Compliance and Privacy Officer

Compliance and Privacy Officer

Location: WA, hybrid; regular travel to all King & Pierce County clinic sites
Reports To: Auburn Clinic Administrator (Program Sponsor)
Dotted-Line To: Director of Recovery Programs; Medical Director
Direct Reports: None. Partners closely with each site's Clinic Administrator, who owns day-to-day compliance execution at their location, as the enterprise resource, escalation point, and standard-setter behind that work.
Type: Full-Time, Exempt
Salary : $105,000 - $125,000

About We Care Daily Clinics

We Care Daily Clinics is dedicated to delivering high-quality, compassionate care to individuals across King and Pierce County. We are committed to expanding access to behavioral health and recovery services, ensuring that every member receives the care they need in a safe, welcoming environment. As We Care grows across multiple locations, we are strengthening our leadership structure to keep clinical quality, member experience, and compliance consistent at every site.

Position Summary

The Compliance and Privacy Officer is responsible for all things compliance and privacy across We Care Daily Clinics, network-wide. Each clinic's Clinic Administrator carries day-to-day compliance responsibility at the site level; this role is ultimately responsible for all of it, setting the policy, standards, and framework that site-level compliance work operates within, and serving as the resource and escalation point behind it. This includes owning privacy compliance specific to Opioid Treatment Programs (OTPs) above all, 42 CFR Part 2 (the federal confidentiality rule for SUD patient records, which imposes stricter consent requirements than HIPAA) alongside HIPAA, OSHA, DEA, Medicaid, and Washington Administrative Code (WAC) requirements. This role reports to the Auburn Clinic Administrator in their capacity as the organization's designated Program Sponsor, with a dotted-line relationship to the Director of Recovery Programs and the Medical Director to keep clinical and program leadership closely looped in on compliance matters.

Key Responsibilities

Enterprise Compliance Program & Standards

• Set the enterprise-wide compliance program, policy, and standards covering federal, state, and accreditation requirements for OTPs that site-level teams implement locally.
• Own network-wide monitoring of regulatory, legal, and accreditation change affecting OTPs; translate it into policy updates and guidance for leadership and Clinic Administrators, rather than leaving each site to track it independently.
• Set the standard process, templates, and requirements for licensure activity (initial applications, renewals, modifications, change-of-ownership submissions), and step in directly on complex or high-stakes filings.

Regulatory Relations & Licensing

• Serve as the executive-level liaison and escalation point with regulatory agencies, SAMHSA, DEA, Washington State DOH, HCA, the State Opioid Treatment Authority (SOTA), and accrediting organizations, during inspections, investigations, audits, and reviews, backing up site leadership rather than leaving them to face regulators alone.
• Own the master regulatory calendar and reporting framework across all clinics; review and approve site-submitted regulatory reports, plans of correction, and corrective action plans before they go to regulators.
• Advise executive leadership on compliance and regulatory considerations for strategic growth, new clinics, medication units, satellite sites, and new-state regulatory expansion.

Audits, Investigations & Quality

• Own the organization's compliance framework across HIPAA, 42 CFR Part 2, OSHA, DEA requirements, Medicaid regulations, and WAC, setting the enterprise standard that site-level compliance work is measured against.
• Lead enterprise-wide compliance risk assessments and set risk-mitigation strategy; author and maintain organization-wide policies, procedures, and SOPs that site leadership adapts and applies locally.
• Set the standard for how compliance concerns are investigated and documented, and serve as the escalation point on complex, sensitive, or high-risk investigations through resolution.
• Set the clinical, operational, and regulatory audit framework, including standards for auditing clinical documentation, medication dispensing, treatment planning, counseling, toxicology testing, and discharge processes and spot-check findings for cross-site consistency.
• Own network-wide quality indicator, clinical outcome, incident trend, and risk-management data, identifying cross-site patterns that a single location wouldn't be positioned to see.
• Set the enterprise quality-improvement framework based on audit findings, performance metrics, and corrective action plans, and hold site leadership accountable for tracking corrective actions through completion.
• Own the enterprise recordkeeping standard for audits, investigations, and corrective actions, ensuring site-level documentation meets that bar consistently across the network.
• Own emergency preparedness, business continuity, and enterprise risk management strategy across the clinic network.
• Chair the Compliance Committee, prepare reports and recommendations for executive leadership, and set the tone for a network-wide culture of compliance.

Privacy & 42 CFR Part 2

• Own the organization's privacy compliance program specific to OTP/SUD treatment records, above all 42 CFR Part 2, alongside the HIPAA Privacy and Security Rules and applicable Washington State privacy law, and set the policy that site leadership implements.
• Provide direct guidance on 42 CFR Part 2 consent, disclosure, and re-disclosure requirements, including its materially stricter consent rules relative to HIPAA, and own privacy provisions in vendor/BAA and Qualified Service Organization Agreements (QSOAs) in partnership with Legal Counsel.
• Own breach-notification protocols and serve as the escalation point for any suspected 42 CFR Part 2 or HIPAA privacy incident across the clinic network.

Cross-Functional Partnership & Strategic Advisory

• Partner with the Director of Recovery Programs, Medical Director and each site's Clinic Administrator to improve workflows and operational efficiency from a compliance lens.
• Own compliance sign-off on new clinical programs, regulatory initiatives, and operational processes before rollout, so site teams are executing within an already-approved framework rather than working out compliance after the fact.
• Partner with the Safety & Risk Manager on OSHA recordkeeping and workplace injury reporting to ensure consistent enterprise-wide compliance.

Training & Culture

• Own the compliance, regulatory, and documentation training curriculum covering policies, regulatory change, documentation standards, and privacy requirements that site leadership delivers locally.
• Work with Indigenous Pact on compliance training for staff and leadership across all locations.

Qualifications

Required

• 7+ years of healthcare compliance experience, with OTP, SUD, or behavioral-health experience strongly preferred.
• Deep working knowledge of 42 CFR Part 2, HIPAA Privacy and Security Rules, OSHA, DEA requirements, Medicaid regulations, and Washington Administrative Code (WAC), including how 42 CFR Part 2's consent requirements differ from and exceed HIPAA's.
• Experience overseeing compliance across multiple sites or a clinic network, setting policy and standards that others execute against, not just running compliance at a single site.
• Direct experience serving as primary or executive-level liaison with regulatory agencies (e.g., SAMHSA, DEA, state health departments) during inspections, investigations, or audits.
• Strong policy-writing, audit-framework design, and training-curriculum development skills.
• Excellent judgment and communication skills working with both site-level leadership and executive leadership.

Preferred

• Certified in Healthcare Compliance (CHC) or equivalent certification strongly preferred.

Equal Employment Opportunity (EEO) Statement

We Care Daily Clinics is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All employment decisions are based on qualifications, merit, and business need—without regard to race, color, religion, creed, national origin, ancestry, gender, gender identity or expression, sexual orientation, age, marital status, disability, veteran status, genetic information, or any other protected status under applicable laws.

Tribal Preference Statement

In accordance with applicable Tribal and Federal laws, Tribal preference will be given to qualified candidates who are members of a federally recognized tribe. We Care Daily Clinics and Indigenous Pact are proud to partner with Tribal communities to expand access to high-quality, culturally grounded care.