AI governance for healthcare and health-adjacent companies.
Boards are asking about AI strategy. Customers and auditors are starting to ask about AI controls. Most security teams don't have a defensible answer yet. I help them build one — policy, controls, agent operations review, and a roadmap your auditor can sign off on.
Fractional CISO · 25 years across infrastructure, security, and platform engineering · Operating production agents every day.
I know where agents leak, how authority escalates through tool chains, and what an indirect prompt injection actually looks like when it hits production.
How It Works
From discovery to deployment in weeks, not months
Discovery Call
30 minutes
Map workflows, tools, pain points
Setup Sprint
3-5 days
Deploy secure AI operations center
Tuning Period
2 weeks
Calibrate agents, refine workflows
Autopilot
Ongoing
AI handles day-to-day, you handle strategy
How I work
Three engagement types. No price list — pricing happens on the discovery call after I understand your scope.
One-time engagement
AI Governance Sprint
4–6 weeks
Deliverables
AI usage policy, agent and tool inventory, control mapping to your existing framework (SOC 2 / HIPAA / HITRUST as relevant), and a 12-month roadmap for ongoing governance.
Best for
Companies whose board, customers, or auditor has started asking about AI and need a defensible position fast.
Ongoing retainer
Fractional CISO with AI scope
Monthly engagement
Deliverables
Everything a fractional CISO does — risk management, policy, compliance program, audit support — plus AI-specific controls, agent operations oversight, and ongoing review of LLM-integrated workflows for prompt injection, authority escalation, and PHI/PII leakage.
Best for
Companies that need a security executive in the seat but aren't ready for a full-time CISO, and whose AI surface area is growing.
Project-based
SOC 2 / HIPAA / HITRUST audit prep
Scoped to audit timeline
Deliverables
Full readiness through audit, with AI usage and agent operations integrated into the control set rather than bolted on after.
Best for
Companies on a defined audit clock who don't want to be surprised by an AI-controls question they haven't answered.
Work that moved the needle
Real results from real engagements
Accelerating a 3-Year Roadmap to 6 Months
How a healthcare analytics firm achieved SOC 2 Type II in record time while cutting cloud spend by 70%.
Modernizing Legacy "Big Iron" in One Year
Migrating two decades of technical debt to the cloud and achieving SOC 2 amidst exponential growth.
Ready to build a defensible AI governance position?
Book a 45-minute call to talk through where your AI exposure sits and what a governance program would take.
I operate this stuff in production every day.
Most AI governance advice is written by people who have never deployed an agent. The policy reads fine. The auditor signs off. Then the agent does something the policy didn't anticipate, because the person who wrote the policy didn't know how the agent actually behaves under load.
I run multi-LLM agent stacks every day — Claude, OpenAI, and self-hosted models on Ollama and LiteLLM, orchestrated through n8n with persistent state. I've operated agents on the OpenClaw framework, evaluated migration paths after framework-level disruption, and architected installations of Nous Research's Hermes Agent. I debug live agent traces, tool-call chains, and inter-service auth failures as part of normal weekly work.
That hands-on operations background is what makes the governance advice land. I know where agents leak, how authority escalates through tool chains, and what an indirect prompt injection actually looks like when it hits production. The controls I write are the controls I'd want if it were my data.
Book Your Free Strategy Session
Let's discuss your security goals and compliance requirements in a no-obligation strategy call
Free Strategy Call
Quick, focused conversation about your specific needs
Expert Guidance
Get actionable advice on SOC 2, HIPAA, and security strategy
No Obligation
Free consultation with no strings attached
Can't find a time that works? Email me directly at peter@peterhallen.com