Compliance Manager

About the role

This role serves as the organization's Compliance Officer and Privacy Officer, reporting to the Chief Operations Officer and General Counsel. The Manager is responsible for developing, implementing, and overseeing the organization's comprehensive compliance and privacy program across international and national programs to ensure compliance with GDPR, HIPAA, applicable State regulations, and the OIG Seven Elements of an Effective Compliance Program. This position serves as the primary point of contact for all compliance and privacy matters including patient rights, workforce training, policy enforcement, breach response, investigations, and internal auditing.

Responsibilities

• Privacy & Compliance Program Leadership: Develop, implement, and oversee comprehensive compliance and privacy program across multiple locations including international and national programs; ensure compliance with GDPR, HIPAA Privacy Rule (45 CFR Parts 160 & 164), Title 10 NYCRR, NY SHIELD Act, and OIG Seven Elements of an Effective Compliance Program; safeguard confidentiality, integrity, and availability of protected health information (PHI) and regulated health information; function as independent and objective body that reviews and evaluates compliance and privacy issues/concerns within organization.
• Policy, Training & Enforcement: Develop and maintain facility's Notice of Privacy Practices, policies, and procedures; ensure leadership, members in administrative roles, and employees comply with global, federal, and state rules; deliver workforce training on privacy, HIPAA, GDPR, and compliance requirements; foster culture of confidentiality and compliance throughout organization; ensure organizational behavior meets Code of Conduct standards.
• Breach Response & Investigations: Lead breach response activities and regulatory reporting; conduct compliance and privacy investigations; manage patient rights requests and privacy-related inquiries; coordinate incident response and corrective action planning.
• Auditing & Monitoring: Oversee all internal audit and administrative functions related to compliance and privacy program; conduct internal auditing and monitoring activities; ensure PHI is used and disclosed in accordance with global, federal, and state regulations; prepare compliance reports and analytics for leadership review.

Requirements

• Experience: 5–7+ years healthcare privacy or compliance experience, preferably in long-term care or healthcare setting.
• Education: Bachelor's degree in Health Administration, Legal Studies, Compliance, or related field; Master's or JD preferred.
• Regulatory Expertise: In-depth knowledge of OIG Seven Elements, GDPR, HIPAA Privacy Rule, and State privacy laws.
• PHI Knowledge: Expertise in PHI lifecycle and permissible disclosures.
• Certifications: Certified in Healthcare Compliance (CHC) and/or Certified in Healthcare Privacy Compliance (CHPC), or ability to become certified within first six months of hire.
• Analytical Skills: Strong analytical, communication, and problem-solving abilities.
• Breach Response: Skilled in breach response and regulatory reporting.
• Policy Development: Strong training and policy development capabilities.
• Regulatory Interpretation: Ability to interpret and apply complex regulations.
• Confidentiality: Ability to maintain confidentiality and exercise sound judgment.

Technical Skills

• Microsoft Office: Proficiency in MS Office including advanced Excel skills for data tracking, analysis, and reporting.
• ERP Systems: Familiarity with enterprise resource planning systems and document/workflow management platforms (e.g., Microsoft SharePoint); ability to assess data flows and access to sensitive information.
• EHR/EMR: Experience with electronic health record systems and understanding of how PHI is created, maintained, and accessed.
• Tracking Systems: Familiarity with compliance, audit, or incident tracking systems (a plus).

Preferred Skills & Experience

• Master's degree or JD.
• International/multi-country compliance experience.
• GDPR implementation experience.
• Long-term care facility experience.
• Nonprofit or mission-based organization experience.
• Experience with multi-location compliance oversight.
• Spanish language skills.