ISACA NEW ENGLAND · 50TH AGM & SECURITY EXPO
The AI Vendor File starters
Thanks for being in the room for Your AI Vendor's HIPAA Problem. Here are the three artifacts from the talk. No forms, no email gate. Take them today, use them this week.
Thanks for being in the room for Your AI Vendor's HIPAA Problem. Here are the three artifacts from the talk. No forms, no email gate. Take them today, use them this week.
Waypoints 1 through 3 as a send-to-vendor questionnaire, mapped to §164.308 and §164.312, with what a strong answer looks like for each question and a send log to track outcomes.
DOWNLOAD PDFThe four delta questions as a fill-in review for AI data flows: model training, subprocessors, retention, and de-identification claims, with a verdict block and the contract trigger language to request.
DOWNLOAD PDFThe three-gate verdict from the talk on one page: BAA adequacy, data minimization, operational ownership. Ready for your working papers.
DOWNLOAD PDFAll three map to CISM Domain 2, COBIT APO12, and the HIPAA Security Rule. Nothing here is new work invented for AI; each discharges an obligation the frameworks already impose.
I'm Ricky Martin, founder and principal vCISO at Secure Nomad. I spent over twenty years building enterprise security risk programs at Harley-Davidson, Deloitte, Optiv, and Trace3. Today I work inside independent healthcare practices across New England, the organizations adopting AI tools fastest with the least security staff to vet them.
These artifacts come from that fieldwork. They are built to be runnable by a one-person GRC function, or a sharp office manager with a checklist, and to produce the file an underwriter can actually read.
CISM · CISSP · CCSP · full credential wall at Credly
The crosswalk drops into APO12 working papers, the checklist is what a defensible AI answer on the renewal questionnaire needs behind it, and the three vendor questions surface shadow AI in a ten-minute conversation with an office manager. Happy to compare notes with anyone advising practices through an AI-heavy renewal cycle.