VP of Compliance and Regulatory

XRHealth•Needham, MA

About The Position

XRHealth is seeking a VP, Compliance and Regulatory to build and lead the company's compliance and regulatory function from the ground up. This senior, cross-functional leadership role is responsible for ensuring XRHealth operates in compliance with healthcare regulatory requirements, data privacy laws, and corporate governance standards across its jurisdictions. The role combines healthcare regulatory expertise—including HIPAA, digital therapeutics and Software as a Medical Device (SaMD) considerations, and telehealth—with international data privacy knowledge and the ability to establish scalable compliance programs for a growing, multi-entity digital health company. The role coordinates and audits regulatory strategy, builds compliance frameworks across three legal entities, and provides compliance reporting to executive leadership and the Board. Responsibilities may evolve as the company and function grow.

Requirements

10+ years of progressive compliance, regulatory affairs, or healthcare legal experience.
At least 3–5 years in a senior leadership role.
Background as a lawyer with a strong grounding in healthcare regulations.
Deep working knowledge of HIPAA and US healthcare regulatory frameworks.
Experience with international data privacy regulation, with GDPR required.
Prior experience in digital health, health tech, medical device, or a comparable regulated industry.
Experience building compliance programs from the ground up in a fast-growing or multi-entity organization.
Strong track record partnering cross-functionally with HR, Legal, Finance, and executive leadership.
Exceptional judgment, discretion, and communication skills.
Comfort operating as both a hands-on builder and a strategic advisor.
Experience working across international and multicultural teams.

Nice To Haves

Familiarity with digital therapeutics/SaMD regulatory considerations.
Experience with Israeli or Australian privacy law.
JD, compliance certification (e.g., CHC, CIPP/E, CIPP/US), or equivalent advanced degree.
Spanish or Hebrew language skills.

Responsibilities

Act as internal auditor and coordinator of XRHealth's regulatory strategy, including monitoring FDA guidance on Software as a Medical Device (SaMD) and digital therapeutics as applicable across operations.
Ensure ongoing HIPAA compliance, including policies, training, risk assessments, and breach response protocols.
Monitor and interpret evolving telehealth and digital health regulations across US states and international markets.
Serve as the primary point of contact for regulatory inquiries, audits, and inspections.
Lead compliance with global data privacy frameworks, including GDPR (Spain/EU), Israeli Privacy Protection Law, Australian Privacy Act, and US state privacy laws.
Partner with IT/Security to maintain data governance policies, vendor risk assessments, and incident response plans.
Oversee cross-border data transfer mechanisms and ensure appropriate safeguards are in place.
Build compliance frameworks across XRHealth's three legal entities.
Partner with People Operations on employment law compliance.
Support M&A due diligence and integration from a compliance and regulatory risk perspective.
Maintain and update company policies, codes of conduct, and compliance training programs, including HIPAA and Cultural Competency training.
Design and implement a scalable, risk-based compliance program appropriate for a growing digital health company.
Establish compliance monitoring, auditing, and reporting cadences to executive leadership and the Board.
Build relationships with outside counsel and external regulatory advisors across jurisdictions.
Develop and manage compliance-related documentation, SOPs, and audit trails.