Compliance / Security Officer Job Description
Role Overview
The Compliance Officer is a key member of the executive leadership team, responsible for the development, implementation, and ongoing management of the organization’s Comprehensive Compliance Program. This role ensures that the organization operates in full accordance with federal and state laws, including HIPAA, CMS (Medicare Advantage/ODAG), and OIG guidelines.
Core Responsibilities and Duties
- Define Program Structure: Establish and maintain the foundational "Seven Elements" of an effective compliance program as defined by the OIG.
- Policy Development: Draft, implement, and update compliance policies and procedures.
- Define Educational Requirements: Determine the mandatory compliance curriculum for all employees and contracted providers.
- Training Oversight: Ensure completion of Fraud, Waste, and Abuse (FWA), HIPAA, and General Compliance training within 90 days of hire and annually thereafter.
- FDR Compliance: Oversee the organization’s status as a First Tier, Downstream, and Related Entity (FDR), ensuring all contracted physicians and vendors meet CMS criteria.
- Exclusion Screening: Manage the monthly screening process against OIG (LEIE) and GSA (SAM) databases for all staff and contractors.
- ODAG Monitoring: Audit the timeliness of Organization Determinations, Appeals, and Grievances to ensure compliance with CMS.
- Internal Audits: Define the annual audit calendar, focusing on high-risk areas such as multi-state licensure, billing accuracy, and telehealth prescribing.
- Reporting Mechanisms: Maintain and publicize an anonymous reporting "hotline" or channel for staff to report concerns without fear of retaliation.
- Investigations: Lead internal investigations into potential compliance breaches or unethical conduct and oversee corrective action plans.
- Compliance Committee: Chair the internal Compliance Committee and provide regular reports to the Board of Directors and Executive Leadership.
- External Liaison: Act as the primary liaison for external audits from payers (e.g., IBX) or government agencies.
- Risk Assessment: Conduct an annual enterprise-wide risk assessment to identify and mitigate emerging regulatory threats.
- Oversight: work with the technology org to ensure secure, compliant, and safe function across Engineering and IT. Jointly track customer assessments, requirements, and remediation where needed, and keep abreast of industry trends and standards.
- Vendor Management: evaluate current and potential vendors for trustworthiness, security principles and practices, and overall risk to the company. Own vendor relationships in the security and compliance space.
Qualifications
- Education: Bachelor’s degree required; Master’s, or healthcare-rela