Compliance Manager

UpDoc•San Francisco, CA

61d•Remote

About The Position

At UpDoc, we are building the first clinically validated, physician-supervised AI agent that manages chronic diseases. We are an early-stage startup founded by Stanford physicians. We are seeking a Compliance Manager to build and manage the compliance foundation that enables UpDoc to develop, deploy, and scale our technology responsibly. Compliance is central to how we earn the trust of health systems, regulators, payers, and patients while operating at the frontier of what software is permitted to do in medicine. This is a remote role, with candidates preferred to be physically located in the San Francisco Bay Area.

Requirements

8+ years of healthcare compliance experience, with at least 3 years in a leadership or program-owner role.
Experience working with FDA-regulated software or digital health products, with a strong understanding of SaMD quality systems and post-market obligations.
Deep working knowledge of HIPAA Privacy and Security Rules and experience negotiating BAAs with health systems.
Experience supporting SOC 2, HITRUST, or comparable healthcare security and compliance frameworks.
Familiarity with Medicare care management reimbursement compliance and healthcare fraud and abuse law.
Track record of building programs from an early stage rather than solely administering mature ones.
Ability to translate regulation into pragmatic guidance for engineers, clinicians, and executives, and to hold a firm line when it matters.

Nice To Haves

Experience at a digital health or clinical AI company selling into large health systems or academic medical centers.
Exposure to federal research compliance, including NIH, ARPA-H, or similar federally funded programs.
Familiarity with AI-specific regulatory developments, including FDA guidance on AI-enabled device software and predetermined change control plans.
Certification such as CHC, CHPC, CIPP/US, or RAC.
JD, MPH, MHA, or equivalent graduate training; a clinical background is a plus.

Responsibilities

Partner with our Regulatory and Quality team where enterprise compliance requirements intersect with UpDoc’s FDA-regulated product and quality system.
Ensure broader compliance policies and processes align with established regulatory and quality requirements.
Support cross-functional compliance considerations as UpDoc expands its products, clinical programs, partnerships, and reimbursement models.
Serve as the HIPAA Privacy Officer and coordinate closely with the Security Officer on our HIPAA Security program.
Own Business Associate Agreements, minimum-necessary practices, and breach assessment and notification procedures, and partner with Security and Engineering on data flow documentation.
Partner with Security on SOC 2 Type II and HITRUST readiness and lead compliance responses to health system vendor risk assessments.
Advise on applicable federal and state privacy requirements, including HIPAA, CCPA/CPRA, and emerging health data privacy laws.
Build the compliance framework for applicable care management, remote monitoring, and other reimbursement pathways, including documentation, supervision, and time-tracking requirements.
Assess arrangements with health systems, clinicians, and partners under the Anti-Kickback Statute, Stark Law, and beneficiary inducement rules, working with outside counsel.
Maintain Corporate Practice of Medicine compliance across the states in which we operate.
Establish and oversee compliance requirements for clinician credentialing, licensure, scope of practice, and supervision, in partnership with Clinical Operations.
Ensure care delivered through UpDoc is appropriately documented, escalated, and audited to meet UpDoc's clinical governance standards and the requirements of partner health systems.
Support compliance for federally funded research and grant programs, including human subjects protections, IRB coordination, data management requirements, and cost allowability.
Maintain conflict of interest and research integrity policies.
Write, maintain, and train the company on policies and procedures; lead the annual compliance risk assessment and work plan.
Establish compliance training, reporting mechanisms, and an audit and monitoring cadence.
Prepare regular compliance and risk reporting for the CEO and Board.
Serve as the primary compliance counterpart to customer legal, privacy, and IT security teams during contracting and implementation.
Coordinate with outside counsel, auditors, and specialized advisors as needed.