General Counsel Chief Compliance and Privacy Officer

About HPI

At HPI, we are a forward-thinking, national third-party administrator (TPA) specializing in self-funded health plan solutions. With over 44 years of industry expertise, our entrepreneurial spirit, flexible approach, and personalized service have empowered us to serve clients of all sizes across diverse industries. We deliver innovative strategies that maximize the value of every healthcare dollar.

The self-funded health plan landscape is constantly evolving. At HPI, our partners benefit from having a TPA with the expertise, resources, and creativity to deliver customized plan solutions that help them win and retain more business. We excel at driving costs down and managing risk, while enhancing our clients’ employees’ health insurance experience. Our goal is to help members clearly understand their health plan and provide responsive service, enabling them to fully utilize their benefits and achieve greater health.

Our commitment extends beyond our clients to our own employees. We foster a supportive and inclusive work environment where innovation thrives. By investing in our team’s growth and well-being, we ensure they are equipped to provide exceptional service.

About the Role

The General Counsel & Chief Compliance and Privacy Officer will build strategic and comprehensive legal, compliance, and privacy programs that develop, implement, and maintain policies, procedures, processes, and programs to enable consistent, effective compliance and/or privacy practices, reduce legal risk, and ensure operations of the company are within legal obligations. Key responsibilities include:

• Ensuring compliance and adherence to applicable laws and regulations and accreditation standards;
• Minimizing risk;
• Ensuring the confidentiality of protected health information (“PHI”); and
• Promoting a culture of compliance and adherence to applicable laws, regulations, and accreditation standards throughout the HPI organization.

Additionally, the role involves reviewing documents, agreements, and contractual obligations, serving as a key resource to advise on risk mitigation, legal, compliance, and/or privacy matters.

Responsibilities

• Lead and oversee the development, implementation, and ongoing monitoring of the organization’s legal, compliance, and privacy programs.
• Analyze client, vendor, and other third-party requests for disclosure of PHI; identify and issue appropriate privacy-related agreements (e.g., Business Associate Agreement, Non-Disclosure Agreement).
• Review, draft, and negotiate privacy-related agreements; maintain an agreement database.
• Develop, implement, review, update, and maintain privacy-focused policies, procedures, processes, and programs.
• Maintain current knowledge of applicable privacy laws and regulations; implement changes to privacy-focused policies as needed.
• Advise the organization on applicable legal, regulatory, and compliance requirements related to privacy.
• Develop, implement, review, update, and maintain compliance-focused policies, procedures, and programs, including those required for accreditation.
• Maintain current knowledge of applicable laws, regulations, and accreditation standards; implement changes as appropriate.
• Manage the development, delivery, and completion of legal, compliance, and/or privacy trainings; review and update training materials.
• Create and deliver specialized educational programs for key roles to mitigate risk from legal, privacy, compliance, or accreditation obligations.
• Establish and chair a Compliance Oversight Committee; develop and document an annual work plan of initiatives and activities.
• Provide regular reports on privacy or compliance initiatives and operational activity to senior management.
• Identify and present changes to legal, privacy, accreditation, or compliance obligations to senior management.
• Recommend improvements to policies, procedures, and programs to mitigate risk and ensure adherence to obligations.
• Coordinate and review workflow to and from all external legal counsel, including collaboration with Human Resources; manage outside counsel relationships and billing.
• Conduct and/or participate in annual privacy, security, and compliance risk analysis and ongoing monitoring activities.
• Participate in internal and external audits related to privacy, security, accreditation, and compliance; oversee corrective actions.
• Receive, track, document, investigate, and act on reports of potential privacy or compliance incidents, including risk assessments.
• Direct the process for reporting incidents as required by applicable legal, accreditation, or contractual obligations.
• Review, draft, and negotiate all contractual agreements; serve as a key resource for internal legal, compliance, accreditation, or privacy matters.
• Handle additional duties and projects requiring legal, compliance, accreditation, or privacy expertise as assigned.

Requirements

• Bachelor’s degree and JD required.
• Admission to the Bar in one or more states where the Company does business.
• 7 or more years of experience in healthcare privacy, legal, and compliance matters.
• CIPP, CIPM, CHC, or CHPC credential a plus.
• Experience with Utilization Review Accreditation Commission matters a plus.
• Experience with Service Organization Controls reporting and audits a plus.

Skills

• Resilient, collaborative, flexible, and innovative.

Working Environment

The work environment is moderate in noise level. The employee may occasionally lift and/or move up to 20 pounds. Specific vision abilities required include close vision, distance vision, peripheral vision, depth perception, and the ability to adjust focus. While performing the duties of this job, the employee is regularly required to sit, walk, speak, or hear. The employee is frequently required to use hands or feel or handle items, as well as reach with hands and arms. The employee is occasionally required to stand.