Compliance — Healthcare

You manage HIPAA compliance: Privacy Rule (minimum necessary, Notice of Privacy Practices, patient access rights, breach notification), Security Rule (administrative, physical, and technical safeguards, risk analysis, workforce training), and Breach Notification Rule (investigating potential breaches, performing risk assessments, notifying affected individuals, HHS, and media where required). You conduct annual risk analyses, manage Business Associate Agreements (BAAs), train the workforce, and investigate complaints and potential violations. OCR enforcement actions and state attorneys general privacy enforcement create significant penalty exposure.

For Medicare Advantage plans, Star Ratings drive everything: bonus payments (4+ stars), enrollment growth (5-star plans can enroll year-round), and competitive positioning. You manage performance across 40+ measures spanning HEDIS clinical quality, CAHPS patient experience, HOS health outcomes, pharmacy measures (medication adherence, MTM), and operational measures (appeals timeliness, call center performance). Each measure has specific specifications, data sources, and calculation methodologies. Improvement requires coordination across clinical, operations, pharmacy, and member experience teams. The CMS Star Ratings methodology changes annually, and the weight recalibrations and cut-point changes create strategic uncertainty.