Director of Risk and Compliance

Heartland Community Health Center – Lawrence, KS; Lawrence (KS); Sur place; USD 82 000 - 120 000; Plein temps

Résumé du poste

Heartland Community Health Center – Lawrence, KS is seeking a Director of Risk and Compliance to develop and oversee the organization’s risk management and compliance programs. The role partners with executive leadership to identify risks, ensure regulatory adherence, and foster a culture of ethical risk awareness across the health system.

The Director will supervise the HIMS department, serve as HIPAA Privacy Officer, and coordinate the FTCA annual application, reporting to the COO.

Responsabilités

• Develop and implement a comprehensive risk management strategy aligned with the organization's strategic plan and goals.
• Establish a consistent framework for identifying, assessing, prioritizing, mitigating, monitoring, and reporting organizational risks.
• Collaborate with leaders to conduct risk assessments and audits to identify exposures and emerging risks.
• Lead or coordinate responses to significant risk events, emergencies, and incidents with a focus on patient safety and continuity of operations.
• Serve as HIPAA Privacy Officer and lead the FTCA annual application process.
• Supervise the Health Information Management (HIMS) department and ensure compliance with privacy, security, and information governance requirements.
• Provide training and education on compliance-related topics and monitor regulatory inquiries and inspections.

Description du poste

Position Overview

The Director of Risk and Compliance is responsible for developing, implementing, and monitoring the risk management and compliance program of the organization. This role involves working closely with executive leadership and employees to identify potential risks, ensuring compliance with regulatory requirements, and fostering a culture of ethical behavior and risk awareness across the organization.

Job title

Director of Risk and Compliance

Reports to

Chief Operations Officer

Status

Exempt (Salaried $82,000 - $120,000)

Position Overview

The Director of Risk and Compliance is responsible for developing, implementing, and monitoring the risk management and compliance program of the organization. This role involves working closely with executive leadership and employees to identify potential risks, ensuring compliance with regulatory requirements, and fostering a culture of ethical behavior and risk awareness across the organization.

The Director serves as a key organizational resource for risk-based decision-making, helping leaders and employees understand potential exposure, evaluate the likelihood and impact of adverse events, establish appropriate controls, and develop strategies to reduce or manage risk. The Director is expected to recognize emerging risks, connect individual incidents or concerns to broader organizational trends, and translate risk information into actionable recommendations for executive leadership and the Board of Directors.

The Director reports to the Chief Operations Officer (COO) and will also provide regular updates or correspondence to the Chief Executive Officer, executive leadership, committees, and Board of Directors. The Director serves as the HIPAA Privacy Officer and leads the annual Federal Tort Claim Act application process.

The Director is responsible for overseeing the development, implementation, and monitoring of risk management strategies related to health information management. This role ensures that the organization complies with legal and regulatory requirements, protects the integrity and confidentiality of patient data, and mitigates risks associated with the management of health information. The position directly supervises the health information and medical records (HIMS) department.

Duties and Responsibilities

• Risk Management:
• Develop and implement a comprehensive risk management strategy aligned with the organization's strategic plan and goals, including business, clinical care, patient safety, facility, and operational risks.
• Establish a consistent framework for identifying, assessing, prioritizing, mitigating, monitoring, and reporting organizational risks.
• Provide risk-based recommendations to leadership regarding the prioritization and escalation of significant risks based on likelihood, severity, impact, and organizational exposure.
• Collaborate with leaders and employees to conduct regular risk assessments and audits to identify areas of potential exposure and emerging risks.
• Collaborate with clinical leaders and employees to assess and mitigate risks related to patient safety and quality of care.
• Establish risk mitigation plans and monitor their effectiveness.
• Establish and maintain processes for reporting, investigating, escalating, and managing adverse events, patient safety concerns, incidents, and near misses.
• Evaluate incidents and near misses for immediate risk, potential systemic risk, and opportunities for improvement.
• Develop and maintain organizational crisis, emergency preparedness, and business continuity plans.
• Lead the organization's response to significant risk events, emergencies, and incidents, with a focus on patient safety and continuity of operations.
• Lead or coordinate response to data breaches, privacy incidents, and other health information risks.
• Conduct root cause analyses to identify contributing factors, systemic risks, and opportunities for improvement.
• Develop and monitor corrective and preventive actions to mitigate risk and prevent recurrence.
• Monitor claims, complaints, incidents, and adverse events for trends and opportunities to reduce organizational and patient safety risk.
• Monitor and coordinate the management of claims, potential claims, and litigation-related risks in collaboration with appropriate internal and external resources.
• Monitor incident trends and emerging risks and use findings to strengthen policies, processes, and risk mitigation strategies
• Facilitate regular reporting to executive leadership, applicable committees, and the Board of Directors regarding significant risks, trends, mitigation strategies, and areas requiring leadership attention.

• Risk Management in Health Information Management:
• Develop and implement risk management strategies specifically related to health information management.
• Identify, assess, and mitigate risks related to the collection, storage, processing, use, disclosure, retention, and sharing of patient health information.
• Establish and maintain controls to mitigate risks and ensure the security and confidentiality of health information.
• Evaluate risks associated with health information systems, workflows, vendors, technology, access controls, data sharing, and information disclosure.
• Monitor and evaluate the effectiveness of risk management strategies and adjust as necessary.
• Lead or coordinate responses to significant health information incidents, including privacy or security incidents and potential data breaches.
• Compliance Oversight:
• Serve as the HIPAA Privacy Officer.
• Ensure the organization complies with all relevant laws, regulations, and industry standards.
• Ensure that health information management practices comply with relevant healthcare regulations, including HIPAA, HITECH, HRSA, CMS, and other federal and state laws.
• Serve as the lead for the Federal Tort Claims Act (FTCA) risk management annual application.
• Develop and maintain compliance policies and procedures.
• Assess and monitor risks associated with vendors, contractors, business associates, and other third parties, including contractual, regulatory, privacy, security, and operational risks.
• Monitor changes in laws and regulations that could impact on the organization and update policies accordingly.
• Conduct regular compliance audits and investigations.
• Provide training and education for employees on compliance-related topics.
• Monitor the Peer Review policy and procedures in collaboration with clinical leaders.
• Manage and respond to regulatory inquiries, inspections, and site visits as applicable.
• Policy Development:
• Develop and implement policies and procedures that promote ethical behavior, regulatory compliance, patient safety, and effective risk management.
• Develop, implement, and maintain policies and procedures related to health information management, patient safety incident response, and risk mitigation.
• Ensure policies and procedures are effectively communicated and supported through appropriate training and education.
• Oversee employee adherence to the organization's policies and procedures.
• Evaluate the effectiveness of internal controls and recommend modifications when controls are insufficient or risks change.
• Risk, Compliance, and Quality Improvement:
• Continuously evaluate the effectiveness of the organization's risk management and compliance programs.
• Establish meaningful performance indicators and measures to monitor risk, compliance, patient safety, incident management, and HIMS performance.
• Analyze data and trends to identify emerging risks and opportunities for improvement.
• Use data, incident trends, audit findings, claims, complaints, and other information to prioritize risk management activities.
• Monitor completion and effectiveness of corrective action plans.
• Identify opportunities to strengthen internal controls, processes, communication, and accountability.
• Stay current on emerging risks, regulatory developments, industry standards, and best practices in healthcare risk management, compliance, patient safety, and health information management.
• Health Information Management (HIMS) Management:
• Directly supervise and provide leadership to the HIMS department.
• Ensure HIMS operations incorporate appropriate risk management, compliance, privacy, security, and information governance practices.
• Provide guidance and support to HIMS staff regarding regulatory requirements, risk identification, documentation, privacy, disclosure, and information management.
• Monitor HIMS processes for potential compliance, operational,