Compliance and Privacy Manager

About Boulder

Boulder Care is an award-winning digital clinic for addiction medicine, recognized for both innovation and high quality of patient care. Founded in 2017 by CEO Stephanie Strong, our mission is to improve the lives of people with substance use disorders through compassionate, evidence-based care.

We provide Boulder patients with a fully virtual, multidisciplinary care team—including medical providers, behavioral health clinicians, and peer recovery specialists—who deliver personalized treatment, including medication-assisted treatment (MAT) and ongoing support. Our approach is grounded in clinical excellence, patient-centered care, and a commitment to reducing barriers to recovery. Boulder partners with leading health plans, employers, and community organizations to ensure that our services are accessible and covered for the people who need them most.

Named by Fortune as one of the Best Workplaces in Healthcare, Boulder fosters a culture of kindness, respect, and meaningful work that delivers outstanding patient outcomes and moves the addiction medicine industry forward.

About this role

As the Manager of Compliance & Privacy, you'll lead and scale our health care compliance and privacy programs across a rapidly growing, telehealth-based addiction treatment model. You will be responsible for ensuring Boulder Care operates at the highest standards of compliance with health care regulations and privacy laws in every jurisdiction in which we deliver services, including oversight of privacy and compliance operations, state behavioral health certification and accreditation program compliance, internal audits, incident responses, managing education and training initiatives, and monitoring and mitigating risk. In this role, you will partner closely with legal, clinical, IT, product, operations, and executive leadership to embed compliance and privacy into our services, policies, and culture. 

Health Care Compliance, Accreditation and Behavioral Health Certification, and Privacy Program Management - 90%

• Develop, maintain, and enhance compliance policies, procedures, and controls for telehealth-based addiction treatment services in multiple states in accordance with best practices and applicable state and federal laws and regulations; lead periodic reviews and updates as laws/regulations evolve
• Serve as the designated Privacy Officer and oversee compliance with HIPAA, 42 CFR Part 2, and applicable state privacy laws and regulations
• Manage national accreditation and state behavioral health certification program compliance, including policy development and new market applications 
• Conduct privacy & compliance risk assessments, internal audits, gap analyses; implement corrective plans and monitor remediations as necessary
• Manage incident response: oversee investigations of privacy or compliance breaches, coordinate response, notification, and remediation
• Lead training & awareness programs for clinical, operational, technical, and other staff on privacy, security, and regulatory compliance topics
• Monitor regulatory landscape: track changes and developments in relevant laws and regulations, assess their impact on Boulder Care’s operations, and advise leadership accordingly
• Support compliance with contractual obligations (e.g. with payors, vendors, partners) related to privacy, consent, data use and sharing
• Serve as liaison to external regulators or auditors, manage audit or investigation responses, ensure documentation readiness
• Maintain metrics, dashboards, and reporting to leadership on compliance/privacy performance, risk indicators, and program health
• Lead or participate in internal compliance committees; coordinate with Chief Legal Officer, clinical operations, and information security teams

Ethical Leadership, Compliance and Organizational Communication -10%

• Demonstrate knowledge of ethical standards, professional codes, and applicable laws affecting the department and company
• Uphold and model organizational policies and professional codes of ethics; document and escalate reports of unethical behavior as required by Boulder policies, licensing bodies, or legal standards
• Promote ethical, patient-centered decision-making by engaging in constructive discussions on the impact of work decisions on patients, staff, and stakeholders
• Communicate policies, procedures, and organizational culture effectively to candidates, new employees, and colleagues
• Foster a culture of professionalism, transparency, and accountability to ensure consistent compliance across the team

What you bring:

• Minimum of 4 years of health care compliance, privacy, and risk management experience,