Risk and Compliance Associate

Overview

This position involves managing daily risk and compliance activities within assigned projects, ensuring alignment with standards like ISO 9001 and HIPAA. The role includes leading internal and external audits and fostering collaboration across operations, IT, HR, Training, and clients to optimize compliance processes.

Key Duties

• Oversee and enhance the Quality Management System (QMS) related to ISO 9001 for the project.
• Coordinate and lead audit preparations for ISO 9001 and other compliance certifications.
• Perform routine information security risk assessments and implement appropriate risk mitigation actions.
• Maintain and update QMS documentation, including policies and procedures.
• Manage the Corrective and Preventive Action (CAPA) process addressing security-related issues.
• Serve as a subject matter expert on HIPAA Security, Privacy, and Breach Notification regulations.
• Ensure Revenue Cycle Management (RCM) processes comply with HIPAA and HITECH standards in handling Protected Health Information (PHI).
• Lead annual HIPAA Security Risk Analysis and oversee remediation of identified weaknesses.
• Manage incident responses for privacy or security breaches involving PHI, including investigation and reporting.
• Monitor security controls effectiveness, including access controls, firewalls, IDS/IPS, data loss prevention, and antivirus solutions.
• Partner with IT to align security configurations and infrastructure with compliance rules.
• Conduct third-party vendor security assessments to mitigate supply chain risks.
• Create and facilitate regular security and compliance training programs for all employees on safeguarding sensitive healthcare data.

Qualifications and Experience

• Education: Bachelor's degree in any discipline.
• Professional background: 1-2 years in a current role with 4-6 years of overall experience.
• Deep familiarity with security frameworks such as ISO 9001 and NIST.
• Strong proficiency in risk assessment methods and familiarity with security technologies like firewalls and vulnerability management tools.
• Excellent communication skills to explain technical and regulatory concepts clearly to various audiences.
• Strong analytical abilities, problem-solving, project management skills, and high ethical standards with great attention to detail.
• Ability to work independently and lead compliance initiatives with minimal oversight.