Director, Corporate Compliance & Privacy

Hi, we’re Gravie. Our mission is to create health benefits that actually benefit small and midsize businesses and their employees. Our innovative benefit solutions and services are developed and delivered by a diverse group of unique people. We encourage you to be your authentic self - we like you that way. ABOUT THE ROLE We are seeking a Director of Corporate Compliance and Privacy to lead and mature our healthcare compliance and privacy programs. This leader will build and coach two managers, one for compliance and one for privacy, who each lead a team of junior-level professionals. The Director will partner closely with clinical, operational, technology, and business leaders and apply sound judgment in a complex, fast-changing regulatory environment. You will be a trusted advisor who helps the organization deliver care and grow responsibly while protecting health plan members, their data, the organization's integrity, and its reputation. KEY RESPONSIBILITIES PROGRAM LEADERSHIP: - Design, implement, and continuously improve the compliance program in line with the elements of an effective compliance program described in federal guidance (e.g., HHS-OIG), including policies, training, monitoring, auditing, and reporting - Assess emerging healthcare regulatory and privacy risks and translate them into practical, risk-based controls - Report regularly to executive leadership and the Board or Compliance Committee on program effectiveness, key risks, and trends PRIVACY PROGRAM LEADERSHIP: - Oversee the privacy program, including HIPAA Privacy Rule compliance, state health privacy and consumer data privacy laws, and privacy policies, notices, and training - Direct privacy incident and breach response in coordination with Security, Legal, and business owners, including risk assessments and required notifications - Oversee privacy reviews of new products, systems, vendors, and data uses, including privacy impact assessments and business associate agreements - Oversee the health plan member rights request program, ensuring timely, compliant handling of requests for access, amendment, accounting of disclosures, restrictions, and confidential communications, in accordance with HIPAA and applicable state law. - Serve as a point of contact for privacy regulators, and work with the Security Officer to align privacy and security controls TEAM LEADERSHIP: - Lead, develop, and hold accountable the Compliance Manager and the Privacy Manager, who each manage junior-level team members - Coach and mentor both managers to build their leadership capability, set clear goals, and develop strong succession pipelines - Set shared priorities and clear division of work between the compliance and privacy teams, and make sure they coordinate on overlapping issues - Plan for resourcing, structure, and long-term capability of the function, including a distributed and remote team CROSS-FUNCTIONAL PARTNERSHIP: - Build and maintain trusted relationships across the organization - Embed compliance and privacy considerations early into business processes and decisions as a collaborative partner rather than a gatekeeper - Influence stakeholders at all levels, including senior executives and clinical leaders, without relying solely on formal authority ENTERPRISE RISK MANAGEMENT: - Operate the Compliance and Privacy programs as distinct risk levers within the purview of the Chief Compliance Officer, working in close coordination with Enterprise Risk Management and Internal Audit, and with business leaders, to integrate compliance and privacy risks into the enterprise risk framework. - Identify and assess compliance and privacy risks and provide them to Enterprise Risk Management for inclusion in the enterprise risk register, coordinating with Internal Audit and business leaders to ensure risks are consistently rated, owned, and addressed. - Translate risk analysis into clear recommendations and risk-acceptance decisions for senior leadership JUDGMENT AND DECISION-MAKING: - Make timely, well-reasoned decisions in ambiguous situations, even when information is incomplete, and clearly communicate the rationale and trade-offs - Lead internal reviews and investigations, escalate significant matters appropriately, and drive remediation to closure MONITORING, AUDITING, AND REPORTING: - Own the enterprise risk-based compliance and privacy auditing and monitoring program, including annual work planning informed by the enterprise risk register, execution, and follow-up, in coordination with Enterprise Risk Management and Internal Audit to avoid duplication and preserve independence - Oversee hotline and case management, exclusion screening, and corrective action plan tracking through resolution - Report on all aspects of the Compliance and Privacy programs, including monitoring and audit results, investigations, incidents, and corrective actions - Establish service level agreements (SLAs) for key compliance and privacy processes and track performance against them - Develop metrics and dashboards that give leadership meaningful visibility into compliance and privacy health - Present program results and SLA performance to the Compliance Committee quarterly - Manage relationships with regulators, external counsel, and auditors as needed PROJECT AND PROGRAM MANAGEMENT: - Plan, prioritize, and deliver multiple concurrent compliance and privacy initiatives (e.g., policy overhauls, system implementations, audit remediation, regulatory readiness efforts) on time and within scope - Set clear milestones, ownership, and status reporting for cross-functional projects - Apply sound project management practices and tools to coordinate work across a distributed team QUALIFICATIONS - Bachelors degree in business or a related field - 10+ years of professional experience in healthcare compliance, privacy, legal, risk, audit, or a related field - 5+ years experience building, leading, and coaching teams, including leading managers who in turn lead junior-level staff - 5+ years of experience and proven ability to build and sustain cross-functional partnerships and influence senior stakeholders, including the ability to explain complex regulatory and privacy topics to non-experts - Project management experience, evidenced by experience leading and delivering on complex, cross-functional initiatives - Strong judgment and decisiveness, evidenced by a track record of sound calls under uncertainty and time pressure - Working knowledge of healthcare regulatory requirements including ERISA, the ACA, the Consolidated Appropriations Act (No Surprises Act, price transparency, MHPAEA), IRS and DOL requirements for HRAs, and state TPA licensing and insurance laws - Working knowledge of health privacy and security requirements, including HIPAA/HITECH as they apply to business associates, breach notification rules, and state privacy laws - Experience conducting investigations and performing root cause analysis PREFERRED - MBA, JD, or other advanced degree, or certification such as CHC, CHPC, CCEP, CIPP/US, CIPM, CFE, or PMP - Experience in healthcare or a comparable regulated environment - Experience leading both compliance and privacy functions, or integrating them under one leader - Experience scaling a compliance or privacy function in a growing or changing organization - Familiarity with compliance and privacy technology, analytics, and case management tools A LITTLE MORE ABOUT US: - We know healthcare. Our company was founded and is still led by industry veterans who have started and grown several market-leading companies in the space. - We have raised money from top tier investors who share the same long-term vision as we do of building an industry defining company that will endure over the long run. We are well capitalized. - Our clients love us. Customer satisfaction rates among employees using Gravie health plans consistently rank above 80% – nearly 40 points above the industry average. - Our culture is unique. We tend to be non-hierarchical, merit-driven, opinionated but kind people who thrive working in a high-performance, fast-paced environment. People at Gravie care deeply about making a positive impact in the lives of the people we serve. BENEFITS Our unique benefits program is the gravy, i.e., the special sauce that sets our compensation package apart. In addition to standard health and wellness benefits, Gravie’s package includes alternative medicine coverage, flexible PTO, up to 16 weeks paid parental leave, paid holidays, a 401k program, transportation perks, education reimbursement, and 2 days of paid paw-ternity leave. JOB APPLICANTS If you apply for employment with Gravie, personal information collected via our applicant tracking vendor is subject to our standalone California Job Applicant Notice at Collection, accessible directly within the application workflow and separate from this Policy.