IT‑IS‑Networking
Technology › Healthcare & Clinical Technology

Regulatory Compliance Architecture

HIPAA, CJIS, NIST 800-53, PCI and Florida public records law — often on the same record at the same time.

Also known as HIPAA, CJIS Compliance, NIST 800-53, DHS Stadium Cybersecurity Best Practices

Left to right is time. Each row is one of the 13 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Twenty-four unbroken years under HIPAA and CJIS, spanning Coleman Technologies and the City of Jacksonville — hospital networks across three states, and city systems worked first as a consultant and later owned outright.

Designing to conflicting statutory regimes rather than to a single framework. Inmate medical records under both HIPAA and CJIS with different access, retention and disclosure rules on the same record is the sharpest case; the city’s shared platform carrying criminal justice records, patient information, court records and elections data is the broadest.

Clinical wireless under HIPAA obligations across hospital estates in New York, Florida and North Carolina, including Baptist Health and Nemours, from 1999.

Assessment against an external framework rather than an internal one: the NFL’s Internal Audit review of TIAA Bank Field, conducted against the Department of Homeland Security’s Stadium Cybersecurity Best Practices Guidelines under the league’s Audit Committee compliance program, with the City represented as the owner of the venue.

A regulated device sets a different default

The earliest of this work was not a compliance regime applied to a system but a system that was the regulated article. The StorComm teleradiology platform operated under Food and Drug Administration clearance, with my contribution being the data gathering and requirements work feeding that process rather than the regulatory filing itself.

The engineering consequence is the part worth carrying forward. When the design is part of a regulated device it cannot be revised casually: a change that would be a ticket in enterprise software is a controlled event with evidence attached. Learning that at the start of a career sets a default about documentation, traceability and what counts as proof that never entirely goes away — and it is why the later work under HIPAA, CJIS and Florida public records law reads as ordinary rather than onerous.

Applied in

  • Casino Surveillance Network Design and Segmentation2024–2026Surveillance refresh and segmentation for a metropolitan casino property — designed as Principal Architect and governed as Director, through a phased implementation and a mid-program re-scope.
  • E-Rate Funded Network Programs2024–2026Roughly fifteen engagements across school districts, a regional education service agency and a public library consortium — every design constrained by federal funding eligibility and the funding-year window.
  • Healthcare Estates2024–2026Five providers — firewall and intrusion-prevention upgrades against an active vendor advisory, a multi-site data center fabric on standing retainer, and segmentation with virtual desktop.
  • Utility OT/IT Engagement2024–2026A natural gas and electric utility, carried from review of the SCADA statement of work through firewall and switch delivery.
  • Commercial Site Rebuild and Live Domain MigrationApril–September 2026Twenty pages moved off a hosted page builder onto a static build, and a live domain repointed to a new host without touching any of the six records carrying its mail.
  • Firewall Refresh and Intrusion Response2025A multi-site next-generation firewall refresh for a nonprofit health provider — and an intrusion the night after cutover, met with geo-fencing and containment run alongside day-one support.
  • Municipal Infrastructure Assessment to RFP2024–2025An infrastructure assessment for a town government, scoped from the start to become the foundation of its own procurement rather than a proposal for follow-on work.
  • NFL Stadium Cybersecurity Review2022–2023A league Internal Audit assessment of the city-owned stadium against the Department of Homeland Security's stadium cybersecurity guidelines, reaching the building's control systems as much as its enterprise IT.
  • Administrative Identity for the Network Estate2006–2022Sixteen years and three platform generations of who may type a command on a city switch and what is recorded when they do — begun as a procurement condition in 2006, closed with multi-factor and a duty-separated account standard.
  • Disaster Recovery Validation and Application Tiering2020Criticality bound to recovery objectives in an instrument rather than a narrative, and a definition of "tested" that the estate could not yet meet — reported rather than softened.
  • Telemedicine Program with Hospital PartnersMay 2014 – August 2015Duval County Jail to UF Health — fifteen months from vendor presentation to completed pilot, opened with a business case rather than with equipment.
  • Hospital Network and Clinical Wireless2000–2004Facility-wide clinical wireless under HIPAA across hospital systems in New York, Florida, Delaware and North Carolina.
  • StorComm PACS Platform1997–1999Chief system designer of a clinical picture archiving and communication platform for hospital customers.
  • StorComm Teleradiology Platform1997–1999Diagnostic imaging delivered to radiologists at home over ISDN and dial-up — telemedicine fifteen years before the market used the word.

Career

See also

Also searched as

  • CJIS
  • criminal justice information
  • FBI security policy
  • HIPAA
  • PCI
  • NIST 800-53
  • FIPS 140-2