Compliance Lead

About the role

The is a pivotal position responsible for steering privacy and data governance strategy within a rapidly growing health technology environment. This role owns the design of intake procedures and workflows that meticulously document data flows for clinical decision support features. You will build and maintain robust data governance structures to ensure AI capabilities align with healthcare regulations and internal company policies. A core part of this position involves reviewing vendor contracts and technical implementations to verify that privacy controls are correctly integrated prior to deployment. You will guide the configuration of features that allow practitioners to access supplement insights while rigorously safeguarding protected health information. Collaboration with security teams will help define testing protocols for authentication and authorization mechanisms used by clinician interfaces. This position requires fluency in healthcare regulations, data systems, and product development to translate complex legal requirements into actionable guidance. You will coordinate with clinical experts to verify that patient analytics maintain accuracy and remain within appropriate context. Success in this role ensures that innovation proceeds responsibly without compromising security, compliance, or patient trust in the expanding ecosystem.

Key facts

What you'll do

• Design intake procedures and workflows that capture and map data flows for clinical decision support capabilities across the platform.
• Build and maintain data governance structures that align AI capabilities with healthcare regulations and established company policies.
• Review vendor contracts and technical implementations to verify that privacy controls are correctly integrated prior to deployment.
• Configure features that enable practitioners to access supplement insights and recommendations while safeguarding protected health information.
• Collaborate with security teams to guide testing of authentication and authorization protocols for clinician interfaces and administrative tools.
• Coordinate with clinical experts to verify that patient analytics outputs maintain accuracy, context, and appropriate clinical relevance.
• Provide guidance on consent mechanisms and audit trails for high-risk functionality that touches sensitive health data.
• Document data handling processes to ensure clarity for regulators, security teams, and product managers across the organization.
• Define how data governance scales responsibly as the platform grows in user base, data volume, and regulatory scrutiny.
• Assess privacy and security risks associated with new product features using a structured risk assessment methodology.
• Serve as a subject matter expert for health data regulations, translating legal requirements into practical product and engineering guidance.
• Partner with cross-functional stakeholders to embed compliance into the product lifecycle from initial concept through launch.
• Monitor changes in North American health data regulations and translate updates into actionable policy and procedural changes.
• Support incident response and audit activities by providing clear documentation and regulatory interpretation as needed.

Requirements

• Bring three to five years of dedicated experience in privacy or compliance roles within technology or healthcare sectors.
• Demonstrate a strong understanding of HIPAA and other North American health data regulations and their practical application.
• Possess hands-on experience using SQL, Python, or comparable tools to analyze data usage, quality, and access patterns.
• Communicate clearly with both technical and clinical stakeholders, especially when operating under demanding timelines and high-stakes scenarios.
• Show knowledge of security frameworks and risk assessment methodologies specific to digital health and related regulated environments.
• Exhibit the ability to make practical decisions that balance regulatory requirements with product velocity and business objectives.
• Hold the ability to interpret complex legal and regulatory language and convert it into actionable guidance for engineering and product teams.
• Maintain a strong attention to detail when reviewing documentation, configurations, and implementations for compliance adherence.

Nice to have

• Experience in the supplement or wellness industry provides a distinct advantage due to familiarity with relevant compliance landscapes.
• Familiarity with common health technology standards and interoperability methods used in clinical data exchange.

Practical notes

Fullscript operates a hybrid work model with a requirement for employees to work from the office in Boston, Massachusetts, on a regular basis. This role is based onsite and does not offer remote or fully remote arrangements. The compensation for this position is $140,000 per year. Employment type is full-time, and candidates must be authorized to work in Canada or the United States without sponsorship for this position. The company reserves the right to verify credentials and background information as part of the hiring process. Requirements and responsibilities may vary from internal records. This description is intended to outline the essential functions of the role. It does not contain every task an employee might perform.