Head of Compliance

Baba is an applied AI lab modernizing risk and care delivery for people with Medicare. We've become the fastest growing digital health system matching people with Medicare and their family caregivers with expert advocates, physicians, medications, lab testing, and AI agents to deliver insurance-covered care across all 50 states. In the last 8 months, we've completed tens of thousands of appointments and partnered with health plans covering more than 4 million Medicare beneficiaries. On any given day, our team's work spans population health research, applied AI research, clinical care delivery, and fintech infrastructure.

We're a Series A company with $40M+ in funding. Our team is half engineers, a third former founders, and comes from places like Ramp, Stripe, Liquid AI, Palantir, MIT, and CMU. Our clinical operations are led by the former Executive Director of Care Transitions from the Mount Sinai Health System. We believe that talent density is our greatest competitive advantage.

Interested candidates should email [email protected] with a short summary of the most challenging problem they've worked on and a link to their LinkedIn.

About the Role

Baba bills commercial and government payers in all 50 states. That puts licensure, credentialing, coding, privacy, marketing claims, and payer contract obligations directly in the path of our growth. You'd be the first person here whose full-time job is compliance.

You'll report to our CEO and work across RCM, Payer Strategy, Credentialing and Licensing, Clinical Operations, Engineering, Marketing, and Legal. The job is part judgment and part execution: working out what a regulation actually requires of us, then getting other teams to operate in accordance.

This is a compliance role, not a legal one. A JD is welcome but not required, and you'd partner with our outside counsel rather than replace them.

Location: Full-time. We'd prefer someone in NYC who can be in our Soho office two or three days a week. We're a small team and most decisions happen in conversation rather than in documents, so proximity matters more here than it would at a larger company. For the right person we'll consider remote, with regular onsite time.

The compliance program itself. Policies, procedures, code of conduct, and the monitoring and auditing cadence behind them. Very little of this exists today.

Risk assessment. Find where we're exposed across our processes and systems, size each risk honestly, and tell leadership what you'd do about it.

Day-to-day advice to the business. RCM, Payer Strategy, Clinical Ops, Marketing, and Product will bring you live decisions on real timelines. The useful version of this weighs regulatory risk against what the business is actually trying to do.

Audit readiness. You're our point of contact for payer audits, delegated credentialing reviews, and regulatory inquiries. That means keeping documentation current rather than assembling it under pressure.

Investigations and remediation. When something goes wrong, you run it down, fix it, and make sure the fix holds.

Reporting and training. Build the reporting that shows leadership where we stand, and a training program the rest of the team will take seriously.

Few people have depth across all of this. We're looking for someone who can get to depth quickly and become the person the company asks:

• Fraud, waste, and abuse: Anti-Kickback Statute, False Claims Act, Stark, and beneficiary inducement rules

• HIPAA privacy and security, plus state privacy laws including CCPA and Washington's My Health My Data Act

• Medicare and Medicaid enrollment, program integrity, and payer contract obligations

• Delegated credentialing and NCQA standards

• State licensure, scope of practice, and telehealth requirements for providers across 50 states

• Corporate practice of medicine and our professional entity structure

• FTC and state consumer protection standards for health and marketing claims

• Documentation and coding integrity across the revenue cycle

• Governance for AI used in clinical and patient-facing contexts

• You have 5–7 years in compliance, legal, strategy, or operations. Healthcare startups, health tech, and consulting are all good backgrounds, particularly if you worked somewhere under-resourced enough that you had to invent the process yourself.

• You run complicated cross-functional projects well and things don't get dropped.

• You write clearly. An executive with no compliance background should be able to read your summary and act on it.

• You're comfortable making calls with incomplete information, and you can tell a real risk from a theoretical one.

• You're hands-on. There's no team here yet, so you'll be writing the policy, building the tracker, and running the meeting.

Nice to have:

• Healthcare compliance experience, particularly with payers, provider networks, or telehealth

• CHC, CHPC, CHPS, or CIPP/US certification

• Experience as the DRI for a payer audit or regulatory inquiry

• JD, MPH, MBA, or similar