VP of Compliance and Regulatory Greater Boston, MA Area

Position Summary

XRHealth is seeking a VP, Compliance and Regulatory to build and lead the company's compliance and regulatory function from the ground up. This is a senior, cross-functional leadership role responsible for ensuring XRHealth operates in full compliance with healthcare regulatory requirements, data privacy laws, and corporate governance standards across all jurisdictions in which we operate. The ideal candidate combines deep healthcare regulatory expertise (HIPAA, digital therapeutics/SaMD considerations, telehealth) with international data privacy knowledge (GDPR, Israeli privacy law, Australian Privacy Act) and the ability to design scalable compliance programs for a fast-growing, multi-entity digital health company.

Key Responsibilities

Regulatory Strategy & Healthcare Compliance

Act as internal auditor and coordinator of XRHealth's regulatory strategy, including monitoring FDA guidance on Software as a Medical Device (SaMD) and digital therapeutics as applicable across operations — this role coordinates and audits strategy

Ensure ongoing HIPAA compliance across the organization, including policies, training, risk assessments, and breach response protocols

Monitor and interpret evolving telehealth and digital health regulations across US states and international markets

Serve as the primary point of contact for regulatory inquiries, audits, and inspections

Data Privacy & Security Compliance

Lead compliance with global data privacy frameworks, including GDPR (Spain/EU), Israeli Privacy Protection Law, Australian Privacy Act, and US state privacy laws

Partner with IT/Security to maintain data governance policies, vendor risk assessments, and incident response plans

Oversee cross-border data transfer mechanisms and ensure appropriate safeguards are in place

Corporate & Employment Compliance

Build compliance frameworks across XRHealth's three legal entities

Partner with People Operations on employment law compliance

Support M&A due diligence and integration from a compliance/regulatory risk perspective

Maintain and update company policies, codes of conduct, and compliance training programs (including HIPAA and Cultural Competency training)

Program Building & Governance

Design and implement a scalable, risk-based compliance program appropriate for a growing digital health company

Establish compliance monitoring, auditing, and reporting cadences to executive leadership and the Board

Build relationships with outside counsel and external regulatory advisors across jurisdictions

Develop and manage compliance-related documentation, SOPs, and audit trails

Qualifications

10+ years of progressive compliance, regulatory affairs, or healthcare legal experience, with at least 3-5 years in a senior leadership role

Background as a lawyer with a strong grounding in healthcare regulations required

Deep working knowledge of HIPAA and US healthcare regulatory frameworks; familiarity with digital therapeutics/SaMD regulatory considerations strongly preferred

Experience with international data privacy regulation (GDPR required; Israeli or Australian privacy law experience a plus)

Prior experience in digital health, health tech, medical device, or a comparable regulated industry

Experience building compliance programs from the ground up in a fast-growing or multi-entity organization

Strong track record partnering cross-functionally with HR, Legal, Finance, and executive leadership

JD, compliance certification (e.g., CHC, CIPP/E, CIPP/US), or equivalent advanced degree preferred

Exceptional judgment, discretion, and communication skills; comfortable operating as a hands-on builder as well as a strategic advisor

Experience working across international/multicultural teams; Spanish or Hebrew language skills a plus

This job description is intended to convey information essential to understanding the scope of the role and is not exhaustive. Responsibilities may evolve as the company and function grow.