Sr Director of Compliance

About Us

At SimplePractice, we are improving access to quality care by equipping health and wellness clinicians with all the tools they need to thrive in private practice. 

More than 250,000 providers trust SimplePractice to build their business through our industry-leading software with powerful tools that simplify every part of practice management. From admin work to clinical care, our suite of innovative solutions work together to reduce administrative burden—empowering solo and small group practitioners to thrive alongside their clients. 

Award-winning and people-first, SimplePractice is shaping the future of health tech. In 2026, we were recognized by BuiltIn as a Best Remote Company to Work For, Software Guru's Best Places to Code, Becker Healthcare Telehealth Companies to Know, and we won a MedTech Breakthrough Award for Best Practice Management Solution Provider.

The Role

We're hiring a Senior Director of Compliance to own our regulatory compliance program end to end — the person accountable for making sure we handle protected health information, and the businesses that depend on us, the way the law and our customers expect.

You'll report to the Chief Legal Counsel and work in close partnership with our CISO and Product/Engineering leadership. This is a strategy and program-ownership role: you'll set direction and represent our compliance posture to the executive team, while a team of managers and analysts runs the day-to-day operations you design.

Responsibilities

Program strategy & governance

• Define the compliance program, set the compliance program's roadmap, priorities, and risk appetite; own risk assessments and the compliance risk register and hold risk-acceptance authority up to a defined threshold, escalating above it to the CLO.

• Chair a cross-functional Compliance/Privacy/Security steering group with Legal, Security, and Product.

Regulatory implementation

• Convert legal interpretation of HIPAA, state health-data privacy laws, 42 CFR Part 2, AI laws and other applicable regimes as they evolve into internal policy, control requirements, and product specifications.

• Own the compliance policy library:  approval authority, review cadence, and mapping policies to the controls they satisfy.

Product & risk

• Sit in product planning and governance for regulated feature areas, surface risk and work with Legal on regulatory readiness before launch of higher-risk features.

• Own the vendor risk program- set the risk-tiering methodology and BAA standards for the vendor risk program; personally review and sign off on high-risk or critical vendors.

Audits, incidents & investigations

• Own certification and audit strategy: annual audits for existing certifications, what to pursue and when, and stand behind the resulting posture with customers and the board, while a GRC manager runs fieldwork and evidence collection.

• Coordinate the business side of regulatory examinations, audits, and subpoenas alongside Legal, which retains control of legal strategy.

Culture & reporting

• Own the content and cadence of company-wide compliance training and set the standards and escalation tiers for internal compliance advisory.

• Deliver a biannual compliance program report to the CLO, CEO, and board Audit/Risk Committee covering risk posture, open remediation, and the risk horizon.

Required Skills and Experience

• 15+ years of experience in healthcare regulatory compliance, risk, or GRC, including at least 7 years leading a compliance program or function.

• Experience on both sides of the table — inside a covered entity (health system, practice group, or payer) and inside a health-tech/SaaS vendor operating as a business associate.

• Deep working knowledge of HIPAA (Privacy, Security, Breach Notification, and Enforcement Rules), state comprehensive and health-specific consumer privacy laws, and 42 CFR Part 2.

• Have personally led an organization through a real regulatory event — an OCR investigation, a state AG inquiry, a reportable breach, or a certification remediation against a hard deadline.

• Experience shipping compliance requirements into a live product roadmap inside an agile/SaaS environment.

• Track record building and managing a compliance team and owning a budget.

• Certified in Healthcare Compliance (CHC), or willingness to obtain within the first year.

• Executive presence: able to present risk in business terms to a CEO or CLO.

Bonus Points

• CHPC or CIPP/US.

• Working familiarity with HITRUST, SOC 2, ISO 27001, or PCI DSS sufficient to direct audit strategy.

• Experience with behavioral/mental health-specific compliance requirements.

• JD or health-law background (not required, and not a substitute for operating experience — this is not a legal role).

• Familiarity with ONC Health IT Certification and information-blocking rules.

Benefits

We offer a competitive benefits program including:

• Medical, dental, vision, life & disability insurance
• 401(k) plan with company match 
• Flexible Time Off (FTO), wellbeing days, paid holidays, and summer Fridays
• Mental health resources
• Paid parental leave & Backup Care
• Tuition reimbursement
• Employee Resource Groups (ERGs)

California Job Applicant Privacy Notice

Thank you for your interest in opportunities at SimplePractice LLC (“SimplePractice” or “us” or “we” or “our”). Please note that when you submit your resume or application materials to us for employment purposes, you are subject to the SimplePractice California Job Applicant Privacy Notice. 

For more information about our privacy practices, please contact us at [email protected].

Notice to Candidates

SimplePractice has been made aware of fraudulent job postings and unaffiliated third parties posing as our recruiting team. We do not have any affiliation or connection to these situations and only post open roles on our official Careers page (simplepractice.com/careers) and reputable job boards like our official LinkedIn or Indeed pages. 

All official SimplePractice recruitment emails will be sent from the domains @simplepractice.com, [email protected] or no‑[email protected] email addresses. 

Examples of fraudulent domains include careers-simplepractice.com, simplepractices.com, and simplepractice.careers.

Please note that SimplePractice will never ask candidates or new hires for money or payment of any kind at any stage of the recruitment or onboarding process.