Privacy Manager

Maintain policies, procedures, and controls supporting HIPAA, 42 CFR Part 2, state privacy laws, and other applicable requirements.

Keep privacy controls, data maps, and records of processing current, with clear owners, evidence, and testing schedules.

Track privacy risks and operational metrics, including request volume, aging items, and remediation progress.

Translate regulatory, payer, and contractual requirements into practical guidance for teams across Headway.

Develop privacy training and resources that help employees make sound decisions.

Triage privacy inquiries, individual rights requests, and potential incidents.

Manage HIPAA and state privacy rights workflows, including access, amendment, accounting of disclosures, restriction, confidential communications, and deletion.

Support incident investigations, documentation, root-cause analysis, and corrective actions.

Coordinate the evidence, timelines, and logistics required for notification and regulatory submissions.

Conduct privacy assessments for products, vendors, workflows, and initiatives involving PHI or sensitive personal information.

Partner with the AI Governance Program to evaluate AI and machine-learning use cases for appropriate data use, minimum necessary access, retention, transparency, and human oversight.

Conduct privacy diligence on vendors with Legal and Security, maintain the BAA inventory, and drive identified gaps to resolution.

Build practical checklists and playbooks that make privacy reviews consistent and scalable.

4–7 years of U.S. privacy experience in a regulated industry such as healthcare, health technology, health plans, or financial services. Direct HIPAA experience is strongly preferred.

Hands-on experience in at least two of the following areas: privacy incidents, individual rights or DSAR workflows, privacy assessments, vendor and BAA governance, or privacy training.

The ability to translate complex legal and regulatory requirements into clear, actionable guidance for non-experts.

Strong judgment about which privacy decisions you can own and which legal questions require escalation.

Excellent written and verbal communication skills, including the ability to document decisions clearly and influence cross-functional partners.

Comfort balancing day-to-day execution with longer-term program design and improvement.

Fluency with AI tools for research, drafting, and analysis, along with sound judgment about verification and the handling of PHI and other regulated data.

The ability to evaluate AI use cases involving patient data, including situations where the law is still evolving.

A collaborative, pragmatic approach to ambiguity and pushback, with a preference for scalable processes over one-off solutions.

A strong connection to Headway’s mission of expanding access to mental healthcare.

Experience with 42 CFR Part 2, minor consent and confidentiality requirements, or other heightened-confidentiality regimes.

Familiarity with payer or contractual privacy requirements.

Experience assessing privacy risk in SaaS, cloud, or AI-enabled products.

A relevant certification, such as CIPP/US, CIPM, CIPT, CHPC, CHPS, or an AI governance credential.

We believe a team's strength is in its people, and we cannot achieve this mission without a team that reflects the diversity of this problem – across race, ethnicity, gender, sexuality, age, national origin, religion, family status, disability, military status, and experience. Headway is committed to the full inclusion of all qualified individuals. As part of this commitment, Headway will ensure that persons with disabilities are provided with reasonable accommodations. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or receive other benefits and privileges of employment, please inform the recruiter when they contact you to schedule your interview.

Headway participates in E-Verify. To learn more, click here.

A notice to Headway applicants: To protect yourself against phishing and recruitment fraud, please note that Headway only accepts applications through our official careers page at https://headway.co/careers . Headway will never refer you to external websites, ask for payment or personal information, or conduct interviews via messaging apps. All official communication will come from a @ findheadway.com email address. If you are contacted by someone claiming to be from Headway via an unofficial channel, please do not share any information and report it as spam.