Director of Risk and Compliance

The Director of Risk and Compliance is responsible for developing, implementing, and monitoring the risk management and compliance program of the organization. This role involves working closely with executive leadership and employees to identify potential risks, ensuring compliance with regulatory requirements, and fostering a culture of ethical behavior and risk awareness across the organization.

The Director serves as a key organizational resource for risk-based decision‑making, helping leaders and employees understand potential exposure, evaluate the likelihood and impact of adverse events, establish appropriate controls, and develop strategies to reduce or manage risk. The Director is expected to recognize emerging risks, connect individual incidents or concerns to broader organizational trends, and translate risk information into actionable recommendations for executive leadership and the Board of Directors.

The Director reports to the Chief Operations Officer (COO) and will also provide regular updates or correspondence to the Chief Executive Officer, executive leadership, committees, and Board of Directors. The Director serves as the HIPAA Privacy Officer and leads the annual Federal Tort Claim Act application process.

The Director is responsible for overseeing the development, implementation, and monitoring of risk management strategies related to health information management. This role ensures that the organization complies with legal and regulatory requirements, protects the integrity and confidentiality of patient data, and mitigates risks associated with the management of health information. The position directly supervises the health information and medical records (HIMS) department.

• Develop and implement a comprehensive risk management strategy aligned with the organization's strategic plan and goals, including business, clinical care, patient safety, facility, and operational risks.
• Establish a consistent framework for identifying, assessing, prioritizing, mitigating, monitoring, and reporting organizational risks.
• Provide risk-based recommendations to leadership regarding the prioritization and escalation of significant risks based on likelihood, severity, impact, and organizational exposure.
• Collaborate with leaders and employees to conduct regular risk assessments and audits to identify areas of potential exposure and emerging risks.
• Collaborate with clinical leaders and employees to assess and mitigate risks related to patient safety and quality of care.
• Establish risk mitigation plans and monitor their effectiveness.
• Establish and maintain processes for reporting, investigating, escalating, and managing adverse events, patient safety concerns, incidents, and near misses.
• Evaluate incidents and near misses for immediate risk, potential systemic risk, and opportunities for improvement.
• Develop and maintain organizational crisis, emergency preparedness, and business continuity plans.
• Lead the organization's response to significant risk events, emergencies, and incidents, with a focus on patient safety and continuity of operations.
• Lead or coordinate response to data breaches, privacy incidents, and other health information risks.
• Conduct root cause analyses to identify contributing factors, systemic risks, and opportunities for improvement.
• Develop and monitor corrective and preventive actions to mitigate risk and prevent recurrence.
• Monitor claims, complaints, incidents, and adverse events for trends and opportunities to reduce organizational and patient safety risk.
• Monitor and coordinate the management of claims, potential claims, and litigation-related risks in collaboration with appropriate internal and external resources.
• Monitor incident trends and emerging risks and use findings to strengthen policies, processes, and risk mitigation strategies
• Facilitate regular reporting to executive leadership, applicable committees, and the Board of Directors regarding significant risks, trends, mitigation strategies, and areas requiring leadership attention.
• Risk Management in Health Information Management:
  • Develop and implement risk management strategies specifically related to health information management.
  • Identify, assess, and mitigate risks related to the collection, storage, processing, use, disclosure, retention, and sharing of patient health information.
  • Establish and maintain controls to mitigate risks and ensure the security and confidentiality of health information.
  • Evaluate risks…