Director of Risk & Compliance

The Director of Risk and Compliance manages Gracelight Community Health's ("Gracelight") corporate compliance and risk management programs across all health center sites and administrative operations, in support of the Chief Operating Officer, who serves as the organization's designated Compliance Officer and HIPAA Privacy Officer. The Director oversees the credentialing and privileging program, ensures ongoing compliance with HRSA Health Center Program requirements and applicable federal and state regulations, and prepares compliance and risk reporting for executive leadership and the Audit Committee of the Board of Directors. This role is based at the administrative office and requires regular travel to Gracelight locations.

ESSENTIAL DUTIES:

1. Operates and continuously improves the corporate compliance program under the direction of the designated Compliance Officer, including written standards, education, monitoring and auditing, reporting channels, investigation and response, and corrective action.
2. Ensures ongoing compliance with HRSA Health Center Program requirements (Section 330), including support for operational site visits, grant conditions, and required policies.
3. Administers the HIPAA privacy program in support of the designated HIPAA Privacy Officer; manages privacy policies, breach assessment and reporting, and patient rights requests, and coordinates with the Security Officer function on the HIPAA security program and risk assessments.
4. Oversees the credentialing and privileging program for licensed and certified personnel, including initial credentialing, recredentialing, privileging, primary source verification, and expirables tracking, in accordance with HRSA and FTCA requirements and in coordination with the Chief Medical Officer for clinical review and approval.
5. Manages the incident reporting system across all sites; ensures incidents, patient grievances, and complaints are logged, investigated, resolved, and trended, and that findings reach the appropriate leaders.
6. Conducts and documents internal investigations of compliance concerns; maintains confidential reporting channels and enforces non-retaliation.
7. Performs monthly OIG/SAM exclusion screening for employees, contractors, and vendors; documents results and remediates findings.
8. Owns the policy management cycle; maintains the policy library, drives scheduled reviews and approvals, and ensures policies reflect current law and practice.
9. Manages the annual compliance training calendar, including new hire and annual refresher training and targeted training in response to identified risks.
10. Coordinates risk management activities, including professional and general liability matters, FTCA deeming and redeeming applications, claims coordination with counsel and insurers, and insurance renewals.
11. Prepares and presents compliance and risk reports for the Compliance Officer, executive team, and Board Audit Committee, including work plans, audit results, and corrective action status.
12. Coordinates responses to external audits, surveys, payer reviews, and regulatory inquiries.
13. Maintains the annual compliance work plan and risk assessment; adjusts priorities based on findings, enforcement trends, and organizational change.
14. Maintains compliance with all applicable federal, state, and local regulations, HRSA Health Center Program requirements, and Gracelight policies and procedures.
15. Performs other duties as assigned.

• Bachelor’s degree in healthcare administration, public health, business, or a related field; equivalent directly related experience may substitute for the degree.
• Minimum of five (5) years of progressive experience in healthcare compliance, risk management, or regulatory affairs, including at least two (2) years in a management or program-leadership role. Experience in a community health center, FQHC, or safety-net setting strongly preferred.
• Licensure and certification — Certification in Healthcare Compliance (CHC), Certified in Healthcare Privacy Compliance (CHPC), or similar credential preferred; may be obtained within twelve (12) months of hire.
• Working knowledge of HIPAA, HRSA Health Center Program requirements, and federal and California healthcare regulations, including compliance program structure, credentialing and privileging, incident and grievance management, and risk management practices. Proficiency with Microsoft Office; experience with compliance, incident reporting, or policy management systems preferred.
• Demonstrated ability to conduct investigations, write clear findings, and present to executive and board audiences. Strong interpersonal and communication skills and demonstrated ability to work with a diverse workforce and patient population. Bilingual English/Spanish preferred.