Veradigm Comprehensive Submissions (VCS) is how health plans get complete, accurate, and defensible data to regulators. Encounter and supplemental data submissions sit at the point where clinical data, claims data, revenue, and audit exposure all meet. A submission that is late, incomplete, or unsupported by the medical record shows up as lost risk-adjusted revenue, a failed audit, or a corrective action plan.

As Principal Product Manager for VCS, you own the most complex and strategically significant problems in that portfolio. You are the person the company relies on to know what CMS, HHS, state Medicaid agencies, and NCQA actually require, when those requirements change, and what that change means for our roadmap and for our clients' financial and compliance outcomes.

This is a hands-on principal individual-contributor role on an empowered product team. You will spend your time with health plan risk adjustment leaders, compliance officers, and submissions operations teams; in the regulations and technical specifications themselves; and with your engineering and design partners deciding what to build. You will set the standard for continuous discovery and outcome accountability across the submissions portfolio, and you will coach other product managers on regulatory product craft.

Regulatory depth is the core requirement for this role. We are looking for someone who has personally lived through submission cycles, sweeps deadlines, error reconciliation, and audit response, and who can turn that experience into product.

What You'll Contribute:

Regulatory and Compliance Ownership

Serves as the company's authority on encounter and supplemental data submission requirements across Medicare Advantage, commercial ACA, Medicaid, and quality reporting; owns the product interpretation of the rules and defends it to clients, auditors, and executives.
Monitors and interprets regulatory change, including CMS Advance Notices and Rate Announcements, HHS Notice of Benefit and Payment Parameters, EDGE server business rules and interface control documents, state Medicaid companion guides, and NCQA HEDIS technical specifications; converts change into assessed, prioritized, and dated roadmap commitments.
Owns compliance readiness for the portfolio: submission deadline and sweeps calendars, data validation and audit trail requirements, record retention, and the evidence a plan needs to substantiate submitted data during RADV, HHS-RADV, or state audit.
Partners with Legal, Privacy, Compliance, and Security on HIPAA, HITRUST, and SOC 2 obligations affecting protected health information in submission workflows, and on client-facing attestations and audit responses.
Establishes the accuracy, completeness, and timeliness measures the portfolio is held to, including acceptance and rejection rates, error resolution cycle time, and reconciliation of submitted data against payer-reported response files.

Product Strategy and Outcomes

Defines and owns accountability for business and customer outcomes across the VCS portfolio; establishes the success metrics and outcome frameworks that guide discovery and delivery, and reports honestly against them.
Defines multi-year strategy and roadmap for submissions, anchored in where regulation, payer economics, and interoperability are heading rather than in current feature parity.
Builds and maintains the competitive and buy-versus-build picture across risk adjustment and submissions vendors; makes explicit recommendations on where Veradigm should differentiate, partner, or exit.
Influences product strategy beyond direct scope, particularly where submissions intersect with risk adjustment analytics, care gap closure, provider data exchange, and Veradigm's clinical data assets.

Discovery and Customer Insight

Leads continuous discovery with health plan risk adjustment, compliance, quality, and submissions operations leaders; designs research, prototype, and data experiments that validate high-stakes regulatory bets before engineering effort is committed, and sets the discovery standard for the team.
Defines the approach for assessing and mitigating the four product risks (value, usability, feasibility, and business viability) on initiatives where a wrong answer creates regulatory exposure, and coaches senior product staff on applying it.
Develops and maintains deep working knowledge of the customer, the data, the business, and the market; is recognized internally and externally as the domain expert for payer submissions.
Uses production and client data directly to find where submissions fail, where error volume concentrates, and where operational workarounds signal a product gap.

Delivery, Launch, and Execution

Champions and models the product trio with engineering and product design; drives shared decision making and coaches team leads on effective trio partnership.
Leads cross-functional product development and launch from concept to delivery for the portfolio's most complex initiatives; ensures alignment across engineering, QA, professional services, and technical operations.
Authors and owns technical and functional specifications for large-scale initiatives, including data mapping, transaction and file format specifications, validation logic, and error handling; translates dense regulatory constraints into requirements engineers can build against.
Synthesizes and arbitrates requirements across clients, operations, compliance, and engineering for a multi-generational portfolio; resolves conflicts and drives alignment.
Plans releases against immovable regulatory deadlines; manages the trade-offs and cross-organizational dependencies that come with dates the company cannot negotiate.
Represents vision, strategy, roadmap, and regulatory risk to executive leadership with authority and clarity.

Commercial and Market Leadership

Defines and manages the product P&L within scope; sets program commitments, drives launch and go-to-market strategy with Marketing and Sales, and establishes performance baselines.
Develops and manages strategic partner and vendor relationships, including clearinghouses, data aggregators, and audit and coding partners; evaluates and negotiates business and contractual arrangements.
Leads client advisory boards and user groups; represents Veradigm at industry forums such as RISE, AHIP, and NCQA events, and mentors senior product staff on domain expertise and product craft.

Required Qualifications:

Education:

Bachelor's Degree in a technical, business, health administration, or health informatics discipline, or equivalent work experience

Work Experience:

10+ years of relevant experience in product management, technical program management, or solutions management, with at least 5 years in healthcare payer data, risk adjustment, or regulatory submissions
5+ years in a payer, payer-services, or health IT organization with direct accountability for regulated data submissions

Regulatory and Submissions Experience:

Candidates must bring demonstrated, hands-on depth in the majority of the following, and expert-level depth in at least two:

Medicare Advantage risk adjustment and encounter data. Working knowledge of the Encounter Data Processing System (EDPS) and legacy RAPS, EDR and CRR submission and correction workflows, MAO-002 and MAO-004 response file handling, Model Output Report (MOR) and Monthly Membership Report reconciliation, risk score calculation and the CMS-HCC V28 model transition, and the Part C and Part D reporting and sweeps calendar.
RADV audit support. Experience preparing for or responding to CMS Risk Adjustment Data Validation audits, including medical record retrieval and coordination, one-best-record selection, coder review workflows, discrepancy and appeal handling, and extrapolation exposure.
Commercial ACA risk adjustment. Hands-on experience with the CMS EDGE server, including enrollment, medical, pharmacy, and supplemental submissions, EDGE business rules and interface control documents, RATEE and default risk adjustment charge avoidance, data submission and quality thresholds, and HHS-RADV initial validation audit and second validation audit cycles.
Medicaid encounter submissions. Experience with state Medicaid managed care encounter reporting, including state-specific companion guides and file layouts, encounter acceptance and denial reconciliation, state performance and completeness standards, and T-MSIS implications.
Quality and Stars reporting. Experience with HEDIS supplemental data (standard and non-standard), Electronic Clinical Data Systems (ECDS) reporting, NCQA HEDIS Compliance Audit and primary source verification, Medicare Star Ratings measure mechanics, and how clinical data feeds both quality and risk adjustment.
EDI and healthcare data standards. Practical fluency with X12 837I and 837P, 835, 277CA, 999 and TA1 acknowledgments, and 834 enrollment, plus ICD-10-CM, CPT, HCPCS, LOINC, RxNorm, and NDC code sets and their annual update cycles.
Clinical data and interoperability. Familiarity with HL7 v2, C-CDA, FHIR (US Core and USCDI), TEFCA and QHIN participation, and how EHR-sourced clinical data is used to support submitted diagnoses.

Additional Work Experience:

Track record of delivering measurable business and customer outcomes, not features shipped
Experience defining product strategy and multi-year roadmaps at enterprise scope
Experience leading advanced product discovery and establishing discovery practice for a team
Experience managing products under hard external compliance deadlines with material financial or regulatory consequence for missing them
Experience in executive stakeholder management and influencing at senior leadership level

Knowledge, Skills, and Abilities:

Reads primary regulatory source material directly, including the Federal Register, CMS technical specifications, and NCQA specifications, and forms an independent, defensible interpretation rather than relying on secondary summaries.
Deep fluency in the empowered product team model, including outcomes over output, continuous discovery, the product trio, and the four product risks, applied at enterprise scale and used to coach senior product staff.
Strong ability to define, synthesize, and manage complex requirements from multiple stakeholders across product generations.
Excellent analytical and problem-solving skills; comfortable working in data directly, including SQL, to investigate submission and error patterns rather than waiting on an analyst.
Solid understanding of the software product development lifecycle and experience executing it end to end.
Strong verbal and written communication skills; can explain a regulatory constraint to an engineer, a technical trade-off to a compliance officer, and a strategy to a board.
Sound judgment under regulatory ambiguity; distinguishes what the rule requires, what is defensible, and what is merely common practice, and says so plainly.
Strong interpersonal skills and a collaborative approach; works effectively in matrixed environments.
Demonstrated ability to manage multiple priorities and track work to on-time, on-budget delivery.
Intellectual curiosity and a commitment to quality; approaches problems in a balanced, solutions-oriented way.

Preferred Qualifications:

Master's Degree, MBA, MPH, or MHA
Professional certification such as CRC (AAPC Certified Risk Adjustment Coder), CPC, CHC, or CPHQ
Experience shipping products used by health plan operations teams at scale, including workflow, exception handling, and audit trail design
Experience with high-volume data pipelines, cloud data platforms, or SaaS multi-tenant data processing
Experience applying automation or machine learning to coding, chart review, or data validation, including how to govern it in a regulated context

Travel:

Up to 25% travel may be required for client sites, advisory boards, and industry conferences
International travel may be required

Compensation for this job is subject to market conditions, geographic considerations, the candidate’s unique skills and experience, state and local laws, and budget. Our commitment to pay transparency is a testament to our dedication to creating a fair, equitable, and inclusive workplace. By continuously analyzing market trends, staying abreast of changes in state laws, and making budgetary adjustments accordingly, we strive to ensure that our compensation practices reflect the value we place on our associates’ unique contributions and support their professional growth.

Enhancing Lives and Building Careers

Veradigm believes in empowering our associates with the tools and flexibility to bring the best version of themselves to work and to further their professional development. Together, we are In the Network. Interested in learning more?

Take a look at our Culture, Benefits, Early Talent Program, and Additional Openings.

Visa Sponsorship is not offered for this position.

At Veradigm, our greatest strength comes from bringing together talented people with diverse perspectives to support the needs of healthcare providers, life science companies, health plans, and the patients they serve. The Veradigm Network is a dynamic, open community of solutions, external partners, and cutting-edge artificial intelligence technologies that provide advanced insights, technology, and data-driven solutions. Veradigm offers a comprehensive compensation and benefits package, including holidays, vacation, medical, dental, and vision insurance, company paid life insurance and retirement savings.

Veradigm’s policy is to provide equal employment opportunity and affirmative action in all of its employment practices without regard to race, color, religion, sex, national origin, ancestry, marital status, protected veteran status, age, individuals with disabilities, sexual orientation or gender identity or expression or any other legally protected category. Applicants for North American based positions with Veradigm must be legally authorized to work in the United States or Canada. Verification of employment eligibility will be required as a condition of hire. Veradigm is proud to be an equal opportunity workplace dedicated to pursuing and hiring a diverse and inclusive workforce.

From a "VEVRAA Federal Contractor" We request Priority Referral of Protected Veterans

This is an official Veradigm Job posting. To avoid identity theft, please only consider applying to jobs posted on our official corporate site.

Thank you for reviewing this Veradigm opportunity. Does this look like a great match for your skill set? If so, scroll on down and tell us more about yourself!

About the company

Veradigm provides healthcare technology solutions that use real-world data to improve how care is delivered and reimbursed. Its offerings include ePrescribe, clinical data registries, risk adjustment, quality management, and ambulatory claims tools, which draw on real-world data to support better clinical decisions and streamlined operations. The company differentiates itself by offering an integrated platform that serves providers, payers, and biopharma, backed by validated data sources and proven methodologies. Its goal is to improve clinical outcomes and financial efficiency across the healthcare ecosystem.

Company Size

1,001-5,000

Company Stage

IPO

Headquarters

Chicago, Illinois

Founded

1986

Get referred to Veradigm

See people who can refer or advise you

Simplify's Take

What believers are saying

Health Network Architecture launched May 6, 2026, with AI features rolling out throughout 2026.
Christian Greyenbuhl became CFO in 2026, replacing interim leadership and stabilizing finance.
September 15, 2026 Jefferies and Deutsche Bank appearances keep management visible to investors.

What critics are saying

The September 2026 vendor API breach exposed patient SSNs and invites class-action lawsuits.
Veradigm still owes 2025 and 2026 filings, signaling persistent controls and audit weakness.
Repeated security incidents and filing delays threaten customer trust and could depress renewals.

What makes Veradigm unique

Veradigm connects 450,000 providers and 200M patient records across its network.
Health Network Architecture gives independent practices real-time clinical, financial, and operational visibility.
Its payer and biopharma data products monetize unique point-of-care and real-world evidence.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Hybrid Work Options
Tuition Reimbursement

Growth & Insights and Company News

6 month growth

49%

1 year growth

49%

2 year growth

47%

Cybersol

Sep 27th, 2026

ShinyHunters expose 6.4M in attack on medical supplier McKesson.

ShinyHunters expose 6.4M in attack on medical supplier McKesson. Source Originally from "ShinyHunters expose 6.4M in attack on medical supplier McKesson" by The Register - View original. Vendor risk governance failure: McKesson's 6.4M record breach exposes healthcare supply chain liability gaps. Why this matters at board and regulatory level. When ShinyHunters compromised McKesson - a critical medical supplier serving 3,300+ oncology providers across 29 states - the breach extended far beyond a single organization's data loss. The exposure of 6.4 million records spanning patient data, staff credentials, and healthcare provider contacts demonstrates a systemic governance failure: healthcare organizations lack binding contractual mechanisms to enforce, audit, and verify vendor security controls proportional to the sensitivity of data those vendors hold. The $55.2 million extortion demand reveals that threat actors now price attacks based on a vendor's position in the supply chain and the downstream liability exposure they create. This pricing model transforms vendor selection from a procurement decision into a board-level governance priority - yet most healthcare organizations remain unprepared to manage the cascading notification obligations, regulatory exposure, and liability allocation that follow a vendor breach of this scale. The supply chain leverage problem. McKesson's position as a critical infrastructure node in healthcare supply chains creates asymmetric risk exposure. A compromise at this level does not affect only McKesson's direct contractual relationships; it propagates through multiple layers of healthcare providers, patients, and staff. Yet the contractual frameworks governing vendor relationships typically fail to specify minimum security controls, real-time audit rights, or binding incident notification timelines. Most healthcare organizations discover - only after a breach occurs - that their vendor contracts lack clarity on who bears responsibility for notification costs, who funds regulatory remediation, and how liability is allocated if disclosure is delayed or incomplete. The concurrent breaches at Boston Scientific and Veradigm, both traced to compromised third-party vendor credentials, reveal a second structural weakness: credential hygiene and access control segregation across vendor ecosystems. When a single compromised credential grants access to multiple downstream systems, the breach becomes a supply chain cascade rather than an isolated incident. This pattern indicates that healthcare organizations have not implemented contractual requirements mandating multi-factor authentication, credential rotation, and access logging for third-party integrations. Under NIS2 and DORA frameworks, critical infrastructure operators and financial entities must assess and monitor supply chain security; healthcare organizations subject to similar regulatory expectations must translate these mandates into enforceable contractual language that specifies minimum technical controls, audit rights, and forensic disclosure obligations. Notification complexity and liability allocation. A breach affecting 6.4 million records triggers notification obligations under HIPAA, state breach notification laws, and potentially GDPR if European patients or providers are affected. However, contractual relationships between vendors and downstream customers often fail to allocate responsibility for notification timing, forensic disclosure, and regulatory reporting. Many healthcare organizations lack contractual clarity on whether their vendor must notify them within a specific timeframe, provide forensic details necessary for regulatory submissions, or assume liability for regulatory fines resulting from delayed or incomplete notification. This ambiguity creates operational chaos and legal exposure at the moment when coordinated, rapid response is most critical. The incident also exposes how vendor risk governance frameworks often overlook extortion as a distinct liability vector. A $55.2 million ransom demand creates pressure on the vendor to negotiate, potentially delaying breach disclosure to downstream customers and regulators. Contractual frameworks should explicitly prohibit vendors from negotiating ransom payments without notifying affected customers and should require vendors to maintain cyber liability insurance that covers both breach response costs and downstream customer notification obligations. Without these contractual anchors, healthcare organizations face scenarios where their vendor's negotiation decisions directly affect their own regulatory exposure and liability timeline. Cybersol's perspective: where governance frameworks break down. This incident reveals a critical distinction between technical security and governance-level risk management. The technical attack vector - credential compromise via a third-party vendor environment - is well-understood and preventable through standard access controls. The governance failure is contractual and organizational. Most healthcare vendor agreements were drafted before ransomware became a primary extortion mechanism, before supply chain attacks became the dominant attack pattern, and before regulators began holding organizations accountable for vendor security failures. Organizations typically overlook three specific risk layers: * Contractual specificity on security controls: Vendor contracts often reference "industry-standard security" or "reasonable safeguards" without defining what these terms mean operationally. Contracts should specify minimum technical controls (MFA, encryption, access logging), audit frequency, and remediation timelines for identified vulnerabilities. * Notification obligation clarity: Contracts should specify that vendors must notify the organization within 24-48 hours of discovering a breach, provide forensic details within 5 business days, and assume responsibility for notifying affected individuals if the vendor's negligence caused the breach. * Cyber liability insurance as a contractual requirement: Vendors should be required to maintain cyber liability insurance that covers breach response costs, notification expenses, and regulatory fines. This shifts financial risk to the vendor and creates an incentive for the vendor to maintain strong security controls. Most healthcare organizations have not integrated these requirements into their vendor management frameworks, leaving them exposed to the exact scenario McKesson's breach created: rapid escalation of liability, regulatory notification cascades, and contractual ambiguity about who bears the cost of remediation. Original source. The Register, "ShinyHunters expose 6.4M in attack on medical supplier McKesson" (September 10, 2026), reported by Connor Jones. Closing reflection. This incident demonstrates that vendor risk governance in healthcare remains reactive rather than preventive. Organizations should review the original article for specific technical details about the attack vector and credential compromise mechanisms. More importantly, they should use this incident as a trigger to audit their vendor contracts for explicit security requirements, notification obligations, liability allocation, and cyber insurance mandates. The governance failure here is not primarily technical - it is contractual and organizational. Healthcare boards should commission a vendor contract audit within the next 60 days, with specific focus on breach notification timelines, liability allocation, and cyber insurance requirements. The cost of updating vendor agreements is negligible compared to the regulatory exposure and notification costs that follow a breach of this scale.

Enterprise Security Tech

Sep 14th, 2026

Veradigm data breach exposes patient Social Security numbers through vendor API.

Veradigm data breach exposes patient Social Security numbers through vendor API. Healthcare technology provider Veradigm has disclosed a data breach in which attackers used credentials stolen from a third-party vendor to access and copy sensitive patient information. The Chicago-based company, formerly known as Allscripts Healthcare Solutions, said the incident affected a limited number of customers and did not disrupt its operations. Veradigm supplies electronic health record, e-prescribing, patient engagement, practice management, and revenue cycle software to healthcare organizations across the United States. According to Veradigm's filing with the US Securities and Exchange Commission, the compromised credentials belonged to a vendor and provided access to an application programming interface used for customer services. The exposed information included personal data and, for some patients, Social Security numbers. Veradigm said clinical and medical records were not accessed. "The vendor's compromised credentials provided access only through that limited interface and did not provide access to any other part of the Company's environment, including the Company's broader network, servers, databases, or other systems," Veradigm said in its SEC filing. The company activated its incident response process, contacted law enforcement, and began notifying affected customers and individuals. Credit monitoring is being offered where appropriate. Veradigm said its investigation remains active, but it does not currently expect the incident to materially affect its financial condition or operations. The Gentlemen ransomware group claims responsibility. Veradigm did not publicly identify the attacker. However, The Gentlemen ransomware group claimed responsibility and alleged that it stole 3.5 million patient records containing names, addresses, Social Security numbers, email addresses, phone numbers, and guarantor information. Those claims have not been independently verified. The Gentlemen operates as a double-extortion group that steals data and may encrypt systems to pressure victims into paying. The operation has claimed hundreds of organizations across healthcare, manufacturing, technology, transportation, and financial services. John Bruggeman, vCISO at CBTS, said the incident illustrates how narrowly scoped vendor access can still create substantial exposure. "The damage an attacker can do depends on what that third party's credentials can reach," Bruggeman said. "In this case, the compromised 3rd party is reported to have access only to a limited amount of data through a specific API." Bruggeman warned that organizations must continuously review vendor credentials, service accounts, API access, machine identities, and emerging AI agents. "Stolen credentials are particularly difficult to detect because the activity can initially look legitimate," he said. The Veradigm breach highlights a growing healthcare cybersecurity problem: attackers may not need to penetrate a company's central network when a trusted vendor credential already provides a path to valuable patient data.

The Register

Sep 10th, 2026

ShinyHunters expose 6.4M in attack on medical supplier McKesson.

ShinyHunters expose 6.4M in attack on medical supplier McKesson. Have I Been Pwned logs leaked records spanning patients, staff, and providers Published Thu 10 Sept 2026 // 13:13 UTC McKesson's cyberattack last month affected roughly 6.4 million individuals, according to Have I Been Pwned (HIBP). The breach notification service added data leaked by serial extortionists ShinyHunters, revealing the scale of the attack for the first time. ShinyHunters initially claimed to have stolen 284 million documents from the medical and pharmaceutical supply company in August, although HIBP did not confirm that figure. The cybercriminals told The Register that they issued a $55.2 million extortion demand to prevent the release of McKesson's data - a sum that apparently was not paid, given the subsequent publication of the data. HIBP said: "The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff, and healthcare provider contacts." The types of information exposed vary between individuals, but the records collectively include names, email and physical addresses, genders, dates of birth, phone numbers, employer details, and sensitive health information. This is broadly consistent with ShinyHunters' claims that the stolen data included appointment dates and notes, as well as sensitive medical details such as the locations of patients' cancers. ShinyHunters also claimed to have stolen Social Security numbers (SSNs) as part of the breach, but HIBP did not include these in its analysis of the leaked corpus. The company, which supports 3,300 oncology providers in 29 states, has not publicly confirmed the scale of the breach or issued further details since the last update from its CIO and CTO on August 29. Medical device maker Boston Scientific disclosed a cyberattack at around the same time as McKesson, but has suffered a different kind of fallout. While McKesson is informing the millions of individuals affected by its breach, Boston Scientific told shareholders that disruption from its attack means it expects to miss its sales and earnings guidance for Q3. An update issued on Wednesday said manufacturing, order fulfillment, and shipping operations had been fully restored, although work to restore some business applications continued. Healthtech company Veradigm also disclosed a cyberattack to US regulators this week, days after ransomware group The Gentlemen claimed responsibility. Veradigm said attackers obtained credentials from a third-party vendor's environment and used them to access a company API, stealing patient data without disrupting operations. The Gentlemen claimed to have stolen around 3.5 million records containing personally identifiable information (PII), including SSNs.(R)

OODA LLC

Sep 10th, 2026

Veradigm warns of patient data breach after ransomware gang claims attack.

Veradigm warns of patient data breach after ransomware gang claims attack. 09/10/2026 Healthcare technology company Veradigm disclosed a data breach after a cybersecurity incident at one of its third-party vendors exposed patients' personal data. The company says the incident did not cause operational disruptions but affected a small number of customers. Formerly known as Allscripts Healthcare Solutions, Veradigm is a Chicago-based healthcare technology company that supplies medical practices with electronic health records, e-prescribing, patient-engagement, practice-management, and revenue-cycle software. Thousands of hospitals, clinics, and biopharmaceutical firms across the United States use its solutions. The company says in a filing with the U.S. Securities and Exchange Commission (SEC) that an attacker obtained credentials from a vendor's environment for a Veradigm API reserved for customer services. The threat actor then used their access to copy patient data.

The Record

Sep 9th, 2026

Veradigm says hackers stole patient data including Social Security numbers in API breach

Electronic health records company Veradigm disclosed that hackers breached a vendor's systems and stole customer data, including Social Security numbers. The Chicago-based firm, which reported $594 million in revenue in 2024, said unauthorised parties obtained credentials to access an application programming interface used by the vendor. The stolen data included personal information of patients but no clinical or medical data. Access was limited to a specific interface and did not impact the company's broader networks or operations. The Gentlemen ransomware gang claimed responsibility, alleging it stole health records of 3.5 million patients. An investigation is ongoing and the breach has been reported to law enforcement. Formerly known as Allscripts, Veradigm previously experienced a ransomware attack in 2019.

Veradigm

Principal Product Manager

About the job