Compliance and Privacy Officer

Location: WA, hybrid; regular travel to all King & Pierce County clinic sites
Reports To: Auburn Clinic Administrator (Program Sponsor)
Dotted-Line To: Director of Recovery Programs;
Medical Director
Direct Reports: None. Partners closely with each site's Clinic Administrator, who owns day-to-day compliance execution at their location, as the enterprise resource, escalation point, and standard-setter behind that work.
Type: Full-Time, Exempt
Salary
: $105,000 - $125,000

About We Care Daily Clinics

We Care Daily Clinics is dedicated to delivering high-quality, compassionate care to individuals across King and Pierce County. We are committed to expanding access to behavioral health and recovery services, ensuring that every member receives the care they need in a safe, welcoming environment. As We Care grows across multiple locations, we are strengthening our leadership structure to keep clinical quality, member experience, and compliance consistent at every site.

Position Summary

The Compliance and Privacy Officer is responsible for all things compliance and privacy across We Care Daily Clinics, network-wide. Each clinic's Clinic Administrator carries day-to-day compliance responsibility at the site level; this role is ultimately responsible for all of it, setting the policy, standards, and framework that site-level compliance work operates within, and serving as the resource and escalation point behind it.

This includes owning privacy compliance specific to Opioid Treatment Programs (OTPs) above all, 42 CFR Part 2 (the federal confidentiality rule for SUD patient records, which imposes stricter consent requirements than HIPAA) alongside HIPAA, OSHA, DEA, Medicaid, and Washington Administrative Code (WAC) requirements. This role reports to the Auburn Clinic Administrator in their capacity as the organization's designated Program Sponsor, with a dotted-line relationship to the Director of Recovery Programs and the Medical Director to keep clinical and program leadership closely looped in on compliance matters.

Key Responsibilities

Enterprise Compliance Program & Standards

• Set the enterprise-wide compliance program, policy, and standards covering federal, state, and accreditation requirements for OTPs that site-level teams implement locally.
• Own network-wide monitoring of regulatory, legal, and accreditation change affecting OTPs; translate it into policy updates and guidance for leadership and Clinic Administrators, rather than leaving each site to track it independently.
• Set the standard process, templates, and requirements for licensure activity (initial applications, renewals, modifications, change-of-ownership submissions), and step in directly on complex or high-stakes filings.

Regulatory Relations & Licensing

• Serve as the executive-level liaison and escalation point with regulatory agencies, SAMHSA, DEA, Washington State DOH, HCA, the State Opioid Treatment Authority (SOTA), and accrediting organizations, during inspections, investigations, audits, and reviews, backing up site leadership rather than leaving them to face regulators alone.
• Own the master regulatory calendar and reporting framework across all clinics; review and approve site-submitted regulatory reports, plans of correction, and corrective action plans before they go to regulators.
• Advise executive leadership on compliance and regulatory considerations for strategic growth, new clinics, medication units, satellite sites, and new-state regulatory expansion.

Audits, Investigations & Quality

• Own the organization's compliance framework across HIPAA, 42 CFR Part 2, OSHA, DEA requirements, Medicaid regulations, and WAC, setting the enterprise standard that site-level compliance work is measured against.
• Lead enterprise-wide compliance risk assessments and set risk-mitigation strategy; author and maintain organization-wide policies, procedures, and SOPs that site leadership adapts and applies locally.
• Set the standard for how compliance concerns are investigated and documented, and serve as the escalation point on complex, sensitive, or high-risk investigations through resolution.
• Set the clinical, operational, and regulatory audit framework, including standards for auditing clinical documentation, medication dispensing, treatment planning, counseling, toxicology testing, and discharge processes and spot-check findings for cross-site consistency.
• Own network-wide quality indicator, clinical outcome, incident trend, and risk-management data, identifying cross-site patterns that a single location wouldn't be positioned to see.
• Set the enterprise quality-improvement framework based on audit findings, performance metrics, and corrective action plans, and hold site leadership accountable for tracking corrective actions through completion.
• Own the enterprise recordkeeping standard for audits, investigations, and corrective actions, ensuring site-level documentation meets that bar consistently across the network.
• Own emergency preparedness, business continuity, and enterprise…