Director, Regulatory & Enterprise Risk

Position SummaryThe Director, Regulatory & Enterprise Risk is a senior attorney responsible for providing practical regulatory legal counsel across the Company's pharmaceutical distribution, specialty pharmacy and related healthcare businesses and for helping develop and administer the Company's enterprise risk management program.Reporting to the General Counsel, the Director will serve as a primary regulatory legal resource for business and functional leaders, independently advising on complex regulatory matters, monitoring significant legal and regulatory developments and helping translate regulatory requirements into practical business guidance.The Director will also lead key elements of the Company's enterprise risk governance process, working collaboratively with Compliance and other functions and building upon the existing annual ERM survey and reporting process.The position requires substantial healthcare or pharmaceutical regulatory experience, strong business judgment and the ability to advise across multiple regulated business models.Key Responsibilities Regulatory Change ManagementEstablish and maintain a structured process to:Monitor significant regulatory developments affecting the Company's businesses.Assess applicability and potential business impact.Communicate actionable regulatory developments to affected stakeholders.Identify responsible business owners.Define implementation requirements and deadlines.Track implementation of significant regulatory changes.Document material regulatory decisions and implementation status.Identify and escalate implementation gaps presenting significant legal or business risk.Pharmaceutical Distribution RegulationProvide regulatory legal advice regarding:Federal and state pharmaceutical distribution requirements.FDA and Federal Food, Drug, and Cosmetic Act requirements affecting wholesale distribution activities.Drug Supply Chain Security Act requirements.EPCIS and electronic product-tracing requirements.Authorized trading-partner requirements.Transaction information and product-tracing obligations.Suspect and illegitimate product requirements.Saleable-return and verification requirements.Product identifiers and serialization-related requirements.Regulatory implications of drop shipments, consignments, inventory programs, and other alternative distribution arrangements.Storage, handling, shipping, returns and recall requirements.Regulatory implications of new products, customers, services and distribution models.Regulatory issues arising from manufacturer/distributor relationships.Controlled Substances and Specialized ProductsAdvise regarding Controlled Substances Act and DEA requirements affecting Company operations.Address regulatory issues involving controlled-substance distribution, storage and related business activities.Evaluate regulatory implications of new controlled products or changes in distribution models.Advise regarding active pharmaceutical ingredients and other products presenting specialized federal or state regulatory requirements.Analyze whether proposed products, activities or operational changes trigger additional registrations, licensing or regulatory requirements.Coordinate with Compliance and Licensing regarding implementation of resulting registration or licensing requirements.Operational licensing, renewals, registrations and routine licensing administration will remain with the appropriate Compliance/Licensing function.Specialty Pharmacy RegulationProvide regulatory legal advice regarding:Federal and state pharmacy-law requirements.Specialty-pharmacy operating models.Pharmacy-practice and dispensing requirements.Prescription-processing workflows.Patient intake activities.Prescription transfer requirements.Shipping and delivery of prescription products.Multistate pharmacy operations.Third parties performing pharmacy-support functions.Regulatory implications of new specialty-pharmacy products, services and workflows.Emerging regulatory issues affecting specialty-pharmacy operations.Medicare, Medicaid and Government Healthcare ProgramsAdvise regarding:CMS requirements affecting Company operations.Medicare and Medicaid regulatory developments.Medicare Advantage requirements relevant to Company activities.Government healthcare program participation requirements.Program-integrity requirements.OIG regulatory and enforcement developments.Exclusion and debarment requirements from a legal-interpretation perspective.Regulatory implications of relationships involving federal healthcare programs.PBM, Payer and Reimbursement RegulationProvide legal guidance regarding:Federal and state PBM regulatory developments.Pharmacy-network regulation.Any-willing-provider and similar network-access requirements.Network participation and termination issues.Payer requirements affecting specialty-pharmacy operations.Reimbursement-related regulatory developments.State PBM reforms and other emerging payer regulation.Regulatory implications of payer and reimbursement strategies.The Contracts organization will continue to manage commercial negotiation and administration of payer and PBM agreements, with Regulatory Legal providing substantive legal guidance as needed.Patient Access, Reimbursement and Financial ResponsibilityAdvise regarding:Electronic prior authorization requirements.Prior-authorization workflows.Benefits verification activities.Patient financial responsibility.Cash-pay arrangements.Assignment of benefits.Patient-assistance programs.Copay assistance.Patient-support programs.No Surprises Act requirements where applicable.340BMonitor and advise regarding:Federal and state 340B developments.Manufacturer contract-pharmacy restrictions.Rebate and discount models.Contract-pharmacy arrangements.Implementation implications of significant 340B legal developments.Healthcare Fraud and AbuseProvide legal guidance regarding:Federal Anti-Kickback Statute considerations.Beneficiary-inducement and Civil Monetary Penalty considerations.Discounts, rebates and other remuneration arrangements.Patient-assistance arrangements.Referral relationships.Vendor and service arrangements presenting fraud-and-abuse considerations.Other healthcare fraud-and-abuse issues affecting Company operations.HIPAA, Privacy and Healthcare DataProvide substantive regulatory legal advice regarding:HIPAA Privacy, Security and Breach Notification requirements.Permitted uses and disclosures of protected health information.Minimum-necessary requirements.Patient authorizations and consent requirements.Business associate relationships and regulatory obligations.Third-party and offshore access to protected health information.Healthcare data sharing.De-identification and use of de-identified information.Secondary uses of healthcare data.Use of prescription, claims, patient and operational data.Regulatory limitations applicable to analytics and other data uses.Emerging federal and state health-data privacy requirements.Coordinate with Corporate & Commercial counsel regarding contractual data ownership, licensing, technology and commercial data-rights issues. Artificial Intelligence, Digital Health and Emerging TechnologyMonitor healthcare and pharmaceutical regulatory developments involving artificial intelligence and emerging technologies.Advise regarding regulatory implications of AI used in distribution, pharmacy and patient-service operations.Assess regulatory considerations associated with patient-facing technologies and automated workflows.Evaluate healthcare-data and privacy implications associated with vendor use of AI.Support the development and ongoing administration of the Company's AI governance framework.Support review and risk assessment of proposed AI use cases, including identification of applicable legal, regulatory, privacy and healthcare-specific considerations.Help identify and address emerging AI risks and incorporate material AI-related risks into the Company's broader enterprise risk management framework where appropriate.Support education and guidance for employees regarding responsible and compliant use of AI technologies.Coordinate with Corporate & Commercial counsel regarding contractual, intellectual-property and commercial aspects of AI and technology.Third-Party and Outsourced ActivitiesAdvise regarding the regulatory implications of third-party, outsourced, delegated and other external service arrangements supporting the Company's operations.Advise regarding regulatory requirements applicable to the selection, oversight and use of third-party service providers.Coordinate with Legal, Compliance, Privacy, Information Security and business stakeholders regarding appropriate diligence, controls and oversight of regulated third-party activities.Enterprise Risk ManagementThe Director will help mature the Company's enterprise risk management framework while building upon the existing annual ERM survey and reporting process administered by Compliance.Responsibilities include:Lead development and maintenance of the Company's ERM framework, methodology and risk taxonomy.Partner with Compliance regarding design and evolution of the annual ERM survey and related reporting.Analyze and challenge risk ratings, trends and identified exposures.Conduct management discussions regarding significant and emerging enterprise risks.Maintain or oversee the enterprise risk register.Facilitate identification of appropriate risk owners.Track significant risk-mitigation plans and commitments.Develop meaningful key risk indicators where appropriate.Facilitate periodic risk-owner reviews.Identify emerging risks using regulatory developments, operational events, claims, compliance findings, quality information, financial information, cybersecurity developments and other enterprise data.Prepare enterprise risk dashboards and executive-level risk reporting.Support enterprise risk reporting to senior leadership and the Board or appropriate Board committee.Periodically evaluate the maturity and effectiveness of the ERM program and recommend enhancements.Business and functional leaders retain ownership of the risks within their areas. ERM provides the framework, aggregation, challenge and governance process.Compliance will continue to administer the existing ERM survey, collect responses and prepare the initial survey-based reporting, with the Director using that information as part of the broader enterprise risk evaluation process.Proactive ResponsibilitiesThe Director is expected to maintain a forward-looking regulatory and enterprise-risk function.Responsibilities include:Maintain a forward-looking regulatory horizon covering significant developments affecting pharmaceutical distribution and specialty pharmacy.Develop an annual Regulatory Priorities Plan.Prepare periodic regulatory intelligence reports identifying significant developments, business impact, required actions, responsible owners and deadlines.Conduct targeted regulatory risk reviews of significant Company operations.Participate early in new-product, new-service, new-vendor and new-business-model initiatives.Develop guidance, FAQs, decision tools and training addressing recurring regulatory questions.Identify areas where regulatory requirements are evolving faster than existing Company processes.Conduct periodic educational sessions for relevant business functions.Use regulatory developments and enterprise information to identify emerging risks before they develop into material issues.Facilitate periodic enterprise risk reviews throughout the year rather than relying solely on an annual survey.Develop risk reporting that identifies changes in risk exposure, mitigation progress and areas requiring management attention.Periodically assess the effectiveness and maturity of the Company's ERM framework and recommend improvements.Judgement and EscalationThe Director is expected to independently advise on matters within the scope of the position and exercise sound judgment regarding appropriate escalation.Matters presenting significant enterprise risk, material regulatory or enforcement exposure, suspected significant noncompliance, government investigations, novel or unsettled legal issues, major strategic implications, significant financial or reputational exposure or other issues warranting executive-level legal judgment should be elevated as appropriate.QualificationsJ.D. from an accredited law school.Active membership in good standing in at least one U.S. jurisdiction.Approximately 7–10+ years of relevant healthcare, pharmaceutical or life-sciences regulatory legal experience.Meaningful experience advising regulated healthcare or pharmaceutical businesses.Experience with pharmaceutical distribution, specialty pharmacy, pharmacy regulation, healthcare reimbursement or related areas strongly preferred.Working knowledge of relevant FDA/FDCA, DSCSA, DEA, pharmacy, CMS/federal healthcare program, fraud-and-abuse, HIPAA/privacy and related regulatory frameworks.Ability to advise across multiple regulated business models and recognize matters requiring specialized external expertise.ERM, risk-management or governance experience preferred, but not required where the candidate demonstrates strong risk-assessment and program-management capabilities.Strong business judgment and ability to translate complex regulatory requirements into practical operational guidance.Demonstrated ability to independently advise business leaders and manage sophisticated regulatory matters.Strong written and verbal communication skills.Ability to work effectively across Legal, Compliance, Quality, Operations, Finance, Information Technology and other functions.Physical requirementsVision, hearing, speech, movements requiring the use of wrists, hands and/or fingers. Must have the ability to view a computer screen for prolonged periods and the ability to sit for extended periods. Must have the ability to work the hours and days required to complete the essential functions of the position, as scheduled. Must have the ability to lift and maneuver items of at least 20 lbs. Must have the ability to travel occasionally. Working condition include normal office setting.Mental DemandsLearning, thinking, concentration and the ability to work under pressure, particularly during busy times. Must be able to pay close attention to detail and be able to work as a member of a team to ensure excellent customer service. Must have the ability to interact effectively with co-workers and customers, and exercise self-control and diplomacy in customer and employee relations’ situations. Must have the ability to exercise discretion as well as appropriate judgments when necessary. Must be proactive in finding solutions.Direct Reports NoEEO StatementFFF Enterprises and Nufactor are an equal opportunity employer and prohibits discrimination and harassment based on the following characteristics: race, color, religion, national origin, physical or mental disability, gender, age (40 years and over) qualified veteran and any other characteristic protected by state or federal anti-discrimination law covering employment. These categories are defined according to Government Code section 12920. The Company prohibits unlawful discrimination based on the perception that anyone has any of those characteristics or is associated with a person who has or is perceived as having any of those characteristics.AcknowledgementThe above statements are intended to describe the general nature and level of work being performed by the incumbent assigned to this classification. They are not intended to be construed as an exhaustive list of all responsibilities, duties, and/or skills required of all personnel so classified. The undersigned employee acknowledges receipt of the Job Description for the employee’s position and understands the essential functions, responsibilities, and qualifications of the position. Furthermore, the employee acknowledges that this Job Description does not include all the essential functions of this position, and that these essential functions may change as deemed necessary by the manager.