Chief Compliance, Privacy & Legal Officer

ProHEALTH Medical Management•New York, NY

22h•$195,000 - $275,000•Onsite

About The Position

The Chief Compliance, Privacy & Legal Officer leads the New York Proton Center’s legal, compliance, privacy, risk management, and insurance functions. The officer advises the CEO, executive leadership, and Board; oversees the organization’s compliance and privacy programs; mitigates organizational risks; and works with leaders to develop practical solutions. The role promotes integrity and accountability and ensures significant concerns are identified, escalated, investigated, and resolved. It also manages relationships with outside legal counsel, insurance brokers, carriers, and other external advisors, and establishes priorities and work plans for the relevant functions. The position requires a high degree of independence and professional judgment. The officer provides legal and strategic counsel; maintains the Compliance & Ethics Program; serves as the HIPAA Privacy Officer; oversees privacy and data protection; reviews and negotiates contracts; maintains risk management and insurance processes; leads or oversees investigations and incident responses; coordinates regulatory affairs; and advises the Board on governance and enterprise risk matters. The role includes protecting confidentiality, attorney-client privilege, and work-product protections.

Requirements

Juris Doctor (J.D.) from an accredited law school.
Admission to practice law in New York State.
At least 5 years of progressively responsible legal, regulatory, compliance, privacy, or related experience; healthcare experience is preferred.
Demonstrated experience leading or overseeing healthcare compliance and/or privacy programs.
Experience advising executives and Boards on complex legal, regulatory, compliance, privacy, governance, and risk matters.
Strong knowledge of healthcare regulation, contracts, and fraud and abuse laws.
Knowledge of HIPAA and healthcare privacy requirements.
Experience overseeing investigations, regulatory inquiries, audits, corrective actions, and remediation.
Strong legal analysis, judgment, negotiation, and risk assessment skills.
Strong contract drafting, negotiation, and management skills.
Knowledge of insurance, risk transfer, and enterprise risk management.
Ability to translate complex legal and regulatory requirements into practical recommendations.
Ability to communicate complex issues clearly and concisely to executives and the Board.
Sound independent judgment, confidentiality, and professional integrity.
Commitment to ethics, accountability, excellence, and the organization’s mission.

Nice To Haves

Additional education or certification in healthcare compliance, privacy, risk management, or a related field.
CHC, CHPC, CCEP, or comparable certification.
Nonprofit governance and regulatory experience.
Healthcare accreditation and regulatory oversight experience.

Responsibilities

Advise the CEO, executive leadership, and Board on significant legal, regulatory, contractual, operational, governance, and strategic matters.
Provide practical legal guidance and advise on legal and regulatory considerations related to strategic initiatives, organizational changes, new programs, technologies, and business arrangements.
Monitor emerging legal and regulatory developments and advise leadership on potential impacts and required actions.
Manage outside counsel, including scope, strategy, performance, and costs.
Set priorities, goals, and work plans for the legal, compliance, privacy, and risk functions.
Maintain, implement, and oversee the Compliance & Ethics Program, related policies and controls, and an annual risk-based work plan.
Maintain and update the Code of Conduct and compliance training for employees, managers, medical staff, and other applicable individuals.
Oversee compliance risk assessments, monitoring, audits, regulatory updates, mitigation, remediation, and corrective actions.
Maintain processes for receiving, reviewing, escalating, investigating, and resolving compliance concerns, employee reports, patient complaints, and incident reports.
Coordinate regulatory responses and required background, exclusion, sanction, and other screenings; identify and address potential conflicts of interest.
Maintain documentation of compliance activities and provide regular compliance reports to leadership and the Board.
Serve as the organization’s HIPAA Privacy Officer and oversee compliance with HIPAA and other applicable privacy and data protection requirements.
Oversee appropriate use, access, disclosure, retention, and protection of protected health information and other sensitive data; advise on data governance and information management.
Lead responses to privacy incidents and potential breaches, including investigation, risk assessment, notification, remediation, and reporting.
Advise on privacy and data protection for new initiatives, products, services, and technologies, including AI, analytics, and cloud services.
Assess vendor and business-arrangement privacy risks and ensure relevant agreements include appropriate privacy, confidentiality, security, and regulatory protections.
Review, draft, negotiate, and oversee organizational contracts and agreements; advise on obligations, risks, and material terms.
Establish contract review, approval, execution, and retention processes, and ensure contracts are documented and maintained.
Negotiate with vendors, service providers, consultants, business partners, and other third parties to protect the organization’s interests.
Partner with Finance, Procurement, Information Technology, Human Resources, Clinical Operations, and other departments on significant contractual matters.
Ensure contracts address applicable legal, compliance, privacy, cybersecurity, insurance, and risk management requirements; advise leadership on obligations, disputes, renewals, and exposure.
Maintain a legal and operational risk management framework for identifying, assessing, mitigating, monitoring, and reporting material risks.
Manage the insurance program with Finance and insurance brokers, including coverage reviews, renewals, certificates of insurance, and risk-transfer strategies.
Advise leadership on insurance coverage, exclusions, deductibles, indemnification obligations, and other risk-transfer considerations; coordinate with brokers, carriers, counsel, and advisors.
Report significant enterprise risks, insurance matters, and mitigation strategies to executive leadership and the Board.
Lead or oversee investigations into compliance, privacy, legal, ethical, regulatory, or other sensitive concerns, including assessment, remediation, follow-up, and documentation.
Coordinate investigations and incident responses with Human Resources, Information Technology, Information Security, Security, executive leadership, and outside counsel as appropriate.
Ensure corrective actions, remediation, and required regulatory reporting are completed; appropriately escalate significant matters to executive leadership and the Board.
Serve as an organizational liaison with governmental, regulatory, accreditation, and oversight agencies as appropriate.
Oversee responses to regulatory inquiries, audits, investigations, subpoenas, corrective action requests, and other formal requests; coordinate regulatory disclosures and reporting obligations.
Advise the Board and relevant committees on legal, regulatory, compliance, privacy, governance, and enterprise risk matters.
Monitor corporate governance requirements and support the Board and executive leadership in meeting legal, fiduciary, compliance, and governance obligations.
Maintain independence and direct access to executive leadership and the Board on significant matters.