Compliance and Privacy Program Lead

Position Summary The Compliance and Privacy Program Lead serves as the day-to-day owner of Detego Health's compliance and privacy program. This role is responsible for designing, implementing, operating, measuring, and continually improving compliance and privacy processes across the organization in a healthcare third party administrator environment. The immediate first-year priority is reliable privacy operations and a working investigations and corrective action process, including individual rights request handling, privacy incident and breach response, and compliance investigation intake through closure. The metrics, monitoring, training, and audit readiness scope build from that foundation as the program matures. The successful candidate will lead privacy and compliance investigations, support regulatory readiness, maintain program documentation and evidence, coordinate corrective actions, manage privacy and compliance reporting, and work closely with Legal, Security, Enterprise Risk, Operations, Cost Containment, Human Resources, vendors, and business stakeholders. This is a hands-on operational role. Success is measured by whether compliance and privacy processes function effectively, risks are identified and addressed, investigations are completed, regulatory obligations are met, and leadership has clear visibility into program performance. The candidate must be able to identify risk, make practical recommendations, escalate material concerns, and operate with limited supervision. Key Responsibilities Compliance and Privacy Investigations • Conduct, document, and manage compliance and privacy investigations from intake through closure • Conduct investigations arising from confidential reporting channels, policy violations, regulatory concerns, and compliance matters • Escalate to and coordinate with Legal when a matter carries litigation, privilege, or material regulatory exposure, and conduct legal directed investigations under that direction • Perform root cause analysis • Track corrective actions to completion • Maintain investigation files and supporting evidence Privacy Program Operations • Operate privacy processes for individual rights requests, privacy concerns, incident response, breach analysis, and documentation • Maintain the Record of Processing Activities and related data inventories as living artifacts that match actual business operations • Conduct privacy assessments for new processes, technologies, vendors, and AI related use cases, including PHI use, minimum necessary, retention, transparency, and human oversight Compliance Program Operations • Monitor compliance obligations and regulatory requirements • Assist departments in implementing compliance controls and corrective actions • Support compliance reviews and targeted monitoring activities • Conduct and document periodic compliance risk assessments and assist in the development of mitigation plans • Conduct periodic compliance and privacy program effectiveness assessments and recommend improvements • Operate the compliance intake channel and manage resulting cases to closure Training and Awareness • Develop and deliver compliance and privacy education programs • Maintain new hire and annual training requirements • Develop awareness materials, guidance documents, FAQs, alerts, and compliance communications Governance, Metrics, and Reporting • Establish and maintain compliance and privacy metrics • Develop dashboards and leadership reporting • Track investigation trends, corrective actions, training completion, privacy incidents, compliance concerns, policy acknowledgments, and other program indicators • Present findings and recommendations to leadership Audit and Regulatory Readiness • Maintain organized evidence repositories • Support HIPAA, SOC 2, URAC, client audits, and regulatory reviews • Coordinate document requests and responses • Five or more years of healthcare compliance, privacy, investigations, audit, regulatory affairs, risk, or related experience • Strong knowledge of the HIPAA Privacy Rule, the HIPAA Breach Notification Rule, and healthcare regulatory compliance • Experience conducting investigations and managing corrective actions through to closure • Experience developing and operating compliance or privacy programs, processes, or controls, not only drafting policy • Experience creating metrics, dashboards, reports, or compliance monitoring activities • Strong written and verbal communication skills • Ability to operate independently, escalate clearly, and influence stakeholders across the organization • CHC or CHPC strongly preferred on the compliance side • CIPP/US strongly preferred on the privacy side • CIPM, CCEP, or a similar certification is a plus • A candidate without a certification should offset it with a demonstrable operating track record and be willing to obtain a relevant certification within 12 months • Healthcare TPA, health plan, managed care, or healthcare services experience • Experience with SharePoint, Power Automate, Vanta, BitSight, or similar governance tools