Privacy, Cybersecurity, Data Security, and Artificial Intelligence

• Designed and implemented regulatory programs—including website disclosures, policies, procedures, training, and risk assessments—to meet FTC, FERPA, GLBA, GDPR, CMMC, and other state, federal, and international requirements.

• Developed HIPAA compliance programs for healthcare clients, including policies, procedures, risk assessments, and entity-designation analyses for a healthcare mobile application, healthcare clinic, and university, covering covered entity, hybrid entity, and business associate designations.

• Assessed GDPR and UK GDPR requirements for a U.S. energy company’s overseas acquisition.

• Guided an international insurance carrier as outside privacy and cybersecurity counsel, including on policy and procedure development, vendor management, and engagement of private investigators.

• Developed a CMMC compliance plan for a Department of Defense subcontractor, incident response plans for financial institutions and professional services firms, and Transportation Security Administration-required security measures for critical infrastructure.

• Oversaw engagement of security firms for penetration testing and other security assessments, with request-for-proposal management and engagement agreement negotiation.

• Directed insurance-approved breach response matters for privacy and security incidents across multiple states, territories, and countries, including reporting analysis, customer communications, agency communications, and insurance policy review for coverage sufficiency.• Drafted policies and developed controls for AI usage by clients and their vendors to ensure compliance with applicable laws and regulations, and provided training on ethical AI usage.

• Developed an AI operational risk mitigation program, including governance structure, risk management framework, policies, and procedures for the development, implementation, use, and validation of AI systems.

FinTech, Financial Services, and BSA/AML

• Negotiated FinTech agreement execution and termination, incorporated customer disclosures, and responded to banking agency compliance inquiries.

• Analyzed cryptocurrency-secured lending and financing arrangements for consumer, vendor, finder, crowdfunding, and other financial services compliance issues.

• Counseled financial institutions on BSA/AML reporting, including CTRs, SARs, and OFAC disclosures.

• Addressed anti-money laundering, suspicious activity, OFAC reporting, and related financial-crime controls for an international insurance carrier.

Contracts, Third Party Risk, and Professional Services

• Drafted client agreements, website documentation, and internal onboarding procedures for accounting and technology consulting firms.

• Coordinated contract administration and third party risk management.

Marketing, Content Review, and Consumer Promotions

• Reviewed advertising, social media, website, sweepstakes, and electronic transaction content under FTC, TCPA, and other applicable requirements.

• Served as compliance counsel to a national multimedia company providing online memberships and sweepstakes giveaways.

Nonprofit Governance

• Reviewed websites, bylaws, policies and procedures, and contracts for nonprofit entities regarding privacy, security, and corporate governance.