Director of Risk & Compliance

Who We Are:

Neighborhood Health Center is a non-profit organization local to Portland, OR serving underserved patients in the areas of primary care, internal medicine, dental services and more. Our patient-centered approach to care honors the unique needs and circumstances of each individual patient. NHC sees people, not problems, and recognizes that the time spent as a patient in a doctors office is only one factor in a persons overall health. Our leading edge, integrated clinical teams work in partnership with patients, their families, and the communities we serve to provide whole-person care, prevention, and ongoing support.

NHC is an Equal Opportunity Employer. We celebrate differences in the workplace and do not discriminate in employment opportunities or practices on the basis of race, color, religion, gender (sex), national origin, age, veteran status, sexual orientation, gender identity, disability, genetic information or any other characteristic protected by law.

Why work with us?

• We are a non-profit organization, passionate about providing the underserved population with medical and dental services across the greater Portland area, committed to making a difference daily.
• We offer our employees a competitive compensation and benefits package which includes 20 days of PTO (based on full time employment), 9 paid holidays, health/dental/vision insurance, quarterly wellness reimbursements, generous 401k retirement plan with employer match, employer paid disability insurance, EAP and life insurance.
• Our employees voted NHC a Top Workplace in 2020, 2021, 2022, 2023, 2024, 2025 and 2026!

Job Title:  Director of Risk & Compliance	Department:  Administrative
Reports To:  Chief Executive Officer (CEO)	Work Type:  Hybrid
Classification:  Full-Time, Exempt	Language Differential:  Ineligible

SUMMARY

Responsible for providing strategic leadership and subject matter expertise in the development, implementation, and oversight of the organization's risk management, compliance, privacy, regulatory, and safety programs. Ensures ongoing compliance with HRSA Health Center Program requirements, federal and state healthcare regulations, and organizational policies and procedures across all service locations. Leads efforts to identify, assess, and mitigate organizational risk; promotes a culture of compliance, accountability, and continuous quality improvement; and supports organizational readiness for audits, reviews, and regulatory oversight activities. Serves as a trusted advisor to the Chief Executive Officer and Board of Directors on risk, compliance, governance, and regulatory matters, and provides recommendations to strengthen organizational integrity and operational effectiveness.

Essential Job Duties

• Acts as the designated Compliance Officer and HIPAA Privacy Officer, overseeing HIPAA Privacy Risk Assessments, risk mitigation plans, Business Associate Agreements (BAAs), and managing breach notification processes.
• Provides compliance oversight for vendors, contractors, and business partners whose services may create regulatory, privacy, financial, or operational risk as appropriate.
• Collaborates with the HIPAA Security Officer to ensure alignment of HIPAA privacy and security protocols, including security risk analysis and contribution to the organization’s data incident response readiness.
• Implements, and maintains a comprehensive organizational compliance and ethics program designed to prevent, detect, and correct non-compliance with applicable federal and state laws and regulations. This includes:
  • Oversees coordination of day-to-day compliance and risk management activities, including ensuring comprehensive risk assessments to identify potential areas of vulnerability and legal or regulatory non-compliance.
  • Establishing and overseeing a regular auditing and monitoring plan to assess compliance effectiveness across all operational areas.
  • Develops and monitors key performance indicators (KPIs) to assess risk and compliance program effectiveness, providing data-driven updates and strategic recommendations to the CEO and/or Board of Directors.
  • Overseeing and promoting an effective system for confidential reporting of suspected compliance violations (e.g., hotline, portal) and ensuring non-retaliation for good faith reporting.
  • Oversees processes for exclusion and sanction screening of employees, contractors, vendors, and providers in accordance with federal and state requirements.
  • Directs or oversees compliance, privacy, or regulatory investigations and ensures appropriate documentation, remediation, and reporting.
• Manages interactions and ensures timely responses to inquiries from external agencies including but not limited to; Occupational Safety and Health Administration (OSHA), Health Resources and Services Administration (HRSA), Center for Medicare and Medicaid Services (CMS), Oregon Health Authority (OHA) and payor audits to supply requested information in a timely manner.
• Oversees Federal Tort Claims Act (FTCA) activities including oversight and reporting of malpractice claims and the FTCA Deeming application process.
• Leads and ensures compliance with Health Resources and Services Administration (HRSA) Health Center Program requirements, including:
  • Ensuring ongoing operational adherence to the HRSA-approved Scope of Project (services, sites, and service area. Oversees compliance with HRSA's Sliding Fee Discount Program requirements, including policy development, eligibility assessment, and signage
  • Leads staff in site preparation for HRSA Operational Site Visits, and supporting all compliance audits.
  • Develops, monitors, and validates corrective action plans resulting from audits, investigations, HRSA operational site visits, external reviews, and identified compliance deficiencies.
• Ensures the establishment and maintenance of a patient complaint/grievance process compliant with HRSA requirements.
• Ensures compliance with relevant Oregon state laws and regulations, including those pertaining to patient rights, informed consent, mandatory reporting, protection of health information (which may be more stringent than HIPAA), data breach notification, clinic licensure, and public health requirements overseen by the Oregon Health Authority (OHA).
• Develops and implements strategies to prevent, detect, and respond to potential fraud, waste, and abuse (FWA) in federal healthcare programs, consistent with OIG guidance and CMS regulations. This includes providing guidance and oversight to ensure compliance with the Federal Anti-Kickback Statute, Stark Law, and other relevant fraud and abuse laws.
• Provides compliance and risk-management oversight and support for NHC's Emergency Management Program, collaborating with operational and facilities leadership to ensure regulatory requirements, training, exercises, and documentation are maintained.
• Builds ownership and accountability within clinics to ensure safety and risk management systems and processes are defined and collaborates with department leaders to ensure they are enforced.
• Promotes a strong culture of safety and risk mitigation to protect the organization’s insurance coverage against liability and casualty loss.
•  Oversees company-wide policy and procedure governance, including development, review, approval, and retirement processes, to ensure alignment with state and federal regulations and organizational needs.
• Acts as evaluating body to ensure that risk and compliance issues are investigated and evaluated in a timely manner.
• Provides oversight for required compliance-related training and attestations assigned to staff via NHC’s Learning Management System and guides the assignment of additional compliance training.
• Ensures all regulatory and/or grant-related training requirements are met and documented
• Provides oversight and guidance to the Risk and Compliance Department.
• Works with NHC’s Pharmacy Department to support compliance with HRSAs 340B Drug Pricing Program, including helping to ensure mechanisms are in place to prevent diversion and duplicate discounts and to meet recertification requirements.
• Develops and maintains succession plans and assigns backups for critical risk and compliance roles to ensure business continuity.
• Other duties as assigned.

Qualifications

Education and/or Experience

• Bachelor’s degree is required.
• Must have at least 5 years’ experience working in a leadership or management capacity within healthcare, preferably at a patient-centered or community health center environment; or an equivalent combination of education and/or experience may be qualifying.
• Any of the following certifications or combinations of certifications are preferred: Certified Healthcare Compliance (CHC), Certified Healthcare Privacy Compliance (CHPC), Associate Risk Manager (ARM), or Certified Risk Manager (CRM).

Knowledge, Skills, Abilities and Behaviors

• Knowledge of practices and regulations related to evaluating and providing patient care.
• Skill in oral and written communication including interviewing to gather medical histories, providing presentations, consultations, facilitation, and documentation.
• Ability to analyze complex data and draw valid conclusions.
• Ability to interpret, adapt and apply guidelines and procedures.
• Ability to establish and maintain positive and effective working relationships with patients, staff, and the general public.
• Demonstrated knowledge and experience in the delivery of health care to a diverse and underserved population.
• Ability to use good judgement in difficult situations.
• Ability to communicate professionally with peers, management, and patients alike.
• Demonstrated ability to lead multidisciplinary teams and influence organizational decision-making.
• Experience and proficiency using electronic health records.

WORKING CONDITIONS

• Regularly sit while working on the computer; use hands and fingers to handle, control or feel objects tools or controls; repeat the same movements when entering data; ability to differentiate between colors, shades, and brightness; read from a computer screen for extended periods of time.
• Frequently stand and walk around the office to gather supplies, required to do filing, use office equipment, or collaborate with employees.
• Occasionally stand, stoop and lift or move objects, equipment and supplies weighing approximately 20-25 pounds up to 40-50 pounds.
• The noise level in the work environment is usually moderate.

Neighborhood Health Center Employment Offers are contingent on successful completion of reference checks, background checks, drug screening for illegal substances, Tuberculosis, and any position specific credentialing or licensure requirements.