Compliance and Privacy Manager

centralcalasthma; Fresno (CA); On-site; USD 90,000 - 135,000; Full time

Job summary

Central California Asthma Collaborative (CCAC) seeks a Compliance and Privacy Manager to lead the community health division's compliance program, safeguarding PHI and ensuring adherence to HIPAA, HITECH, CMS, CalAIM, and Medi-Cal requirements.

Reporting to the Director of Community Health and Director of Data Analytics, the CPM will translate regulatory guidance into operational policies, educate staff, and coordinate audits.

Qualifications

• Bachelor’s degree in public health or related field; master preferred.
• 2+ years compliance/data experience in healthcare.
• Experience with California Medi-Cal/CalAIM preferred.
• Experience developing organizational compliance programs and internal controls.
• Knowledge of HIPAA, HITECH, CMS, DHCS, CalAIM, ECM, CS, FCA compliance.
• CHC/ CHP/ CHPC or willingness to obtain certification.
• Experience with EHRs and care management platforms.

Responsibilities

• Develop, implement, maintain and improve the division's Compliance Program.
• Monitor compliance with HIPAA, HITECH, CMS, DHCS, CalAIM and Medi-Cal contractual requirements.
• Interpret guidance and translate into policies, workflows and practices.
• Conduct regular compliance risk assessments and recommend corrective actions.
• Develop and maintain compliance dashboards, reports and audit tracking tools.
• Establish safeguards to prevent unauthorized access or loss of PHI.
• Develop and maintain BAAs, confidentiality agreements and data-sharing agreements.
• Coordinate readiness for audits, site visits and regulatory reviews.
• Deliver compliance and privacy education for all employees.
• Coordinate annual HIPAA, compliance, FWA and confidentiality training.

Skills

Healthcare compliance

Regulatory knowledge

Privacy risk management

Training & education

Leadership

Education

Bachelor's degree in Public Health/Health Administration/Compliance

Master's degree preferred

CHC/ CHP/ CHPC certification or willingness to obtain

Tools

EHR systems

Job description

ORGANIZATIONAL BACKGROUND

The Central California Asthma Collaborative (CCAC) is a non-profit organization dedicated to reducing the burden of asthma and other health disparities in the San Joaquin Valley.

POSITION SUMMARY

The Compliance and Privacy Manager (CPM), under the direction of the Director of Community Health and Director of Data Analytics, is responsible for developing, implementing and overseeing the Community Health Division’s compliance program to ensure adherence to federal, state, and contractual requirements governing Medi-Cal services. The CPM serves as the organization's subject matter expert on regulatory compliance, privacy and risk management, with a strong emphasis on safeguarding Protected Health Information (PHI) through effective organizational processes, policies, employee education, and technical and administrative safeguards. This individual will collaborate across departments to build a culture of compliance while ensuring operational practices support quality care, contractual obligations and regulatory excellence.

RESPONSIBILITIES

• Develop, implement, maintain, and continuously improve the division's Compliance Program.
• Monitor compliance with applicable federal and state regulations including HIPAA, HITECH, CMS, DHCS, CalAIM and Medi-Cal Managed Care contractual requirements.
• Interpret regulatory guidance and translate requirements into operational policies, workflows and organizational practices.
• Conduct routine compliance risk assessments and recommend corrective actions.
• Develop and maintain compliance dashboards, reports and audit tracking tools.
• Establish safeguards to prevent unauthorized access, disclosure, alteration or loss of confidential information both internally and externally.
• Develop and maintain policies governing:
  • Access controls
  • Minimum necessary standards
  • Secure communication practices
  • Document retention and disposal
  • Electronic records security
  • Remote workforce privacy safeguards
  • Incident reporting and breach response
• Collaborate with operational leadership to strengthen administrative, technical and physical safeguards.
• Investigate potential privacy incidents and coordinate breach response activities as necessary.
• Ensure Business Associate Agreements (BAAs), confidentiality agreements and data-sharing agreements remain current and compliant.
• Coordinate internal readiness for external audits, site visits and compliance reviews.
• Prepare documentation requested during audits and regulatory reviews.
• Monitor corrective action plans and ensure timely implementation.
• Develop and deliver compliance and privacy education for all employees.
• Coordinate annual HIPAA, compliance, fraud, waste and abuse and confidentiality training.
• Serve as a resource for staff regarding compliance questions and regulatory interpretation.
• Identify operational, regulatory and privacy risks.
• Develop mitigation strategies that minimize organizational exposure.
• Maintain compliance reporting systems and incident tracking logs.
• Participate in leadership meetings to provide regulatory guidance and compliance updates.
• Support organizational initiatives that improve quality, performance and member outcomes.

CORE COMPETENCIES

• Healthcare Compliance and Regulatory Knowledge: Demonstrates knowledge of healthcare regulations, including HIPAA, Medi-Cal, DHCS and managed care requirements, with the ability to interpret and apply regulatory standards to organizational operations.
• Privacy, Risk Management and Auditing: Identifies compliance and privacy risks, conducts audits and investigations, develops corrective action plans, and implements safeguards to protect confidential and protected health information.
• Policy Development and Program Implementation: Develops, implements and maintains compliance policies, procedures and organizational processes that support regulatory compliance and operational excellence.
• Communication, Training and Collaboration: Effectively communicates complex regulatory requirements, delivers staff education and collaborates across departments to promote a culture of ethics, accountability and compliance.
• Leadership and Continuous Improvement: Demonstrates sound judgment, integrity and strong organizational skills while leading compliance initiatives, managing multiple priorities and driving continuous improvement of the organization's compliance and privacy program.

TRAVEL

• To assigned CCAC sites and various meetings as needed; approximately 10% of the time.

QUALIFICATIONS AND SKILLS

Education and Experience

• Bachelor’s degree in Public Health, Health Administration, Business Administration, Compliance, Nursing, or a related field (Master’s degree preferred)
• Two or more years of progressively responsible compliance and/or data related experience in healthcare, managed care, community health or human services.
• Experience working with California Medi-Cal programs, Managed Care Plans, or CalAIM initiatives strongly preferred.
• Demonstrated experience developing organizational compliance programs, policies, and internal controls.
• Strong knowledge of:
  1. HIPAA Privacy Rule
  2. HIPAA Security Rule
  3. HITECH Act
  4. CMS regulations
  5. DHCS requirements
  6. CalAIM initiatives
  7. Enhanced Care Management (ECM)
  8. Community Supports (CS)
  9. Fraud, Waste and Abuse regulations
• Certified in Healthcare Compliance (CHC), Certified HIPAA Professional (CHP), Certified in Healthcare Privacy Compliance (CHPC) or willingness to obtain certification.
• Experience working with Electronic Health Records (EHRs), care management platforms, and secure health information systems.

DRIVING AND LICENSE REQUIREMENTS

Must possess a valid CADL and applicable CA mandated auto insurance.

PHYSICAL REQUIREMENTS

Lift up to 20 (twenty) pounds.

AUTHORITY AND SUPERVISORY CAPACITY

No supervision.

ACCESS TO SENSITIVE INFORMATION

Must maintain confidentiality of personal client and staff information exposed to when working in files and preparing reports.