EP 17 — Modern Health’s Michael Hensley on Healthcare Security Beyond HIPAA Compliance Checkboxes
Future of Data SecurityShow Notes
The healthcare industry's digital transformation has created unprecedented opportunities for patient care delivery, but it's also introduced complex security challenges that extend far beyond traditional compliance frameworks. Michael Hensley, Director of Cyber Security at Modern Health, brings a unique perspective to protecting private — and heavily regulated — health data while maintaining the innovation velocity essential for startup success. Healthcare security teams must balance regulatory requirements with business agility, creating frameworks that protect patients without stifling innovation.
Michael's journey from professional musician to software engineer to cybersecurity leader shaped his understanding that effective security programs prioritize people and processes alongside technology investments. His approach demonstrates how healthcare organizations can build security frameworks that enable rather than restrict innovation, creating speedy review processes for new technologies while maintaining rigorous patient data protection standards. His conversation with Jean also explores the evolving landscape of healthcare cybersecurity, from shadow AI risks to the misconceptions surrounding HIPAA compliance.
Topics discussed:
The fundamental difference between healthcare cybersecurity and other industries, focusing on real-world patient impact rather than just financial or reputational damage from data breaches.
Common misconceptions about HIPAA compliance, including the regulation's flexibility and how organizations must interpret general requirements based on their specific business models and patient populations.
How telehealth expansion created new security paradigms, enabling rapid service deployment through cloud-native platforms while introducing risks from easy misconfigurations and third-party integrations.
Shadow AI emergence in healthcare environments where employees seek productivity gains through unauthorized AI tools, potentially exposing patient data to non-compliant platforms without understanding regulatory implications.
Organizational strategies for safe AI adoption in regulated industries, including dedicated review processes, governance committees, and internal tool development that unlocks productivity while maintaining compliance.
The evolution from traditional on-premises healthcare security models to cloud-native architectures where services can be deployed with minimal friction but require sophisticated guardrails to prevent data exposure.
Advanced approaches to vendor risk management in healthcare technology, balancing the need for third-party integrations with rigorous security and compliance vetting processes.
Why effective cybersecurity programs treat people and processes as equally important to technology investments, focusing on ownership models and operational sustainability rather than just tool deployment.
Building security teams that enable business objectives through speedy review processes and treating compliance requests as first-class problems rather than obstacles to innovation.
More from Future of Data Security
When agentic AI systems make multiple tool calls, store data, and act autonomously, static compliance frameworks fall apart. Kevin Bauer, CISO at Chainalysis Government Solutions, argues security teams need continuous monitoring of which controls were in effect at runtime and whether those controls actually worked. Kevin led the first blockchain analytics product to FedRAMP Moderate authorization, where data sensitivity emerged through attribution to real-world entities. He draws direct parallels between those boundary-setting challenges and today's governance gaps in agentic AI, where data classification must drive compliance obligations in real time.
The gap between an exploit's first use and its public disclosure has gone negative. Agentically deployed attacks now reach their target before the vulnerability behind them is ever publicly reported, a shift most security programs are still catching up to. Tom Doughty, Chief Information Security Officer at Generate:Biomedicines, walks Jean through what that shift demands from a security team, from agentic countermeasures to a different approach to non-human identity, plus what changed when he moved a 25-year financial services security career into an AI-native biotech (generatebiomedicines.com) built on machine-generated molecules.
Gopuff runs 200-plus AI agents and 100-plus MCP servers across three public clouds, and Ravi Nori is the one securing all of it. The Head of Cyber Security at Gopuff brought a defense-industry classification ethos to a cloud-native retail platform where customer data sits at the top of the priority chain. Ravi walks Jean through Gopuff's three AI deployments, the shadow AI sprawl he uncovered during an environment scan, and why agent security now spans three surfaces: desktop, browser, and cloud. He also breaks down how boards push for AI adoption while security lags behind.
What if the file itself decided who gets access, carried its own encryption, and refused unauthorized requests? Georgeo X. Pulikkathara, Global CIO and CISO at iMerit Technology, sees that future arriving fast. With 34 years in IT security and active service as a Colonel in the US Army Reserve, Georgeo breaks down 40-minute AI-enabled breaches, the flood of non-human accounts, and why human oversight remains the one control that will never go away.
Gartner predicts 40% of enterprise applications will incorporate agentic AI by year's end, but Jon Rohrich is asking a more basic question: why? Leading Avanade's Canadian cybersecurity practice with nearly 30 consultants, Jon keeps watching proof of concepts succeed, only to collapse when unmodeled risks surface in production.