Director of Compliance

About the Role

Works under general direction to perform ongoing activities related to developing, implementing, maintaining, and adhering to policies and procedures in compliance with federal, state, and local laws and regulations for the University of Maryland Medical System (UMMS). This role involves close collaboration with key stakeholders to ensure compliance with existing and new regulations, representing assigned policy areas, performing risk assessments, and leading education, training, auditing, and monitoring initiatives.

Responsibilities

• Accountable for the Compliance Program at Member Organizations (MOs), including directing MO-specific risk assessments related to HIPAA and privacy compliance.
• Conducts risk assessment analysis, identifying high, medium, and low risks, and compiles Executive reports on aggregate findings and recommendations for UMMS System and Physician Compliance Leadership.
• Communicates risks to both technical and non-technical stakeholders.
• Leads the Member Organization Privacy Monitoring Program, ensuring ongoing monitoring of inappropriate/unauthorized access and disclosures using electronic record monitoring applications (e.g., Protenus, Break-the-Glass) and data loss prevention tools in accordance with HIPAA and the Health Information Technology for Economic and Clinical Health Act.
• Performs trend analyses and prepares summary reports for Executive Leadership on privacy monitoring activities.
• Serves as an expert resource in interpreting and providing guidance on compliance policies tailored to departmental needs.
• Oversees the development and dissemination of compliance policies and procedures, including the approval of monitoring and auditing tools for assigned areas.
• Reviews reporting to ensure adherence to compliance and privacy standards and recommends actions based on self-monitoring results.
• Directs local compliance and privacy auditing and monitoring activities, reviews findings for regulatory compliance, and escalates issues to executive leadership.
• Ensures timely completion of all management action plans resulting from compliance-related findings by internal audit for assigned MOs.
• Provides ongoing compliance and privacy education, including regular training sessions and special topic training.
• Develops activities to foster compliance and privacy awareness through publications, newsletters, fairs, and the Intranet.
• Maintains systems to solicit, evaluate, and respond to complaints, problems, and issues through all communication channels.
• Coordinates and oversees investigations, responses to violations, and corrective actions for reports of alleged fraud and noncompliance.
• Ensures all escalated complaints for supported MOs are resolved timely and satisfactorily.
• Reviews investigation report findings and approves adjustments to achieve set objectives.
• Utilizes IT systems/tools to manage and coordinate data investigations.
• Participates in UMMS and Member Organizations’ Compliance Committees as the lead compliance and privacy representative.
• Sets compliance committee agendas, chairs assigned Member Organization quarterly compliance committee meetings, and ensures meeting packets are complete and submitted to stakeholders within five calendar days before the meeting.
• Monitors and stays up-to-date with laws, regulations, standards, and guidelines, communicating updates to appropriate stakeholders.
• Prepares reports for local and Corporate executive leadership and the Audit and Compliance Committee of the Board of Directors.
• Collaborates with the Director of Physician and Ambulatory Network on pertinent physician-related matters.
• Performs other duties as assigned.

Requirements

• Bachelor’s degree or an equivalent combination of education and experience is required; Master’s degree preferred.
• Ten years of related compliance and privacy experience with a background in healthcare regulatory issues, including familiarity with hospital billing.
• Four years of experience in healthcare or regulatory fields is preferred.
• Certified in Healthcare Compliance or other professional compliance certification (or achieve certification within 12 months of hire date).
• Experience and working knowledge of Corporate Compliance, Audit, Legal, Privacy, or Information Security.
• Experience with case investigations management and compliance hotline management is preferred.