McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve – we care.
What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.
Position Summary
The Senior Healthcare Compliance Analyst is responsible for leading and supporting healthcare regulatory compliance initiatives across the organization, ensuring the protection of electronic Protected Health Information (ePHI) and adherence to healthcare industry regulations and certifications.
This role serves as a subject matter expert for HIPAA Security Rule compliance, healthcare privacy requirements, HITRUST certification activities, and related healthcare regulatory obligations. The analyst will partner with Legal, Privacy, Technology, Business Units, and Cybersecurity teams to assess compliance, identify risks, validate control implementation, collect and evaluate evidence, coordinate remediation activities, and maintain ongoing audit readiness.
The position plays a key role in supporting the organization's HIPAA Security Program, healthcare risk assessment activities, continuous monitoring efforts, regulatory audits, and compliance assurance initiatives.
Key Responsibilities
HIPAA Compliance & Risk Analysis
Lead and support HIPAA Security Rule compliance activities across applications, systems, and business processes that create, receive, maintain, or transmit ePHI.
Conduct and facilitate HIPAA Security Assessments and Attestations for in-scope applications.
Support enterprise HIPAA Risk Analysis and Risk Management activities.
Validate implementation and effectiveness of administrative, technical, and physical safeguards.
Identify compliance gaps and coordinate remediation efforts with business and technology stakeholders.
Provide guidance on HIPAA Security Rule requirements and compliance obligations.
Support the maintenance of audit-ready evidence demonstrating compliance with HIPAA requirements.
Healthcare Regulatory Compliance
Support compliance activities across healthcare and privacy regulations including: HIPAA Security Rule
HIPAA Privacy Rule
HITECH
HITRUST CSF
PIPEDA
GDPR
CMMC
Monitor evolving healthcare regulatory requirements and assess organizational impact.
Support implementation of regulatory compliance initiatives.
Maintain documentation demonstrating regulatory compliance and control effectiveness.
HITRUST & Healthcare Certification Programs
Support HITRUST certification and validated assessment activities.
Perform control assessments, testing, and evidence reviews against HITRUST CSF requirements.
Coordinate remediation activities for identified HITRUST control deficiencies.
Maintain supporting documentation required for assessments, external reviews, and certification activities.
Assist with continuous monitoring activities to sustain certification of readiness between assessment cycles.
Compliance Assessments & Assurance
Conduct healthcare-focused risk assessments and compliance reviews.
Evaluate security and privacy controls against regulatory and industry requirements.
Review evidence to validate control implementation and operating effectiveness.
Track remediation plans and ensure timely closure of identified gaps.
Support internal and external audits, regulatory reviews, and customer compliance requests.
Develop compliance reports, metrics, dashboards, and executive-level status updates.
Partner with Privacy & Data Protection
Partner with Privacy teams to support identification and assessment of systems containing PHI or ePHI.
Evaluate controls supporting the confidentiality,…