Practical guidance on AI governance and HIPAA compliance, written for the people who run the program.
Subscribe by RSS to hear when a new post is published
September 8, 2026
NIST Privacy Framework PR.DS-P1 covers privacy data-at-rest protection. This post walks through why a privacy control on stored data differs from a security one, with the language of the framework itself and the evidence an assessor asks to see.
Read more →September 4, 2026
NIST Privacy Framework PR.AC-P1 covers privacy identity and access. This post walks through access control as a privacy control, with the language of the framework itself and the evidence an assessor asks to see.
Read more →September 3, 2026
NIST Privacy Framework CM.AW-P4 covers individual data correction. This post walks through correcting data the individual disputes, with the language of the framework itself and the evidence an assessor asks to see.
Read more →September 2, 2026
NIST Privacy Framework CM.AW-P1 covers privacy notice distribution. This post walks through getting the notice to the people it is for, with the language of the framework itself and the evidence an assessor asks to see.
Read more →September 1, 2026
NIST Privacy Framework CT.DP-P1 covers data processing disassociation. This post walks through disassociating data from identity where you can, with the language of the framework itself and the evidence an assessor asks to see.
Read more →August 31, 2026
NIST Privacy Framework CT.DM-P8 covers data processing records. This post walks through recording processing so you can account for it, with the language of the framework itself and the evidence an assessor asks to see.
Read more →August 28, 2026
NIST Privacy Framework CT.DM-P4 covers data element deletion. This post walks through deletion requests against a clinical record, with the language of the framework itself and the evidence an assessor asks to see.
Read more →August 27, 2026
NIST Privacy Framework CT.DM-P1 covers data element access. This post walks through giving individuals access to their own elements, with the language of the framework itself and the evidence an assessor asks to see.
Read more →August 26, 2026
NIST Privacy Framework CT.PO-P1 covers data processing policies. This post walks through policies that constrain processing in practice, with the language of the framework itself and the evidence an assessor asks to see.
Read more →August 25, 2026
NIST Privacy Framework GV.AT-P1 covers privacy workforce training. This post walks through teaching privacy risk rather than reciting rules, with the language of the framework itself and the evidence an assessor asks to see.
Read more →