Senior Risk & Compliance Analyst

Company :

Highmark Health

Job Description : 

JOB SUMMARY

This job works collaboratively riskacross Highmark Health clinical areas to support clinical quality auditing, The Senior Risk Compliance Analyst is responsible for monitoring and analyzing medical and utilization management activities to ensure compliance with internal policies, state, CMS, and federal regulations. This role serves as a clinical subject matter expert, providing insights and guidance to internal departments. The Analyst conducts audits of Medical Directors, Utilization Management (UM) and Case Management (CM) processes and files, delivering feedback reports to business partners and reviewing corrective action plans. Key responsibilities include performing routine and non-routine audits of clinical information, assessing medical policy adherence and consistency in decision-making, identifying non-compliance issues, and developing and implementing quality control procedures. The Analyst also administers inter-rater reliability tests and communicates review results to business leads both verbally and in writing. This individual must have a proactive mindset and approach, and feel comfortable working in a highly matrixed environment.           

ESSENTIAL RESPONSIBILITIES

• Plan and conduct risk assessment activities according to the appropriate framework, including but not limited to NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO, in order to identify, assess, prioritize, evaluate and address clinical, information security, privacy, and other areas of risk.  Prepare draft reports and other management reporting deliverables.  Review all work prepared by less experienced team members to ensure audit quality standards are consistently met in all forms of documentation.
• Review and interpret inherent risk assessment results, engagement risks, and develop  assurance plans (e.g., on-site audit, contract review, financials assessment, purchasing data analysis) to address relevant risk areas and to ensure proper controls are implemented.  Accountable for the review and interpretation of authoritative guidance (including, but not limited to NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO reports) and performs qualitative and quantitative impact assessments based on physical, technical, and administrative safeguards as well as contractual requirements; conducts additional information gathering and risk assessments as-needed; documents and reports results.
• Lead development of project plans to support risk assessment and decisioning in coordination with business owners and other stakeholders within task-based budgets.  Collaborate and communicate with Information Security, Privacy, Procurement, Audit, Compliance, and other teams across the Enterprise to align risk management objectives, practices and procedures.
• Interface with business areas, technical staff, project teams, and third parties to execute cross-functional risk assurance projects. Lead the communication of assessment results and findings with multiple stakeholder groups and provides consultation and direction throughout.
• Interpret complex data flow/ information sharing activities, customer integrations, and information safeguards into simplified and high-level terminology and/or process/data flows.  Maintains risk management reporting dashboards in RSA Archer applications in order to keep information complete, accurate, and current.  Prepare and assist with the delivery of risk assurance reports to management. 
• Ensure risk questionnaires and other risk assessments are distributed and completed on-time and prepares initial impact assessments.  Ensure compliance requirements are met across the Enterprise.  Assist in training and mentoring team members on multi-faceted engagements, platform customer dependencies, and interpretation of complex contract agreements.
• Collaborate with lead in providing input and consultation on risk and assurance reporting.  Collaborate and consult with other areas (e.g., Procurement, Privacy, Information Security, Legal) throughout the engagement lifecycle   Assist in providing timely feedback on interpretations regarding authoritative guidance.
• Proactively reviews updates made to departmental desk-level procedures, risk assessment methodology, assessment procedures, questionnaires, training, etc. and is responsible for monitoring compliance with departmental metrics, internal control activities, contractual obligations, regulatory requirements, and responding to customer inquiries / audits. 
• Other duties as assigned or requested

PREFERRED RESPONSIBILITIES

• Clinical operations anal