Director, Regulatory & Enterprise Risk

FFF Enterprises•Temecula, CA

About The Position

The Director, Regulatory & Enterprise Risk is a senior attorney providing practical regulatory legal counsel across the Company’s pharmaceutical distribution, specialty pharmacy, and related healthcare businesses. Reporting to the General Counsel, the Director serves as a primary regulatory legal resource for business and functional leaders, independently advises on complex regulatory matters, monitors significant legal and regulatory developments, and translates regulatory requirements into practical business guidance. The Director also leads key elements of the Company’s enterprise risk governance process in collaboration with Compliance and other functions, building on the existing annual ERM survey and reporting process. The role requires substantial healthcare or pharmaceutical regulatory experience, sound business judgment, and the ability to advise across multiple regulated business models. Business and functional leaders retain ownership of risks within their areas; ERM provides the framework, aggregation, challenge, and governance process. Compliance continues to administer the existing ERM survey, collect responses, and prepare initial survey-based reporting. The role provides legal guidance across pharmaceutical distribution, controlled substances and specialized products, specialty pharmacy, government healthcare programs, PBM and payer regulation, patient access and reimbursement, 340B, healthcare fraud and abuse, HIPAA and healthcare data, artificial intelligence and emerging technology, and third-party or outsourced activities. The Director coordinates with relevant Legal, Compliance, Licensing, Privacy, Information Security, and business functions. Routine licensing administration remains with the appropriate Compliance or Licensing function, and the Contracts organization continues to manage commercial negotiation and administration of payer and PBM agreements. The Director is expected to maintain a forward-looking regulatory and enterprise-risk function, identify emerging risks, support practical implementation of regulatory requirements, and independently advise on matters within the position’s scope. Significant enterprise risks, material regulatory or enforcement exposure, suspected significant noncompliance, government investigations, novel or unsettled legal issues, major strategic implications, and significant financial or reputational exposure should be escalated as appropriate. The position is performed in a normal office setting. It involves occasional travel and requires the ability to work the hours and days needed to complete essential functions as scheduled. Physical requirements include prolonged computer-screen viewing, extended sitting, and lifting or maneuvering items of at least 20 pounds. Mental demands include learning, concentration, attention to detail, working under pressure, effective teamwork and interaction, discretion, sound judgment, diplomacy, and proactive problem-solving.

Requirements

J.D. from an accredited law school.
Active membership in good standing in at least one U.S. jurisdiction.
Approximately 7–10+ years of relevant healthcare, pharmaceutical, or life-sciences regulatory legal experience.
Meaningful experience advising regulated healthcare or pharmaceutical businesses.
Working knowledge of relevant FDA/FDCA, DSCSA, DEA, pharmacy, CMS and federal healthcare program, fraud-and-abuse, HIPAA/privacy, and related regulatory frameworks.
Ability to advise across multiple regulated business models and recognize matters requiring specialized external expertise.
Strong business judgment and ability to translate complex regulatory requirements into practical operational guidance.
Demonstrated ability to independently advise business leaders and manage sophisticated regulatory matters.
Strong written and verbal communication skills.
Ability to work effectively across Legal, Compliance, Quality, Operations, Finance, Information Technology, and other functions.
Ability to meet the position’s physical requirements, including prolonged computer-screen viewing, extended sitting, and lifting or maneuvering items of at least 20 pounds.
Ability to travel occasionally and work the hours and days required to complete essential functions as scheduled.
Ability to learn, think, concentrate, work under pressure, pay close attention to detail, work as part of a team, interact effectively with coworkers and customers, exercise discretion and judgment, maintain self-control and diplomacy, and proactively find solutions.

Nice To Haves

Experience with pharmaceutical distribution, specialty pharmacy, pharmacy regulation, healthcare reimbursement, or related areas.
ERM, risk-management, or governance experience; this is preferred but not required where the candidate demonstrates strong risk-assessment and program-management capabilities.

Responsibilities

Establish and maintain a structured process to monitor significant regulatory developments, assess applicability and business impact, communicate actionable guidance, identify responsible owners, define implementation requirements and deadlines, track implementation, document material decisions, and escalate significant implementation gaps.
Provide legal advice on federal and state pharmaceutical distribution requirements, including FDA and FDCA requirements, DSCSA, EPCIS and electronic product tracing, authorized trading partners, transaction information, suspect and illegitimate products, saleable returns, verification, serialization, distribution arrangements, storage, shipping, returns, recalls, new products and business models, and manufacturer-distributor relationships.
Advise on Controlled Substances Act and DEA requirements, controlled-substance distribution and storage, specialized products and active pharmaceutical ingredients, and whether proposed products or operational changes trigger additional registrations, licensing, or regulatory requirements; coordinate implementation with Compliance and Licensing.
Provide regulatory legal advice on federal and state pharmacy law, specialty-pharmacy operating models, pharmacy practice and dispensing, prescription processing and transfers, patient intake, shipping and delivery, multistate pharmacy operations, third-party pharmacy-support functions, and new products, services, or workflows.
Advise on CMS, Medicare, Medicaid, Medicare Advantage, government healthcare program participation and program-integrity requirements, OIG developments, exclusion and debarment requirements, and relationships involving federal healthcare programs.
Provide legal guidance on federal and state PBM regulation, pharmacy networks, network-access requirements, participation and termination, payer requirements, reimbursement developments, state PBM reforms, and regulatory implications of payer and reimbursement strategies.
Advise on electronic prior authorization, prior-authorization workflows, benefits verification, patient financial responsibility, cash-pay arrangements, assignment of benefits, patient-assistance and copay-assistance programs, patient-support programs, and applicable No Surprises Act requirements.
Monitor and advise on federal and state 340B developments, manufacturer contract-pharmacy restrictions, rebate and discount models, contract-pharmacy arrangements, and implementation implications of significant legal developments.
Provide legal guidance on healthcare fraud-and-abuse issues, including the federal Anti-Kickback Statute, beneficiary inducement and Civil Monetary Penalty considerations, discounts, rebates, remuneration, patient assistance, referral relationships, and vendor or service arrangements.
Advise on HIPAA Privacy, Security, and Breach Notification requirements; permitted uses and disclosures of protected health information; minimum-necessary standards; authorizations and consent; business associates; third-party and offshore access; healthcare-data sharing; de-identification; secondary data uses; and emerging federal and state health-data privacy requirements.
Coordinate with Corporate & Commercial counsel on contractual data ownership, licensing, technology, and commercial data-rights issues.
Monitor regulatory developments concerning AI and emerging technologies; advise on AI used in distribution, pharmacy, and patient services; assess patient-facing technology and automated workflows; evaluate healthcare-data and privacy implications of vendor AI use; and support AI governance, use-case review, risk assessment, employee guidance, and integration of material AI risks into ERM.
Coordinate with Corporate & Commercial counsel regarding contractual, intellectual-property, and commercial aspects of AI and technology.
Advise on regulatory requirements and implications of third-party, outsourced, delegated, and other external service arrangements, including provider selection, oversight, and use; coordinate diligence, controls, and oversight with Legal, Compliance, Privacy, Information Security, and business stakeholders.
Lead development and maintenance of the ERM framework, methodology, and risk taxonomy; partner with Compliance on the annual ERM survey and reporting; analyze and challenge ratings, trends, and exposures; and conduct management discussions about significant and emerging risks.
Maintain or oversee the enterprise risk register, facilitate assignment of risk owners, track significant mitigation plans and commitments, develop key risk indicators where appropriate, and facilitate periodic risk-owner reviews.
Identify emerging risks using regulatory developments, operational events, claims, compliance findings, quality, financial, cybersecurity, and other enterprise information.
Prepare enterprise risk dashboards and executive-level reporting, support reporting to senior leadership and the Board or appropriate Board committee, and periodically assess ERM maturity and effectiveness and recommend enhancements.
Maintain a forward-looking regulatory horizon and develop an annual Regulatory Priorities Plan and periodic regulatory intelligence reports identifying significant developments, business impacts, required actions, owners, and deadlines.
Conduct targeted regulatory risk reviews, participate early in new-product, new-service, new-vendor, and new-business-model initiatives, and develop guidance, FAQs, decision tools, and training for recurring regulatory questions.
Conduct periodic educational sessions, identify where requirements are evolving faster than Company processes, facilitate risk reviews throughout the year, and develop reporting on changes in exposure, mitigation progress, and issues requiring management attention.
Independently advise on matters within the position’s scope and exercise sound judgment regarding escalation of significant legal, regulatory, enforcement, enterprise, strategic, financial, or reputational matters.