Kevin Thompson - GRC Consultant/Advisor, Privaxi

Feedback from Kevin’s ex-colleagues

Let me see

Keep in touch with meI'm using Intch to connect with new people. Use this link to open chat with me via Intch app

Work Background

PrivaxiHITRUST / GRC Consultant

Mar. 2023RemoteLeads client-facing compliance initiatives by aligning with HITRUST CSF, HIPAA, PCI DSS, SOC 2, and GDPR, guiding organizations to strengthen security frameworks, develop actionable roadmaps, and implement best practices that ensure certification success and long-term compliance. • Collaborates with third-party vendors to deploy advanced automated compliance platforms, streamlining HITRUST e1, i1, and r2 certification workflows, reducing manual effort, and integrating solutions to optimize compliance tracking and reporting capabilities. Recently completed a HITRUST R2 Assessment using DRATA: Led the implementation and integration of the Drata GRC platform to support HITRUST compliance efforts for a healthcare center. Acted as Subject Matter Expert (SME) for HITRUST, ensuring accurate control mapping and alignment with the HITRUST CSF framework. Conducted end-to-end evidence testing and validation to support HITRUST readiness, with a strong focus on data integrity and audit preparedness. Established scalable processes for evidence collection, control monitoring, and compliance documentation within the Drata platform. Collaborated with stakeholders across the healthcare organization to embed Drata into daily compliance operations and streamline audit workflows.

SunStone SecurevCISO Support Manager

Apr. 2022 - Aug. 2024VirtualOversaw the implementation of a comprehensive cybersecurity framework, ensuring robust protection of digital assets and critical infrastructure while maintaining regulatory compliance with standards such as HIPAA, SOC, ISO, and FEDRAMP. Directed client-centered projects aimed at enhancing cybersecurity asset management and governance, leveraging platforms like JupiterOne and DRATA to optimize cyber asset visibility, audit evidence management, reporting capabilities, and process automation. Managed the production of audit documentation, coordinated incident response and disaster recovery exercises, and led to thorough after-action reports supported by extensive evidence, facilitated by advanced analysis and AI-powered reporting tools.

CognizantGRC / HITRUST Manager

Feb. 2021 - Dec. 2022Atlanta Metropolitan AreaOrchestrated the successful execution of Cognizant HITRUST with adherence to HITRUST requirements, and meticulously guided evidence management throughout the process. Conducted regular audits, assessments, and training sessions to mitigate potential risks and maintain compliance with industry standards, ensuring the organization’s information security measures were robust and up-to-date. Managed compliance projects, ensuring adherence to defined scope and deadlines, utilizing project schedules and deliverables to achieve efficient project completion.

InCommHealthcare/Regulatory Compliance Program Director

Aug. 2014 - May. 2020Atlanta Metropolitan AreaAt InComm as an Healthcare Compliance Program Director, I delivered oversight of organizational security policies and procedures relevant to employees, contractors and other third parties. I provided appropriate consultation and implement corrective action for detected process deficiencies. I regulated compliance with new rules, regulations and revisions, as set forth by Center for Medicare and Medicaid Services (CMS), as well as other federal and state laws and regulations governing regulatory compliance. I directed self-assessments/risk assessments to detect process deficiencies and provide consultation to address identified deficiencies facilitating cross functional best practices of risk management and compliance. I led internal (e.g., activity logs, HIPAA risk analysis) and external (e.g., HITRUST, SOC II, ADA/508) audits and security posture reviews. I collaborated with legal counsel regarding healthcare and privacy compliance requirements and interpretation of contractual language to ensure compliance with contractual documentation and requirements (BAA, RFP, MSA) for new and recurring healthcare clients. I oversaw organization and maintenance of HIPAA documentation and other compliance policies and procedures. My Key Contributions:  Initiated and led efforts to obtain the validated HITRUST Certification resulting in client confidence, reduced organizational risk.  Implemented and facilitated ongoing work sessions to develop IT Governance process models and supporting governance documentation systems.  Successfully developed business cases related to new compliance initiatives such as HITRUST certification, 508/ADA Compliance and implementation of cross functional audit platforms.  Directed the effective implementation of a legacy HIPAA/Regulatory awareness training platform to enhance employee accountability and audit report quality.

3M Healthcare Information Systems (Short Term Contract)ICD-10 Business Analyst

Feb. 2014 - Aug. 2014Spearheaded the implementation and optimization of ICD-10 coding systems, enhancing medical coding efficiency and accuracy while ensuring compliance alignment through stakeholder interviews and security control assessments. Mapped ICD-9/ICD-10 codes for claims data, optimizing claims processing efficiency and enabling informed decision support analysis, contributing to streamlined workflows and improved outcomes. My Key Contributions:  Prepared Business Requirements Documents, Functional Requirement Documents to keep record.

Verizon HealthcareSr. Systems Business Analyst/IT Project Manager

Aug. 2012 - Jan. 2014Alpharetta, GeorgiaLed cross-functional teams, overseeing analysis of complex business processes and implementing innovative technology solutions to improve decision-making and enhance customer experience. Maintained up-to-date Business Requirements Documents (BRD) and Functional Requirement Documents (FRD) for healthcare and Medicaid/Medicare security information and privacy event monitoring systems, ensuring system governance and compliance. My Key Assignments:  Applied five years of experience as Business Analyst in Healthcare include understanding of Business Requirement Gathering, Business Analysis, Joint Application Development JAD sessions with clients and referring to accessible documentation and procedure.  Executed HL7 GAP Analysis in order to evaluate HL7 data and document integrity and determine documentation is in code ready format.

Children's Healthcare of AtlantaSr. Healthcare IT Analyst (Contract Position)

May. 2011 - Aug. 2012Greater Atlanta AreaLed a team of interface analysts in designing, implementing, and supporting HL7 interfaces for EPIC EMR systems, resulting in improved system integration efficiency and reduced data discrepancies across CHOA healthcare systems. Managed the lifecycle of several HL7 interface projects for EPIC EMR systems, from initial requirement gathering through deployment and post-launch.

Greenway Medical TechnologiesEMR Business Analyst (Contract Role)

Jan. 2011 - Dec. 2011Greater Atlanta Area• Worked to define and prioritize build projects; ensuring project specifications and Meaningful Use parameters are integrated, including documentation for all new interfaces and designs in a format appropriate for use as an end user reference and training guide. • Was in charge of communication with Greenway customers to gather business requirements for Automated Programming Interface (API) transactions, prepared requirements documentation use case models for technical and end-users. • Provided consultation existing API transactions business practices and workflows to determine operational compliance and efficiencies while recommending changes as appropriate.

NCR CorporationSolutions Consultant/Healthcare Business Analyst

Feb. 2010 - Feb. 2011• Directed the deployment Implementation project teams consisting of both NCR and client associates focused on installing and implementing Healthcare solutions (Kiosk Check-In Systems, Patient Portals) both nationally and internationally • Developed functional and technical documentation deliverables such as BRD's, user scenarios, screen flows/content requirements and Visio flows/activity diagrams • Worked closely with NCR Interface Developers and hospital IT personnel to analyze, define, document, test, troubleshoot and coordinate implementation of HL7 interfaces • Supported UAT planning or triage/defect reviews as needed accomplishing client confidence the end solution meets requirements and user needs

3M Health Information SystemsEMR Systems Trainer

Jun. 2009 - Feb. 2010Contracted, Project Completed On-Time • Provided implementation and training support for inpatient Military Healthcare clinicians associated with the Department of Defense (AHLTA)/MAPS Electronic Medical Record (EMR) systems implementation • Utilized excellent customer service skills to clinical user groups, to provide training and support, and to act as a change agent in service of departmental goals