECISION-MAKING:
- Make timely, well-reasoned decisions in ambiguous situations, even when information is incomplete, and clearly communicate the rationale and trade-offs
- Lead internal reviews and investigations, escalate significant matters appropriately, and drive remediation to closure
MONITORING, AUDITING, AND REPORTING:
- Own the enterprise risk-based compliance and privacy auditing and monitoring program, including annual work planning informed by the enterprise risk register, execution, and follow-up, in coordination with Enterprise Risk Management and Internal Audit to avoid duplication and preserve independence
- Oversee hotline and case management, exclusion screening, and corrective action plan tracking through resolution
- Report on all aspects of the Compliance and Privacy programs, including monitoring and audit results, investigations, incidents, and corrective actions
- Establish service level agreements (SLAs) for key compliance and privacy processes and track performance against them
- Develop metrics and dashboards that give leadership meaningful visibility into compliance and privacy health
- Present program results and SLA performance to the Compliance Committee quarterly
- Manage relationships with regulators, external counsel, and auditors as needed
PROJECT AND PROGRAM MANAGEMENT:
- Plan, prioritize, and deliver multiple concurrent compliance and privacy initiatives (e.g., policy overhauls, system implementations, audit remediation, regulatory readiness efforts) on time and within scope
- Set clear milestones, ownership, and status reporting for cross-functional projects
- Apply sound project management practices and tools to coordinate work across a distributed team
QUALIFICATIONS
- Bachelors degree in business or a related field
- 10+ years of professional experience in healthcare compliance, privacy, legal, risk, audit, or a related field
- 5+ years experience building, leading, and coaching teams, including leading managers who in turn lead junior-level staff
- 5+ years of experience and proven ability to build and sustain cross-functional partnerships and influence senior stakeholders, including the ability to explain complex regulatory and privacy topics to non-experts
- Project management experience, evidenced by experience leading and delivering on complex, cross-functional initiatives
- Strong judgment and decisiveness, evidenced by a track record of sound calls under uncertainty and time pressure
- Working knowledge of healthcare regulatory requirements including ERISA, the ACA, the Consolidated Appropriations Act (No Surprises Act, price transparency, MHPAEA), IRS and DOL requirements for HRAs, and state TPA licensing and insurance laws
- Working knowledge of health privacy and security requirements, including HIPAA/HITECH as they apply to business associates, breach notification rules, and state privacy laws
- Experience conducting investigations and performing root cause analysis
PREFERRED
- MBA, JD, or other advanced degree, or certification such as CHC, CHPC, CCEP, CIPP/US, CIPM, CFE, or PMP
- Experience in healthcare or a comparable regulated environment
- Experience leading both compliance and privacy functions, or integrating them under one leader
- Experience scaling a compliance or privacy function in a growing or changing organization
- Familiarity with compliance and privacy technology, analytics, and case management tools
A LITTLE MORE ABOUT US:
- We know healthcare. Our company was founded and is still led by industry veterans who have started and grown several market-leading companies in the space.
- We have raised money from top tier investors who share the same long-term vision as we do of building an industry defining company that will endure over the long run. We are well capitalized.
- Our clients love us. Customer satisfaction rates among employees using Gravie health plans cons