Governance Risk and Complains Manager

Develop, maintain, and continuously improve the organization’s enterprise GRC program.

Lead compliance activities related to:

HIPAA Privacy and Security Rules

HITRUST CSF

SOC 2 Type II

PCI-DSS

Ensure controls appropriately protect PHI, personally identifiable information (PII), payment card data, and other sensitive healthcare information.

Maintain policies, standards, procedures, risk methodologies, and control documentation.

Support compliance with Business Associate Agreements (BAAs), client security requirements, and healthcare customer contractual obligations.

Monitor changes in healthcare regulations, cybersecurity requirements, and industry standards.

Coordinate internal and external assessments, certifications, client audits, and regulatory reviews.

Conduct enterprise risk assessments and maintain the organizational risk register.

Perform third-party/vendor security risk assessments.

Develop mitigation strategies and monitor remediation activities.

Present risk metrics and executive reports to senior leadership.

Support business continuity and disaster recovery governance.

Develop and maintain an AI governance framework for the responsible use of artificial intelligence within healthcare RCM.

Establish policies and controls governing generative AI, machine learning, automation, and AI-enabled decision-support technologies.

Evaluate AI use cases involving:

Coding assistance

Denial prediction

Claims analytics

Prior authorization

Patient communication

Revenue forecasting

Assess AI solutions for privacy, security, accuracy, bias, transparency, explainability, and regulatory risk.

Ensure PHI is appropriately protected when using internally developed or third-party AI tools.

Establish approval and risk-review processes for new AI use cases and vendors.

Maintain an inventory of approved AI systems, use cases, owners, data sources, and associated risks.

Align AI governance practices with frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 where appropriate.

Lead preparation for SOC 2, HITRUST, HIPAA, PCI DSS, and customer security assessments.

Coordinate evidence collection and control testing across business and technology teams.

Manage remediation plans for audit findings, control deficiencies, and client security observations.

Respond to customer security questionnaires and due diligence requests.

Participate in security and compliance discussions with healthcare providers, health systems, physician groups, payers, and other clients.

Maintain a centralized repository of compliance evidence, audit documentation, and client assurance materials.

Lead or support vendor security and compliance assessments.

Evaluate vendors that access, process, transmit, or store PHI, PII, payment information, or other sensitive data.

Review security documentation including SOC reports, HITRUST certifications, penetration tests, and risk assessments.

Ensure appropriate BAAs, data protection agreements, and security requirements are in place.

Monitor critical vendors for changes in risk posture.

Partner with Information Security and Privacy teams to maintain administrative, technical, and physical safeguards required by HIPAA.

Support identity and access management governance for systems containing healthcare information.

Participate in incident response activities involving potential PHI exposure, security incidents, or compliance concerns.

Support breach assessment and regulatory notification processes where required.

Oversee security and compliance awareness programs for employees and contractors.

Promote appropriate handling of healthcare data across operational teams.

Develop GRC dashboards and executive reporting for risk, audit status, remediation, vendor risk, and compliance metrics.

Track key risk indicators and key performance indicators for the compliance program.

Manage compliance calendars and recurring control activities.

Lead cross-functional remediation and compliance initiatives.

Present significant risks, findings, and recommendations to senior leadership.

Drive automation and continuous improvement within the GRC program.

You are known for being thorough and crossing every “T”.

You enjoy collaboration and building relationships at every level.

Curiosity and willingness to learn new things.

Excellent organization and planning skills, both technical and strategic.

Stay updated with the latest in technology and cybersecurity trends to recommend improvements to our IT and security infrastructure.

Ability to communicate regularly and have a desire to be a part of a team.

· This role profile is not intended to be an exhaustive list of qualifications, skills, efforts, duties, responsibilities or working conditions associated with the position.

GetixHealth is an equal employment opportunity employer.