Director, Corporate Compliance & Privacy

Gravie

2d•$147,000 - $196,300

About The Position

Gravie is seeking a Director of Corporate Compliance and Privacy to lead and mature its healthcare compliance and privacy programs. The Director will build and coach two managers—one for compliance and one for privacy—who each lead junior-level professionals. The role partners with clinical, operational, technology, and business leaders, applying sound judgment in a complex and fast-changing regulatory environment. The Director serves as a trusted advisor who helps the organization deliver care and grow responsibly while protecting health plan members, their data, the organization’s integrity, and its reputation. The Director will oversee program design and continuous improvement, including compliance policies, training, monitoring, auditing, reporting, privacy protections, incident response, and member rights requests. The position also leads risk-based auditing and monitoring, investigations and remediation, regulatory relationships, and cross-functional initiatives. It reports program results and service-level performance to the Compliance Committee quarterly and works within the purview of the Chief Compliance Officer, coordinating with Enterprise Risk Management, Internal Audit, and business leaders. Gravie describes its culture as non-hierarchical, merit-driven, opinionated but kind, and suited to people who thrive in a high-performance, fast-paced environment. The company focuses on health benefits for small and midsize businesses and their employees.

Requirements

Bachelor’s degree in business or a related field.
10 or more years of professional experience in healthcare compliance, privacy, legal, risk, audit, or a related field.
5 or more years of experience building, leading, and coaching teams, including leading managers who supervise junior-level staff.
5 or more years of experience building and sustaining cross-functional partnerships and influencing senior stakeholders, including explaining complex regulatory and privacy topics to non-experts.
Project management experience leading and delivering complex, cross-functional initiatives.
Strong judgment and decisiveness, with a track record of sound decisions under uncertainty and time pressure.
Working knowledge of healthcare regulatory requirements, including ERISA, the ACA, the Consolidated Appropriations Act (No Surprises Act, price transparency, and MHPAEA), IRS and DOL requirements for HRAs, and state TPA licensing and insurance laws.
Working knowledge of health privacy and security requirements, including HIPAA/HITECH as they apply to business associates, breach notification rules, and state privacy laws.
Experience conducting investigations and performing root cause analysis.

Nice To Haves

MBA, JD, or another advanced degree, or a certification such as CHC, CHPC, CCEP, CIPP/US, CIPM, CFE, or PMP.
Experience in healthcare or a comparable regulated environment.
Experience leading both compliance and privacy functions, or integrating them under one leader.
Experience scaling a compliance or privacy function in a growing or changing organization.
Familiarity with compliance and privacy technology, analytics, and case management tools.

Responsibilities

Design, implement, and continuously improve the compliance program in line with federal guidance, including policies, training, monitoring, auditing, and reporting.
Assess emerging healthcare regulatory and privacy risks and translate them into practical, risk-based controls.
Report regularly to executive leadership and the Board or Compliance Committee on program effectiveness, key risks, and trends.
Oversee the privacy program, including HIPAA Privacy Rule compliance, state health privacy and consumer data privacy laws, and privacy policies, notices, and training.
Direct privacy incident and breach response with Security, Legal, and business owners, including risk assessments and required notifications.
Oversee privacy reviews of new products, systems, vendors, and data uses, including privacy impact assessments and business associate agreements.
Oversee the health plan member rights request program, ensuring compliant and timely handling of access, amendment, accounting of disclosures, restriction, and confidential communication requests.
Serve as a point of contact for privacy regulators and work with the Security Officer to align privacy and security controls.
Lead, develop, and hold accountable the Compliance Manager and Privacy Manager, who each manage junior-level team members.
Coach and mentor both managers, set clear goals, and develop leadership capability and succession pipelines.
Set shared priorities and divisions of work between compliance and privacy teams, ensuring coordination on overlapping issues.
Plan the function’s resourcing, structure, and long-term capability, including for a distributed and remote team.
Build and maintain trusted relationships across the organization, embedding compliance and privacy considerations early in business processes and decisions.
Influence stakeholders at all levels, including senior executives and clinical leaders, without relying solely on formal authority.
Coordinate the Compliance and Privacy programs with Enterprise Risk Management, Internal Audit, and business leaders, integrating risks into the enterprise risk framework.
Identify and assess compliance and privacy risks for the enterprise risk register, coordinating consistent risk ratings, ownership, and response.
Translate risk analysis into clear recommendations and risk-acceptance decisions for senior leadership.
Make timely, well-reasoned decisions in ambiguous situations and communicate the rationale and trade-offs.
Lead internal reviews and investigations, appropriately escalate significant matters, and drive remediation to closure.
Own the enterprise risk-based compliance and privacy auditing and monitoring program, including annual risk-informed work planning, execution, and follow-up, while coordinating with Enterprise Risk Management and Internal Audit to avoid duplication and preserve independence.
Oversee hotline and case management, exclusion screening, and corrective action plan tracking through resolution.
Report on compliance and privacy program activities, including monitoring and audit results, investigations, incidents, and corrective actions.
Establish service level agreements for key compliance and privacy processes and track performance against them.
Develop metrics and dashboards that provide leadership visibility into compliance and privacy health.
Present program results and service-level performance to the Compliance Committee quarterly.
Manage relationships with regulators, external counsel, and auditors as needed.
Plan, prioritize, and deliver concurrent compliance and privacy initiatives on time and within scope.
Set milestones, ownership, and status reporting for cross-functional projects.
Apply project management practices and tools to coordinate work across a distributed team.