Chief Compliance, Privacy & Legal Officer

ProHEALTH Medical Management•New York, NY

About The Position

The Chief Compliance, Privacy & Legal Officer leads New York Proton Center’s legal, compliance, privacy, risk management, and insurance functions. The officer advises the CEO, executive leadership, and Board; maintains and oversees the compliance and privacy programs; mitigates organizational risks; and partners with leaders on practical solutions. The role promotes integrity and accountability and ensures significant concerns are identified, escalated, investigated, and resolved. It manages relationships with outside legal counsel, insurance brokers, carriers, and other external advisors, and establishes priorities and work plans for the organization’s legal, compliance, privacy, and risk functions. The position exercises a high degree of independence and professional judgment. The officer serves as a trusted legal and strategic advisor; oversees the Compliance & Ethics Program and HIPAA privacy function; and directs contract review, negotiation, and management. The role leads or oversees investigations and incident responses, regulatory engagement, risk management, and insurance matters, and advises the Board on governance and enterprise risks. It supports the appropriate protection of confidentiality, attorney-client privilege, and work-product protections.

Requirements

Juris Doctor (J.D.) from an accredited law school.
Admission to practice law in New York State.
At least 5 years of progressively responsible legal, regulatory, compliance, privacy, or related experience; healthcare experience is preferred.
Demonstrated experience leading or overseeing healthcare compliance and/or privacy programs.
Experience advising executives and Boards on complex legal, regulatory, compliance, privacy, governance, and risk matters.
Strong knowledge of healthcare regulation, contracts, and fraud and abuse laws.
Knowledge of HIPAA and healthcare privacy requirements.
Experience overseeing investigations, regulatory inquiries, audits, corrective actions, and remediation.
Strong legal analysis, judgment, negotiation, and risk assessment skills.
Strong contract drafting, negotiation, and management skills.
Knowledge of insurance, risk transfer, and enterprise risk management.
Ability to translate complex legal and regulatory requirements into practical recommendations.
Ability to communicate complex issues clearly and concisely to executives and the Board.
Sound independent judgment, confidentiality, and professional integrity.
Commitment to ethics, accountability, excellence, and the organization’s mission.

Nice To Haves

Additional education or certification in healthcare compliance, privacy, risk management, or a related field.
CHC, CHPC, CCEP, or comparable certification.
Nonprofit governance and regulatory experience.
Healthcare accreditation and regulatory oversight experience.

Responsibilities

Advise the CEO, executive leadership, and Board on significant legal, regulatory, contractual, operational, governance, and strategic matters.
Provide practical legal guidance that supports organizational objectives while managing risk, and advise on legal and regulatory implications of strategic initiatives, organizational changes, programs, technologies, and business arrangements.
Monitor emerging legal and regulatory developments and advise leadership on their potential impacts and required actions.
Manage outside counsel, including scope, strategy, performance, and costs for specialized matters, litigation, investigations, and regulatory issues.
Set priorities, goals, and work plans for legal, compliance, privacy, and risk functions while protecting confidentiality, attorney-client privilege, and work-product protections.
Maintain, implement, and oversee the Compliance & Ethics Program, including its policies, controls, annual work plan, and Code of Conduct.
Oversee compliance risk assessments, monitoring, audits, regulatory updates, mitigation, remediation, and corrective actions.
Maintain independent processes for receiving, reviewing, escalating, investigating, and resolving compliance concerns, employee reports, patient complaints, and incident reports.
Coordinate regulatory responses and required background, exclusion, sanction, and other screenings for applicable individuals.
Identify, review, and address potential conflicts of interest involving outside relationships and activities.
Maintain compliance training for employees, managers, medical staff, and other applicable individuals; promote ethical conduct and maintain documentation and regular compliance reporting.
Serve as the organization’s HIPAA Privacy Officer and oversee compliance with HIPAA and other applicable privacy and data protection requirements.
Oversee the use, access, disclosure, retention, and protection of protected health information and other sensitive data; advise on data governance and information management.
Lead responses to privacy incidents and potential breaches, including investigation, risk assessment, notification, remediation, and reporting.
Advise on privacy and data protection considerations for initiatives, products, services, and technologies, including AI, analytics, and cloud services.
Assess vendor and business-arrangement privacy risks and ensure appropriate protections in third-party and business associate agreements.
Review, draft, negotiate, and oversee organizational contracts and agreements; advise on contractual obligations and material terms.
Establish contract review, approval, execution, and retention processes and ensure contracts are documented and maintained.
Negotiate with vendors, service providers, consultants, business partners, and other third parties to protect the organization’s legal and financial interests.
Partner with Finance, Procurement, Information Technology, Human Resources, Clinical Operations, and other departments on significant contractual matters.
Ensure contracts address applicable legal, compliance, privacy, cybersecurity, insurance, and risk management requirements; advise on significant obligations, disputes, renewals, and exposure.
Maintain a legal and operational risk management framework for identifying, assessing, mitigating, monitoring, and reporting material risks.
Manage the insurance program with Finance and insurance brokers, including coverage review, renewals, certificates of insurance, and risk-transfer strategies.
Advise leadership on insurance coverage, exclusions, deductibles, indemnification obligations, and risk-transfer considerations; coordinate with brokers, carriers, counsel, and other advisors.
Report significant enterprise risks, insurance matters, and mitigation strategies to executive leadership and the Board.
Lead or oversee investigations involving compliance, privacy, legal, ethical, regulatory, or other sensitive concerns, including assessment, remediation, follow-up, and documentation.
Coordinate investigations and incident responses with Human Resources, Information Technology, Information Security, Security, executive leadership, and outside counsel as appropriate.
Ensure corrective actions, remediation, and required regulatory reporting are completed; oversee escalation of significant matters to executive leadership and the Board.
Serve as an organizational liaison with governmental, regulatory, accreditation, and oversight agencies on legal, compliance, privacy, and regulatory matters.
Oversee responses to regulatory inquiries, audits, investigations, subpoenas, corrective action requests, and other formal requests; coordinate required disclosures and reporting.
Advise the Board and relevant committees on legal, regulatory, compliance, privacy, governance, and enterprise risk matters.
Monitor corporate governance requirements and support the Board and executive leadership in meeting legal, fiduciary, compliance, and governance obligations.
Maintain independence and direct access to executive leadership and the Board on significant matters.