Clinical Compliance Manager

Clinical Compliance Manager (US Healthcare)

Own US healthcare compliance and AI governance across our marketplace. You'll define the HIPAA boundary, operationalize CPOM sensitivities, drive SOC 2 alignment, manage vendors/BAAs, and run a pragmatic policy & audit program that keeps product velocity high and risk low.

Hybrid (Austin, TX) or Remote (US)

Full-time

Competitive salary + equity

AI Governance HIPAA CPOM SOC 2 Policy Compliance & Operations Remote

Compliance ownership Define and maintain US compliance posture: HIPAA boundary, CPOM sensitivity, SOC 2 alignment, state privacy coverage, records & retention.

AI & data Establish AI guardrails (no PHI to non-approved endpoints, evals, human-in-the-loop), and data minimization/consent patterns.

Enablement Turn policy into checklists, templates, and build-time gates; partner with Product, Eng, Security, and Provider Ops.

Focus

Examples

Policy lifecycle Draft → review → train → attest → audit → update Acceptable Use, Privacy, Data Handling, Incident Response, AI Use Policy

Data handling Classification, minimization, retention & deletion Record of Processing, "no-train/no-share" flags, PHI boundary docs

Controls & audits Map controls to frameworks; test & evidence Change mgmt, access reviews, backups, vendor reviews, training logs

Incident readiness Runbooks, tabletop drills, notifications Breach decision tree, forensics partners, comms templates

AI governance

Boundary: No PHI/consumer health data to non-approved LLM endpoints; BAAs and region controls where applicable.

Guardrails: Retrieval-first for sensitive flows, allow-lists, output filters, role-separated contexts, human review for risky actions.

Evaluation: Offline eval sets, red-team prompts, regression gates; track cost/latency/quality and drift.

Clinical boundary

No medical advice. AI features inform navigation and education only; clinical judgment remains with licensed providers.

Regulatory scope

Area

Scope

Notes

HIPAA awareness Define when we're a covered entity/business associate vs. consumer app Boundary docs; BAAs; marketing vs. operations distinctions

CPOM sensitivity Corporate practice of medicine awareness by state Clear clinic–marketplace separations; DISCLAIMERS; routing rules

State health privacy Consumer health privacy requirements (e.g., consent, disclosures) Granular opt-outs, sensitive data flags, tracking governance

SOC 2 alignment Trust Services Criteria mapping Control owners, evidence, auditor liaison

Records & retention Schedules, legal holds, deletion System-of-record matrices; periodic purge jobs

• DPAs/BAAs, scopes, subprocessor tracking, renewal calendars.
• Data egress allow-lists; key & region controls verified.
• Checklists in PRD/RFC templates; compliance gates in CI (evidence links).
• Training & attestations; quarterly access reviews.
• Incident playbooks; post-mortems with corrective actions.

Success metrics

Metric

Definition

Guardrails

Control health % key controls tested "pass" on schedule with evidence Focus on risk-weighted controls, not vanity counts

Vendor posture % vendors with current reviews/BAAs; issue closure time Critical vendors reviewed at least annually

Training & attestation % employees current on privacy/AI/compliance training New hire within 30 days; annual refresh 100%

Incident readiness Tabletop & runbook coverage; MTTR for drills/incidents Notification decisions within SLA; lessons captured

AI guardrail efficacy Eval pass rate; PHI egress block rate; regression escapes No medical advice; cost/latency within SLO

Requirements

Must-have

Nice-to-have

• 5+ years in healthcare compliance, privacy, or risk (US).
• Operational HIPAA awareness, vendor/BAA management, and policy lifecycle ownership.
• Experience partnering with Product/Eng/Security at product velocity.
• US work authorization; ability to support periodic on-site/offsite travel.
• SOC 2 / ISO 27001 control mapping and audit liaison experience.
• Exposure to consumer health privacy regimes and CPOM nuances.
• AI governance experience (guardrails, evals, data boundary decisions).
• Clinical background or experience in telehealth/marketplaces.

Hiring process

Step

What to expect

Typical time

Screen 30 min on compliance judgment, vendor/BAA approach, and AI governance perspective. ~1 week

Deep dive Walkthrough of HIPAA boundary & state privacy trade-offs; sample artifacts (redacted welcome). ~1 week

Practical Time-boxed exercise or prior work review (policy snippet + vendor risk scenario + AI guardrail outline). 3–7 days

Panel Cross-functional discussions with Product/Eng/Security/Provider Ops; incident tabletop scenario. ~1 week

Offer Comp band, benefits, start date. Background check post-offer where lawful. 48–72 hours

Equal Opportunity: We welcome applicants of all backgrounds and do not discriminate on any protected basis.

Right to work: US work authorization required; export‑control compliance may apply to some tools/vendors.