Chief Compliance, Privacy & Legal Officer
Job Description Job Description Located in Manhattan, The New York Proton Center (NYPC) is one of the most unique and respected clinical partnerships in the world of proton therapy. The collaboration between Memorial Sloan Kettering Cancer Center, Montefiore Medical Center and Mount Sinai Health System brings state of the art proton therapy treatment to the patients of New York and the surrounding areas. Our team at NYPC is comprised of highly motivated, passionate, professional and engaged individuals working together as a dynamic team to deliver an exceptional level of patient care, providing the most advanced proton therapy technology. We offer our employees a competitive compensation and benefits package with flexibility for growth and career advancement. If you meet the criteria and would like to be a part of our collaborative, innovative and patient focused team, please apply with a cover letter and copy of your resume, or CV, to the current opportunity listed below. Position Summary: The Chief Compliance, Privacy & Legal Officer leads legal, compliance, privacy, risk management, and insurance matters and advises the CEO, executive leadership, and Board. The role maintains and oversees the compliance and privacy program, mitigates organizational risks, and partners with leaders on practical solutions. The Chief Compliance, Privacy & Legal Officer promotes integrity and accountability, and ensures significant concerns are identified, escalated, investigated, and resolved. The Chief Compliance, Privacy & Legal Officer manages key external advisor relationships, including outside legal counsel, insurance brokers, carriers, and other external advisors, and establishes priorities and work plans for the organization’s legal, compliance, privacy, and risk functions. The position exercises a high degree of independence and professional judgment. Duties and Responsibilities: Position Summary: The Chief Compliance, Privacy & Legal Officer leads legal, compliance, privacy, risk management, and insurance matters and advises the CEO, executive leadership, and Board. The role maintains and oversees the compliance and privacy program, mitigates organizational risks, and partners with leaders on practical solutions. The Chief Compliance, Privacy & Legal Officer promotes integrity and accountability, and ensures significant concerns are identified, escalated, investigated, and resolved. The Chief Compliance, Privacy & Legal Officer manages key external advisor relationships, including outside legal counsel, insurance brokers, carriers, and other external advisors, and establishes priorities and work plans for the organization’s legal, compliance, privacy, and risk functions. The position exercises a high degree of independence and professional judgment. Duties and Responsibilities: Legal & Strategic Counsel Serve as a trusted legal and strategic advisor to the CEO, executive leadership, and Board on significant legal, regulatory, contractual, operational, governance, and strategic matters. Provide practical, business-oriented legal guidance that supports organizational objectives while managing risk. Advise on legal and regulatory considerations related to strategic initiatives, organizational changes, new programs, technologies, and significant business arrangements. Identify emerging legal and regulatory developments and advise leadership on potential impacts and required actions. Partner with leaders across the organization to develop practical solutions to complex legal, compliance, privacy, and risk matters. Manage outside counsel, including scope, strategy, performance, and costs related to specialized matters, litigation, investigations, and regulatory issues. Establish priorities, goals, and work plans for the legal, compliance, privacy, and risk functions while protecting confidentiality, attorney-client privilege, and work-product protections. Compliance & Ethics Maintain, implement, and oversee the Compliance & Ethics Program, including related policies and controls, in accordance with applicable laws, regulations, accreditation standards, and industry requirements. Establish compliance priorities and maintain an annual work plan based on organizational risks and regulatory obligations. Maintain and update the Code of Conduct to provide clear, current guidance to employees and other applicable individuals. Oversee compliance risk assessments, monitoring, and audits; communicate relevant regulatory developments; and direct appropriate mitigation, remediation, and corrective actions. Maintain independent and effective processes for receiving, reviewing, escalating, investigating, and resolving compliance concerns, employee reports, patient complaints, and incident reports. Coordinate regulatory responses and required background, exclusion, sanction, and other screenings for applicable individuals. Identify, review, and address potential conflicts of interest involving outside relationships and activities. Maintain and update compliance training for employees, managers, medical staff, and other applicable individuals. Promote a culture of compliance, accountability, integrity, and ethical conduct. Maintain organized documentation of compliance activities, including assessments, audits, investigations, corrective actions, and training. Provide regular compliance reports to the CEO, executive leadership, the Board, and other appropriate leaders. Privacy & Data Protection Serve as the organization’s HIPAA Privacy Officer and privacy leader. Oversee compliance with HIPAA and other applicable privacy and data protection requirements, including related policies, training, audits, and controls. Oversee the appropriate use, access, disclosure, retention, and protection of protected health information and other sensitive data, and advise on related data governance and information management practices. Lead responses to privacy incidents and potential breaches, including investigation, risk assessment, notification, remediation, and reporting. Advise leaders on privacy and data protection considerations for new initiatives, products, services, and emerging technologies, including AI, analytics, and cloud services. Assess privacy risks involving vendors and business arrangements, and ensure third-party and business associate agreements include appropriate privacy, confidentiality, security, and regulatory protections. Partner across the organization to identify, assess, and reduce privacy and data protection risks. Contract Review & Negotiation Review, draft, negotiate, and oversee a broad range of organizational contracts and agreements. Advise departments and executive leadership regarding contractual obligations, risks, indemnification, liability, confidentiality, termination provisions, intellectual property, privacy, insurance requirements, and other material terms. Establish appropriate contract review, approval, execution, and retention processes and ensure contracts are properly documented and maintained. Negotiate with vendors, service providers, consultants, business partners, and other third parties to protect the organization’s legal and financial interests. Partner with Finance, Procurement, Information Technology, Human Resources, Clinical Operations, and other departments on significant contractual matters. Ensure contracts appropriately address applicable legal, compliance, privacy, cybersecurity, insurance, and risk management requirements. Advise leadership regarding significant contractual obligations, disputes, renewals, and potential areas of financial or operational exposure. Risk Management & Insurance Maintain legal and operational risk management framework that ensures compliance and supports the identification, assessment, mitigation, monitoring, and reporting of material risks. Ensure the organization’s insurance program is effectively managed in collaboration with Finance and insurance brokers, including coverage review, renewals, certificates of insurance, and risk-transfer strategies. Advise executive leadership regarding insurance coverage, exclusions, deductibles, indemnification obligations, and other risk-transfer considerations. Coordinate with insurance brokers, carriers, outside counsel, and other external advisors regarding insurance matters, as appropriate. Provide regular reporting to executive leadership and the Board regarding significant enterprise risks, insurance matters, and risk mitigation strategies. Investigations & Incident Management Lead or oversee investigations involving compliance, privacy, legal, ethical, regulatory, or other sensitive concerns, including assessment, remediation, follow-up, and documentation. Establish appropriate processes for receiving, documenting, triaging, investigating, and resolving compliance and privacy concerns. Coordinate investigations and incident responses with Human Resources, Information Technology, Information Security, Security, executive leadership, and outside counsel, as appropriate. Ensure appropriate corrective actions, remediation, and regulatory reporting are completed when required. Maintain appropriate confidentiality, attorney-client privilege, and work-product protections in connection with legal and investigative matters. Oversee the appropriate escalation of significant legal, compliance, privacy, regulatory, and ethical matters to executive leadership and the Board. Regulatory & External Affairs Serve as a primary organizational liaison, as appropriate, with governmental, regulatory, accreditation, and oversight agencies regarding legal, compliance, privacy, and regulatory matters. Oversee the organization’s response to regulatory inquiries, audits, investigations, subpoenas, corrective action requests, and other formal requests from governmental or regulatory authorities. Coordinate regulatory disclosures and reporting obligations with executive leadership, relevant departments, and outside counsel, as appropriate. Monitor emerging regulatory developments and assess their potential impact on the organization’s operations, strategy, and risk profile. Board & Governance Advise the Board and relevant committees on significant legal, regulatory, compliance, privacy, governance, and enterprise risk matters. Monitor corporate governance requirements and emerging issues, and support the Board and executive leadership in meeting their legal, fiduciary, compliance, and governance obligations. Maintain independence and direct access to executive leadership and the Board on significant compliance, legal, privacy, and risk matters. Qualifications: Juris Doctor (J.D.) from an accredited law school required. Admission to practice law in New York State is required. 5 years of progressively responsible legal, regulatory, compliance, privacy, or related experience, preferably within a healthcare environment. Demonstrated experience leading or overseeing healthcare compliance and/or privacy programs. Experience advising executives and Boards on complex legal, regulatory, compliance, privacy, governance, and risk matters, with strong knowledge of healthcare regulation, contracts, and fraud and abuse laws. Knowledge of HIPAA and healthcare privacy requirements. Experience overseeing investigations, regulatory inquiries, audits, corrective actions, and remediation. Strong legal analysis, judgment, negotiation, and risk assessment skills. Strong contract drafting, negotiation, and management skills. Knowledge of insurance, risk transfer, and enterprise risk management. Ability to translate complex legal and regulatory requirements into practical recommendations. Ability to communicate complex issues clearly and concisely to executives and the Board. Sound independent judgment, confidentiality, and professional integrity. Commitment to ethics, accountability, excellence, and the organization’s mission. Additional education or certification in healthcare compliance, privacy, risk management, or a related field preferred. CHC, CHPC, CCEP, or comparable certification preferred. Nonprofit governance and regulatory experience preferred.
