Sr. Director Healthcare Compliance

Job Description

Job Description:\n\nOverview\nSr. Director, Healthcare Compliance\nJob Summary: \nThe Sr. Director, Healthcare & Data Privacy Compliance is a leadership role, reporting to the Compliance & Risk Officer, responsible for the strategic vision, oversight, and operational execution of the organization's healthcare compliance and data privacy assurance programs. This position serves as the Company’s designated HIPAA Privacy Officer and leads the strategy to safeguard information assets, ensure regulatory compliance, and foster an enterprise-wide culture of data privacy.\nThis role bridges healthcare operations (such as pharmacy and telehealth) with data security, legal, and executive leadership to ensure compliance readiness across state and federal regulations, technical security standards, and operational workflows.\nSupervisory Responsibilities: \nThis position has direct supervisory responsibilities. \n \nEssential Duties and Responsibilities: \nHealthcare Compliance Oversight \nManage and lead the healthcare compliance program, guiding long-term goals, tactics, and risk mitigation strategies.\nDevelop and Maintain Policies and Procedures: Create and update written policies and procedures accessible to all associates, detailing the implementation and operation of the compliance program.\nRespond to Complaints & Audits: Lead the research and response to reports of complaints, suspected non-compliance, and audits, including record maintenance and assisting investigations.\nLead Third Party Offshore Vendor Management: Conduct annual audits, security assessments, and required attestations for healthcare business units.\nAnalyze and adapt to current federal and state healthcare laws impacting business operations (e.g., HIPAA, Anti-Kickback Statute, Stark Law, False Claims Act).\nUnderstand and Analyze Regulatory Requirements: Knowledge of current federal and state laws impacting program operations. Analyze and prepare written communications regarding these laws for affected business areas.\nPrivacy Assurance \nAct as the designated HIPAA Privacy Officer:\nCoordinate regulatory contracting with healthcare service providers, partners, and business owners and maintain up-to-date Business Associate Agreements (BAAs).\nNotice of Privacy Practices (NPP); Develop, distribute, or post an NPP that explains patients' rights regarding their PHI and the organization's privacy practices. Ensure the NPP is updated to reflect changes in regulatory requirements or procedures.\nInstitution-Wide Monitoring: Coordinate and track institution-wide monitoring of healthcare data management compliance.\nHandle Privacy Complaints and Breaches: Implement a process for receiving, documenting, tracking, investigating, and acting on all complaints concerning breaches in privacy policies and procedures.\nProvide subject matter expertise for key cybersecurity compliance initiatives, including HITRUST certification, Sarbanes-Oxley (SOX) ITGCs, and CCPA compliance.\nEvaluate and monitor third-party vendor risk and cybersecurity postures in coordination with IT, Legal, and Risk Management.\nStrengthen and manage the cookie management program and related compliance.\nAudit, Risk Assessment & Incident Response\nPartner with the Compliance Officer to facilitate and perform annual institution-wide risk assessments to identify privacy, compliance, and cybersecurity vulnerabilities.\nPartner with the Data Security officer to oversee the incident response plan for cybersecurity breaches and privacy violations, ensuring swift investigation, remediation, corrective action plans (CAPs), and mandatory regulatory reporting.\nAssist executive leadership in responding to reports of suspected non-compliance and enforcing disciplinary sanctions when violations occur.\nEducation, Training & Communication\nDesign Associate Training: Develop a solid associate education and training program that covers healthcare compliance issues such as fraud, waste and abuse.\nMaintain confidential, anonymous reporting hotlines/channels for compliance concerns.\nReport compliance findings, audit results, and governance metrics directly to senior management and regulatory bodies.\n \nSkills/Abilities: \nStrategic, results-driven leadership with high ownership and accountability.\nStrong cross-functional collaboration and relationship-building skills across reporting chains.\nExcellent oral, written, and executive presentation communication skills.\nExpert knowledge of business operational workflows managing consumer healthcare data and technology infrastructure.\nAbility to handle complex problem-solving and manage multiple high-priority, concurrent projects under tight deadlines.\nEducation and Experience: \nBachelor of Science in Healthcare Administration or a related business field required.\nMaster’s degree in a related business or healthcare field preferred.\n10-15 years in a compliance/regulatory role supporting business operations. Experience working with federal health care agencies and regulators, HIPAA, Anti-kickback and Stark laws.\nCertificates/Licenses/Registration:\nRequired Healthcare/Privacy Certifications (at least one): CHPC, CHC, or equivalent.\nFinancial Responsibilities (budget, revenue):\nThis position has budget responsibility, authority and/or level of control. \n \nPhysical Requirements: \nWork is performed indoors with potential for exposure to safety and health hazards related to office work. Could periodically travel to other office and operational sites. The noise level in the work environment is usually moderate.\n \nProlonged periods of sitting at a desk and working on a computer.\n \nSelectQuote Core Values: \nService: We create positive customer experiences. \nEntrepreneurship: We create innovate & take risks. \nLeadership: We build & invest in high-performing teams. \nEmpowerment: We embrace a changing environment. \nCourage: We challenge the status quo & drive continuous improvement.\nTeamwork: We help support & celebrate each other.\n\nDisclaimer: The above statements are intended to describe the general nature and level of work being performed by people assigned to this job. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required.\n \n\nResponsibilities\n\nMore than 35 years ago, SelectQuote was founded on one core promise: to help our customers protect the people they value most. We pioneered the way consumers shopped for term life insurance, and now, we also help people find home insurance, auto insurance, senior health insurance and more. Our quick and easy process saves consumers both time and money, and today, more than 2 million families trust us to help them with their insurance needs.\n But what truly sets us apart is our people, and the opportunities to grow your career with SelectQuote are unmatched.\n\nQualifications\nThe Sr. Director, Healthcare & Data Privacy Compliance is a leadership role, reporting to the Compliance & Risk Officer, responsible for the strategic vision, oversight, and operational execution of the organization's healthcare compliance and data privacy assurance programs. This position serves as the Company’s designated HIPAA Privacy Officer and leads the strategy to safeguard information assets, ensure regulatory compliance, and foster an enterprise-wide culture of data privacy.\nThis role bridges healthcare operations (such as pharmacy and telehealth) with data security, legal, and executive leadership to ensure compliance readiness across state and federal regulations, technical security standards, and operational workflows.\n \nSupervisory Responsibilities: \n\n This position has direct supervisory responsibilities. \n\nEssential Duties and Responsibilities: \nHealthcare Compliance Oversight\n\n Manage and lead the healthcare compliance program, guiding long-term goals, tactics, and risk mitigation strategies.\n Develop and Maintain Policies and Procedures: Create and update written policies and procedures accessible to all associates, detailing the implementation and operation of the compliance program.\n Respond to Complaints & Audits: Lead the research and response to reports of complaints, suspected non-compliance, and audits, including record maintenance and assisting investigations.\n Lead Third Party Offshore Vendor Management: Conduct annual audits, security assessments, and required attestations for healthcare business units.\n Analyze and adapt to current federal and state healthcare laws impacting business operations (e.g., HIPAA, Anti-Kickback Statute, Stark Law, False Claims Act).\n Understand and Analyze Regulatory Requirements: Knowledge of current federal and state laws impacting program operations. Analyze and prepare written communications regarding these laws for affected business areas.\n\nPrivacy Assurance\n\n Act as the designated HIPAA Privacy Officer:\n \n Coordinate regulatory contracting with healthcare service providers, partners, and business owners and maintain up-to-date Business Associate Agreements (BAAs).\n Notice of Privacy Practices (NPP); Develop, distribute, or post an NPP that explains patients' rights regarding their PHI and the organization's privacy practices. Ensure the NPP is updated to reflect changes in regulatory requirements or procedures.\n Institution-Wide Monitoring: Coordinate and track institution-wide monitoring of healthcare data management compliance.\n Handle Privacy Complaints and Breaches: Implement a process for receiving, documenting, tracking, investigating, and acting on all complaints concerning breaches in privacy policies and procedures.\n \n Ensure sales and marketing practices are compliant\n Provide subject matter expertise for key cybersecurity compliance initiatives, including HITRUST certification, Sarbanes-Oxley (SOX) ITGCs, and CCPA compliance.\n Evaluate and monitor third-party vendor risk and cybersecurity postures in coordination with IT, Legal, and Risk Management.\n Strengthen and manage the cookie management program and related compliance.\n\nAudit, Risk Assessment & Incident Response\n\n Partner with the Compliance Officer to facilitate and perform annual institution-wide risk assessments to identify privacy, compliance, and cybersecurity vulnerabilities.\n Partner with the Data Security officer to oversee the incident response plan for cybersecurity breaches and privacy violations, ensuring swift investigation, remediation, corrective action plans (CAPs), and mandatory regulatory reporting.\n Assist executive leadership in responding to reports of suspected non-compliance and enforcing disciplinary sanctions when violations occur.\n\nEducation, Training & Communication\n\n Design Associate Training: Develop a solid associate education and training program that covers healthcare compliance issues such as fraud, waste and abuse.\n Maintain confidential, anonymous reporting hotlines/channels for compliance concerns.\n Report compliance findings, audit results, and governance metrics directly to senior management and regulatory bodies.\n\nSkills/Abilities: \n\n Strategic, results-driven leadership with high ownership and accountability.\n Strong cross-functional collaboration and relationship-building skills across reporting chains.\n Excellent oral, written, and executive presentation communication skills.\n Expert knowledge of business operational workflows, managing consumer healthcare data and technology infrastructure.\n Ability to handle complex problem-solving and manage multiple high-priority, concurrent projects under tight deadlines.\n\n \nEducation and Experience: \n\n Bachelor of Science in Healthcare Administration or a related business field required.\n Master’s degree in a related business or healthcare field preferred.\n 10-15 years in a compliance/regulatory role supporting business operations.\n Experience working with federal health care agencies and regulators, HIPAA, Anti-kickback and Stark laws.\n\n \nCertificates/Licenses/Registration:\n\n Required Healthcare/Privacy Certifications (at least one): CHPC, CHC, or equivalent.\n\n \nFinancial Responsibilities (budget, revenue):\n\n This position has budget responsibility, authority and/or level of control. \n\nPhysical Requirements: \nWork is performed indoors with potential for exposure to safety and health hazards related to office work. Could periodically travel to other office and operational sites. The noise level in the work environment is usually moderate.\nProlonged periods of sitting at a desk and working on a computer.\n \nSelectQuote Core Values: \nService: We create positive customer experiences. \nEntrepreneurship: We create innovate & take risks. \nLeadership: We build & invest in high-performing teams. \nEmpowerment: We embrace a changing environment. \nCourage: We challenge the status quo & drive continuous improvement.\nTeamwork: We help support & celebrate each other.\n \nDisclaimer: The above statements are intended to describe the general nature and level of work being performed by people assigned to this job. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required.\nAt this time SelectQuote does not hire applicants who solely possess temporary work visas requiring employer sponsorship of any kind including but not limited to OPT, H-1B, L-1, O-1, TN, F-1, J-1, E-3, etc.\nSelectQuote Insurance Services does not discriminate against any applicant for employment, or any employee because of age, color, sex, disability, national origin, race, religion, or veteran status.