Job Description:
The Manager of Compliance and Privacy Program assists the Compliance/Privacy Officer by implementing required program elements, collecting and maintaining supporting information, and delivering timely, accurate compliance communications to internal and external audiences.
The Manager is a hands-on working manager and conducts intake, initial investigations, risk assessments, response, reporting, escalation, and documentation for compliance, FWA, and privacy incident reports. The role maintains clear, concise, detailed, and organized supporting records for departmental projects and corporate projects affecting the department. The Manager carries out tasks and trains, supports, and supervises staff representing Compliance and Privacy in cross-functional tasks, projects, health plan audits, regulatory templates and letters, and interdepartmental meetings on compliance and privacy matters. The Manager works with the Compliance/Privacy Officer to confirm that appropriate resources are allocated to meet project deadlines and service levels.
ESSENTIAL RESPONSIBILITIES:
Corporate Compliance and Privacy Program
- Support the Compliance/Privacy Officer by completing all tasks related to the Corporate Compliance and Privacy Program Elements and the effectiveness.
- Conducts on-site new hire orientation on Compliance, Privacy, and Security. (At least monthly, but no more than weekly). Develops, updates, and maintains all new hire and annual Compliance and Privacy training, coordinating updates with IT Security as needed.
- Maintain and update Compliance, Privacy and Policy tools, including GRC, SharePoint, databases, Excel workbooks, files, and folders, and prepare all required reports. Administer Compliance, Privacy, and Policy Management platforms, stay current on system updates, and maintain the platforms. Keep the Compliance/Privacy Officer promptly informed.
- Conduct a comprehensive review of Compliance and Privacy policies and procedures at least annually to ensure they remain current and aligned with regulatory requirements. Report to Compliance/Privacy Officer all changes promptly.
- Promptly update, review, and maintain compliance and privacy playbooks and training materials. Report to Compliance/Privacy Officer all changes promptly.
- Prepare and submit accurate reports on Compliance and Privacy initiatives and statistics to the Compliance/Privacy Officer by established deadlines, with no extensions.
- Develop, update, manage, and coordinate the preparation of materials for Compliance and Privacy Program Committees and meetings, including agendas, data analysis reports, presentations, and minutes. Promptly gather and communicate essential information regarding Compliance or Privacy requirements to the Compliance/Privacy Officer.
- Perform comprehensive research on complex questions to identify relevant regulatory or contractual obligations and promptly present the findings to the Compliance/Privacy Officer.
- Collaborating with the Compliance/Privacy Officer and Delegation Team Manager coordinating project activities, identifying, documenting, and executing specific action items required for the effective implementation of process improvement initiatives. Design thorough test cases and scenarios to conduct testing and detect defects. Anticipate potential issues and develop alternative solutions while delivering timely updates to the Compliance/Privacy Officer. Regularly review and monitor the issues log to confirm resolution of outstanding matters, reporting status to the Compliance/Privacy Officer prior to solution deployment. Provide backup to the team when necessary.
- Keep the Compliance/Privacy Office Project List up to date with all ongoing departmental projects. The list should include information such as the intended audience, project goals, project leader and team members, detailed next steps with deadlines, responsible personnel, and the completion date. Update this list before or after status meetings to reflect the latest status and upcoming actions. Present during Monday Morning weekly Compliance Team meeting.
- Promptly notify the Compliance/ Privacy Officer of any potential compliance or privacy incidents to ensure proper coordination and remediation.
- Perform other Compliance or Privacy activities as assigned.
Compliance
- As a hands-on working Manager, assumes primary responsibility for the initial screening, prompt investigation, and triage of FWA and other Compliance matters for PriMed, Hill Physicians Medical Group, Inc., their affiliates, and related parties. Conducts, coordinates and manages thorough investigations encompassing data collection, analysis, interviews, and report preparation. Report all potential incidents and resolution steps to be completed to Compliance/Privacy Officer immediately.
- Conduct, coordinate, and manage investigations of potential FWA or compliance incidents, including but not limited to monitoring and performing tasks for the Compliance Hotline and Compliance incident emails, using the GRC Compliance Incident Management Tools. Perform tasks such as intake of report, categorization of internal folder systems, investigation, risk assessment, response, reporting, escalation, documentation, tracking. Keep Compliance/Privacy Officer informed timely.
- Perform comprehensive research, analysis, and evaluation of changes to applicable statutes, rules, regulations, and compliance standards pertaining to federal and state Compliance, Privacy, and Breach Notification requirements utilizing government sources, professional compliance organizations, and relevant industry literature. Prepare timely updates, reports, training documents, and detailed summaries that articulate the implications of both newly enacted and existing compliance obligations, ensuring they are available for review by the Compliance/Privacy Officer timely.
- Supervise and train staff to perform investigations into potential FWA or compliance incidents. Contribute and oversee processes which include but not limited to monitoring and performing tasks for the Hotline and Compliance emails, utilization and maintaining the GRC Compliance Incident Management Tool, initial intake of report, categorization/organization of internal folder systems, investigation of incident, completion of a risk assessment, response, reporting, escalation, documentation, tracking, trending, and reporting.
- Demonstrate proficiency in performing compliance delegation tasks and facilitate cross-training among team members. Diligently monitor email to ensure proper acknowledgments, effective handovers, and precise logging within GRC Tools.
- Perform assigned tasks for health plan delegation audits or government agency audits, including gather case files, policies and procedures, attestations, questionnaires, and other material as requested.
- Perform all Compliance assignments and requests timely and accurately utilizing PriMed Tools. Assists with coverage and perform other compliance duties as assigned.
Privacy
- As a hands-on working Manager, assumes primary responsibility for the initial screening, prompt investigation, and triage of HIPAA/HITECH and other Privacy matters for PriMed, Hill Physicians Medical Group, Inc., their affiliates, and related parties. Conducts, coordinates and manages thorough investigations encompassing data collection, analysis, interviews, and report preparation, as well as all required breach determination and notification processes under HIPAA and applicable state breach rules and requirements. Report all potential incidents and resolution steps to be completed to Compliance/Privacy Officer immediately.
- Conduct, coordinate, and manage privacy investigation activities with team members, including detailed logs of all allegations, information related to affected parties, investigation details, risk assessments, as well as all required breach determination and notification processes under HIPAA and applicable state breach rules and requirements. Report all potential incidents and resolution steps to be completed to Compliance/Privacy Officer immediately.
- Supervise, train staff, and perform investigations of potential privacy incidents. Processes include but not limited to monitoring and performing tasks for the Hotline and Privacy emails, utilization and maintaining the GRC SAI360 Privacy Incident Management Tool, initial intake of report, categorization/organization of internal folder systems, investigation of incident, completion of a risk assessment, response, reporting, escalation, documentation, tracking, trending, and reporting.
- Prepares, implements, maintains, and updates Privacy and Breach Notification policies and associated documentation; requests regular reviews from subject matter experts and informs stakeholders of any policy revisions. Develops and manages tracking systems to document compliance with relevant privacy and breach notification standards. Ensures the Compliance/ Privacy Officer is kept promptly informed.
- Perform privacy program QA to ensure compliance with appropriate laws, regulations, and policy standards, and reviews areas previously audited to confirm proper corrective action or recommendation(s) have been implemented. Develop recommendations for improvement based on findings and conduct related ongoing privacy rule compliance monitoring activities in coordination with the organization’s other compliance and operational assessment functions.
- Monitors patterns of inappropriate use and/or disclosure of Protected Health Information, and establishes an ongoing process to track/trend, investigate and report inappropriate access and disclosure of Protected Health Information immediately to the Compliance/Privacy Officer.
- Collaborates with the Security team to ensure alignment between security and privacy compliance programs including policies, practices, investigations, and acts as a liaison to the Security team.
- On a continuous basis, develop training materials, identify target audiences, and deliver education and training to foster awareness and understanding of and promoting adherence to state and federal Privacy and Breach Notification requirements.
- Addresses privacy and breach notification inquiries, comments, and complaints, and promptly notifies the Compliance Officer, Legal, Health Plans, and Regulatory Agencies as required.
- Perform, manage, coordinate, supervise, and train staff on Proactive Monitoring for potential Privacy Breaches. Report to the Compliance/Privacy Officer any findings timely.
- Prepare, log, and maintain PHI/HIPAA compliance-oriented training for new hires and annual and target training.
- Perform all Privacy assignments and requests timely and accurately utilizing HPMG Tools.
- Perform other duties as assigned.Assesses risk and plans for long range privacy and confidentiality compliance. Drafts all-staff communications to reinforce privacy best practices.
Compliance Letter Templates – All Health Plans
- Coordinate with the Letters Template team on assigned tasks, including updating, testing, and maintaining regulatory compliance letter template tools. Maintain analytics, metrics, and related tools, including GRC, SharePoint, databases, and Excel workbooks. Keep files and folders structured and organized.
- Perform other Regulatory Compliance Letter Template duties as assigned.
- Complete a personal goal to enhance skills to meet departmental initiatives. Maintain CHC, CHCP
SKILLS AND EXPERIENCE REQUIRED:
- Bachelor’s Degree and four years of related privacy experience. Master’s degree Preferred.
- CHC Compliance Certification Preferred. (Must obtained within 9 months)
- CHCP Compliance Privacy Certification Preferred. (Must obtained within 12 months)
- Minimum years of healthcare professional experience required – 3-5.
- Comprehensive understanding of Compliance Program 7 element requirements.
- Comprehensive understanding of PHI/HIPAA guidelines.
- Strong knowledge and understanding of state and federal privacy and breach notification regulations (e.g., HIPAA, CMIA, state and federal breach notification laws)
- Strong analytic skills and critical thinking.
- Strong skills in software applications, including but not limited to Microsoft Word, Excel, PowerPoint, Visio, Access, and Outlook.
- Strong oral, written, reading comprehension, organizational, research, and negotiation skills.
- Prefer a strong understanding of PriMed/Hill Guidelines and other departmental processes.
- Prefer familiarity with key software/systems used by the department including, but not limited to Workday, SharePoint, PRISM, Salesforce, and Epic.
- Demonstrated ability to exercise sound judgment, prioritize multiple tasks, and problem solve under the pressure of deadlines and resource constraints.
- Ability to work well with business and technical staff.
- Ability to work independently as well as part of a team.
Additional Information:
Salary: $109,000 - $144,000 Annual
