Director, Compliance and Privacy

What You'll Do

• Directly lead and execute the day-to-day operations of the HIPAA privacy program, including personally conducting, documenting, and managing complex breach and privacy incident investigations.
• Oversee the state privacy law program (CCPA/CPRA), ensuring data subject access requests (DSARs) and consent management workflows are executed flawlessly.
• Manage and triage operational volume, logging into intake tools and Slack channels alongside the team to ensure compliance inquiries and incidents are resolved efficiently.
• Provide daily operational guidance and decision-making support to the compliance team, serving as the primary escalation point for ambiguous or complex compliance questions.
• Oversee the clinical and regulatory compliance work-stream, managing billing and coding compliance, state licensure, and health plan contractual obligations.
• Serve as the primary operational interface with legal and compliance colleagues to translate complex legal requirements into practical, live workflows for our clinical and business partners.
• Drive the execution of the annual Compliance Work and Audit Plan to proactively identify, monitor, and remediate potential risks across the business.
• Manage and develop direct reports as the compliance organization scales, fostering a high-performing team culture of accountability and mentorship.

Who You Are

• 7+ years of experience in healthcare compliance or privacy, specifically within a clinical or medical group environment.
• Deep expertise in HIPAA and HITECH, strong working knowledge of state privacy laws like CCPA/CPRA.
• A proven track record as an investigator, with extensive experience managing complex healthcare compliance and privacy intakes from discovery to final disposition.
• A track record of “operationalizing” rules. You don’t just read the law; you build the checklists and workflows that make it work for a busy team.
• High empathy for members and care teams, with the ability to communicate complex rules in a clear and supportive way.
• A “player-coach” mindset - you have the executive presence to command a room, but you genuinely enjoy doing the tactical work and aren’t afraid to dig into ticketing queues and spreadsheets.
• A certification in healthcare compliance (CHC) or privacy (CHPC/CIPP) is strongly preferred.