SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
UpDoc is building the first clinically validated, physician-supervised AI agent for chronic disease management, founded by Stanford physicians. You will be UpDoc's first dedicated compliance leader, designing and operating a comprehensive compliance program across five critical domains: medical device quality and regulatory affairs, health data privacy and security, healthcare fraud and abuse, clinical governance and licensure, and federal research compliance.
You will report directly to the CEO and CTO, partnering closely with the in-house regulatory and quality assurance team, outside counsel, and compliance teams at leading health systems. Your responsibilities span:
**Regulatory & Quality Partnership**: Align enterprise compliance requirements with FDA-regulated product and quality system obligations. Support cross-functional compliance as UpDoc expands products, clinical programs, partnerships, and reimbursement models.
**Privacy & Security Compliance**: Serve as HIPAA Privacy Officer and coordinate with the Security Officer on the HIPAA Security program. Own Business Associate Agreements, minimum-necessary practices, breach assessment and notification procedures. Partner on SOC 2 Type II and HITRUST readiness. Lead compliance responses to health system vendor risk assessments. Advise on HIPAA, CCPA/CPRA, and emerging health data privacy laws.
**Healthcare Regulatory & Fraud and Abuse**: Build compliance frameworks for care management, remote monitoring, and reimbursement pathways. Assess arrangements with health systems, clinicians, and partners under Anti-Kickback Statute, Stark Law, and beneficiary inducement rules. Maintain Corporate Practice of Medicine compliance across operating states.
**Clinical Governance & Licensure**: Establish and oversee clinician credentialing, licensure, scope of practice, and supervision requirements. Ensure care delivery is appropriately documented, escalated, and audited.
**Research & Grant Compliance**: Support federally funded research compliance, including human subjects protections, IRB coordination, data management, and cost allowability. Maintain conflict of interest and research integrity policies.
**Program Leadership**: Write and maintain policies; lead annual compliance risk assessment and work plan. Establish training, reporting mechanisms, and audit cadence. Prepare regular compliance and risk reporting for CEO and Board. Serve as primary compliance counterpart to customer legal, privacy, and IT security teams. Coordinate with outside counsel, auditors, and specialized advisors.
**Requirements:**
- 8+ years of healthcare compliance experience, with at least 3 years in a leadership or program-owner role
- Experience working with FDA-regulated software or digital health products; strong understanding of SaMD quality systems and post-market obligations
- Deep working knowledge of HIPAA Privacy and Security Rules; experience negotiating BAAs with health systems
- Experience supporting SOC 2, HITRUST, or comparable healthcare security and compliance frameworks
- Familiarity with Medicare care management reimbursement compliance and healthcare fraud and abuse law
- Track record of building programs from early stage rather than solely administering mature ones
- Ability to translate regulation into pragmatic guidance for engineers, clinicians, and executives; ability to hold firm positions when necessary
**Strongly Preferred:**
- Experience at a digital health or clinical AI company selling into large health systems or academic medical centers
- Exposure to federal research compliance (NIH, ARPA-H, or similar)
- Familiarity with AI-specific regulatory developments, including FDA guidance on AI-enabled device software and predetermined change control plans
- Certification such as CHC, CHPC, CIPP/US, or RAC
- JD, MPH, MHA, or equivalent graduate training; clinical background is a plus
