Chief Compliance Officer

Chief Compliance Officer

At Metrocare, we serve our neighbors with developmental or mental health challenges by helping them find lives that are meaningful and satisfying. Metrocare is the largest provider of mental health services in North Texas, serving over 55,000 adults and children annually. For over 50 years, Metrocare has provided a broad array of services to people with mental health challenges and developmental disabilities. In addition to behavioral health care, Metrocare provides primary care centers for adults and children, services for veterans and their families, accessible pharmacies, housing, and supportive social services. Alongside clinical care, researchers and teachers from Metrocare's Altshuler Center for Education & Research are advancing mental health beyond Dallas County while providing critical workforce to the state.

The Chief Compliance Officer oversees and manages compliance within the organization. The position ensures the Center, and its employees are following regulatory, contractual and accreditation requirements, internal policies and procedures, and that behavior in the organization meets the company's Standards of Conduct. The Chief Compliance Officer is responsible for providing guidance to the Board of Trustees and executive/senior management on all matters related to compliance.

Compliance Officer Role & Responsibilities

• Ensures that all departments are following HIPAA, HITRUST and other accreditation standards that apply to Metrocare.
• Monitors compliance with federal, state, and local regulatory requirements: Stays abreast of laws and regulations that might affect the organization's policies and procedures.
• Develops, initiates, maintains, and revises policies and procedures for the general operation of the compliance program and its related activities to prevent illegal, unethical, or improper conduct.
• Develops policies and programs that encourage managers and employees to report suspected fraud and other improprieties without fear of retaliation.
• Manages day-to-day operation of the compliance program including direct management of compliance team members, providing routine supervision, training, guidance and performance management feedback.
• Collaborates with Human Resources to develop, review and update Standards of Conduct to ensure continuing currency and relevance in providing guidance to management and employees.
• Collaborates with other departments to direct compliance issues to appropriate existing channels for investigation and resolution.
• Consults with General Counsel as needed to resolve difficult legal compliance issues.
• Responds to alleged violations of rules, regulations, policies, procedures, and Standards of Conduct by evaluating or recommending the initiation of investigative procedures to the appropriate department.
• Develops and oversees a system for uniform handling of compliance related violations.
• Monitors, and as necessary, coordinates compliance activities of other departments to remain abreast of the status of all compliance activities and to identify trends.
• Identifies potential areas of compliance vulnerability and risk, develops and implements corrective action plans for resolution of problematic issues, and provides general guidance on how to avoid or deal with similar situations in the future.
• Provides reports on a regular basis, and as directed or requested, keeps the Corporate Compliance Committee and senior management informed of the operation and progress of compliance efforts.
• Ensures proper reporting of violations or potential violations to duly authorized enforcement agencies as appropriate or required.
• Manages the compliance hotline.
• Institutes and maintains an effective compliance communication program for the organization, including promoting: (a) use of the compliance hotline; (b) heightened awareness of Standards of Conduct, and (c) understanding of new and existing compliance issues and related policies and procedures.
• Works with the Human Resources Department and others as appropriate to develop an effective compliance training program, including appropriate introductory training for new employees and ongoing training for all employees and managers.
• Monitors the performance of the Compliance Program and related activities on a continuing basis, taking appropriate steps to improve its effectiveness.
• Ensure contractors and agents who furnish medical services to the health system are aware of the requirements of the compliance program with respect to coding, coverage, billing, marketing, etc.
• Responds to government investigations and queries as the principal point of contact.
• As applicable, develops, implements and monitors corrective actions with all health system departments, providers and sub-providers, agents and, if appropriate, independent contractors.

Privacy Role & Responsibilities

• Oversees all ongoing activities related to the development, implementation, maintenance, and adherence to Metrocare policies and procedures regarding privacy of and access to protected health information (PHI) in compliance to federal and state laws and health system privacy practices.
• Ensures that periodic risk assessments and ongoing monitoring of key elements of the privacy program are monitored, including privacy notices, consents, authorizations, and business partner agreements.
• Develops, implements and maintains the organization's information privacy policies and procedures in coordination with executive/senior management the Quality Council.
• Serves in a leadership role for the compliance committee's activities.
• Performs information privacy risk assessments and conducts related ongoing compliance monitoring activities in coordination with Metrocare's other compliance and operational assessment functions.
• Works with management, key departments, and committees to ensure the organization has and maintains appropriate privacy and confidentiality consent, authorization forms, and information notices and materials reflecting current organization and legal practices and requirements.
• Oversees, directs, delivers, or ensures delivery of initial privacy training and orientation to all employees, volunteers, medical and professional staff, contractors, alliances, business associates, and other appropriate third parties.
• Participates in the development, implementation, and ongoing compliance monitoring of all business associate and data use agreements to ensure all privacy concerns, requirements, and responsibilities are addressed.
• Establishes with management and operations a mechanism to track access to protected health information, within the purview of the organization and as required by law and to allow qualified individuals to review or receive a report on such activity.
• Works cooperatively with all departments in overseeing patient rights to inspect, amend, and restrict access to protected health information when appropriate.
• Establishes and administers a process for receiving, documenting, tracking, investigating, and acting on all complaints and violations concerning the organization's privacy policies and procedures in coordination and collaboration with other similar functions and, when necessary, legal counsel.
• Ensures compliance with privacy practices and consistent application of sanctions for failure to comply with privacy policies for all individuals in the organization's workforce, extended workforce, and for all business associates, in cooperation with Human Resources, administration, and legal counsel as applicable.
• Initiates, facilitates and promotes activities to foster information privacy awareness within the organization and related entities.
• Reviews all system-related information security plans throughout the organization's network to ensure alignment between security and privacy practices and acts as a liaison to the information systems department.
• Maintains current knowledge of applicable federal and state privacy laws and accreditation standards, and monitors advancements in information privacy technologies to ensure organizational adaptation and compliance.
• Serves as information privacy consultant to the organization for all departments and appropriate entities.
• Cooperates with the governmental auditors, other legal entities, and organization officers in any compliance reviews or investigations.
• Works with administration, legal counsel, and other related parties to represent the organization's information privacy interests with external parties (state or local government bodies) who undertake to adopt or amend privacy legislation, regulation, or standard.
• Develop and present reports to the Board of Trustees as requested.
• Coordinates with appropriate Metrocare departments and units to ensure timely development and implementation of corrective action plans in response to monitoring deficiencies and complaints.

Information Security Role & Responsibilities

• Oversee all ongoing activities related to development, implementation, maintenance of, and adherence to Metrocare policies and procedures covering security of and access to protected health information (PHI) in compliance with federal and state laws and health system security practices.
• Ensure the periodic risk assessment and ongoing monitoring and reporting of key elements of the security program.
• Collaborate with the Information Technology Team regarding:
  • The development and enforcement of information security policies and procedures, measures and mechanisms to ensure the prevention, detection, containment, and correction of security incidents.
  • Ensuring that security standards comply with statutory and regulatory requirements regarding health information.
  • Ensuring that security policies are maintained, including administrative security, personnel security, physical safeguards, technical security, and transmission security.
  • Assurance that appropriate documentation exists of response of the institution to the addressable portions of the security rule.
  • Ensuring that security procedures are maintained, including evaluation of compliance with security measures; contingency plans for emergencies and disaster recovery; security incident response process and protocols; testing of security procedures, measures, and mechanisms,