Compliance and Privacy Manager

ORGANIZATIONAL BACKGROUND:

The Central California Asthma Collaborative (CCAC) is a non-profit organization dedicated to reducing the burden of asthma and other health disparities in the San Joaquin Valley.

POSITION SUMMARY:

The Compliance and Privacy Manager (CPM), under the direction of the Director of Community Health and Director of Data Analytics, is responsible for developing, implementing and overseeing the Community Health Division’s compliance program to ensure adherence to federal, state, and contractual requirements governing Medi-Cal services. The CPM serves as the organization's subject matter expert on regulatory compliance, privacy and risk management, with a strong emphasis on safeguarding Protected Health Information (PHI) through effective organizational processes, policies, employee education, and technical and administrative safeguards. This individual will collaborate across departments to build a culture of compliance while ensuring operational practices support quality care, contractual obligations and regulatory excellence.

RESPONSIBILITIES:

• Develop, implement, maintain, and continuously improve the division's Compliance Program.
• Monitor compliance with applicable federal and state regulations including HIPAA, HITECH, CMS, DHCS, CalAIM and Medi-Cal Managed Care contractual requirements.
• Interpret regulatory guidance and translate requirements into operational policies, workflows and organizational practices.
• Conduct routine compliance risk assessments and recommend corrective actions.
• Develop and maintain compliance dashboards, reports and audit tracking tools.
• Establish safeguards to prevent unauthorized access, disclosure, alteration or loss of confidential information both internally and externally.
• Develop and maintain policies governing:

• • Access controls
  • Minimum necessary standards
  • Secure communication practices
  • Document retention and disposal
  • Electronic records security
  • Remote workforce privacy safeguards
  • Incident reporting and breach response

• Collaborate with operational leadership to strengthen administrative, technical and physical safeguards.
• Investigate potential privacy incidents and coordinate breach response activities as necessary.
• Ensure Business Associate Agreements (BAAs), confidentiality agreements and data-sharing agreements remain current and compliant.
• Coordinate internal readiness for external audits, site visits and compliance reviews.
• Prepare documentation requested during audits and regulatory reviews.
• Monitor corrective action plans and ensure timely implementation.
• Develop and deliver compliance and privacy education for all employees.
• Coordinate annual HIPAA, compliance, fraud, waste and abuse and confidentiality training.
• Serve as a resource for staff regarding compliance questions and regulatory interpretation.
• Identify operational, regulatory and privacy risks.
• Develop mitigation strategies that minimize organizational exposure.
• Maintain compliance reporting systems and incident tracking logs.
• Participate in leadership meetings to provide regulatory guidance and compliance updates.
• Support organizational initiatives that improve quality, performance and member outcomes.

CORE COMPETENCIES:

• Healthcare Compliance and Regulatory Knowledge: Demonstrates knowledge of healthcare  regulations, including HIPAA, Medi-Cal, DHCS and managed care requirements, with the ability to interpret and apply regulatory standards to organizational operations.
• Privacy, Risk Management and Auditing: Identifies compliance and privacy risks, conducts audits and investigations, develops corrective action plans, and implements safeguards to protect confidential and protected health information.
• Policy Development and Program Implementation: Develops, implements and maintains compliance policies, procedures and organizational processes that support regulatory compliance and operational excellence.
• Communication, Training and Collaboration: Effectively communicates complex regulatory requirements, delivers staff education and collaborates across departments to promote a culture of ethics, accountability and compliance.
• Leadership and Continuous Improvement: Demonstrates sound judgment, integrity and strong organizational skills while leading compliance initiatives, managing multiple priorities and driving continuous improvement of the organization's compliance and privacy program.

TRAVEL:

• To assigned CCAC sites and various meetings as needed; approximately 10% of the time.

QUALIFICATIONS AND SKILLS:

Education and Experience:

• Bachelor’s degree in Public Health, Health Administration, Business Administration, Compliance, Nursing, or a related field (Master’s degree preferred)
• Two or more years of progressively responsible compliance and/or data related experience in healthcare, managed care, community health or human services.
• Experience working with California Medi-Cal programs, Managed Care Plans, or CalAIM initiatives strongly preferred.
• Demonstrated experience developing organizational compliance programs, policies, and internal controls.
• Strong knowledge of:
  1. HIPAA Privacy Rule
  2. HIPAA Security Rule
  3. HITECH Act
  4. CMS regulations
  5. DHCS requirements
  6. CalAIM initiatives
  7. Enhanced Care Management (ECM)
  8. Community Supports (CS)
  9. Fraud, Waste, and Abuse regulations
• Certified in Healthcare Compliance (CHC), Certified HIPAA Professional (CHP), Certified in Healthcare Privacy Compliance (CHPC) or willingness to obtain certification.
• Experience working with Electronic Health Records (EHRs), care management platforms, and secure health information systems.

DRIVING AND LICENSE REQUIREMENTS:

Must possess a valid CADL and applicable CA mandated auto insurance.

PHYSICAL REQUIREMENTS: 

Lift up to 20 (twenty) pounds. 

AUTHORITY AND SUPERVISORY CAPACITY: No supervision.

ACCESS TO SENSITIVE INFORMATION: Must maintain confidentiality of personal client and staff information exposed to when working in files and preparing reports.