Privacy Manager

The role

The Privacy Manager will operate and improve the privacy program by maintaining policies and controls for HIPAA and state privacy laws. You will manage privacy requests and incidents while assessing product, AI, and vendor risk.

What you will do

• Maintain policies, procedures, and controls supporting HIPAA, 42 CFR Part 2, and state privacy laws.
• Keep privacy controls, data maps, and records of processing current.
• Track privacy risks and operational metrics.
• Translate regulatory, payer, and contractual requirements into practical guidance.
• Develop privacy training and resources.
• Triage privacy inquiries, individual rights requests, and potential incidents.
• Manage HIPAA and state privacy rights workflows.
• Support incident investigations, documentation, and corrective actions.
• Conduct privacy assessments for products, vendors, workflows, and AI initiatives.
• Conduct privacy diligence on vendors and maintain the BAA inventory.

Required qualifications

• 4–7 years of U.S. privacy experience in a regulated industry such as healthcare, health technology, health plans, or financial services.
• Hands-on experience in at least two of the following: privacy incidents, individual rights or DSAR workflows, privacy assessments, vendor and BAA governance, or privacy training.
• Ability to translate complex legal and regulatory requirements into clear, actionable guidance for non-experts.
• Strong judgment about which privacy decisions you can own and which legal questions require escalation.
• Excellent written and verbal communication skills.
• Comfort balancing day-to-day execution with longer-term program design and improvement.
• Fluency with AI tools for research, drafting, and analysis.
• Ability to evaluate AI use cases involving patient data.
• A collaborative, pragmatic approach to ambiguity and pushback.
• A strong connection to Headway’s mission of expanding access to mental healthcare.

Nice to have

• Experience with 42 CFR Part 2, minor consent and confidentiality requirements, or other heightened-confidentiality regimes.
• Familiarity with payer or contractual privacy requirements.
• Experience assessing privacy risk in SaaS, cloud, or AI-enabled products.
• A relevant certification, such as CIPP/US, CIPM, CIPT, CHPC, CHPS, or an AI governance credential.
• Direct HIPAA experience

Benefits

• Medical
• dental
• vision
• HSA/FSA
• 401(k) including match for 2027!
• Carrot Fertility reimbursement
• paid parental, medical and caregiver leave

About the company

Headway is a Series D company building a new mental healthcare system to make therapy more accessible. They provide software to over 90,000 providers across all 50 states.