Compliance & Regulatory Qualifications

A healthcare-provider engagement carried environment-level HIPAA exposure; the data reaching the work was already de-identified before it arrived.

A separate device/medical-catalog client also carried HIPAA considerations, but exposure there was minimal — limited to catalog-section work, not patient data systems.

At REISystems (2010–2011), built loan and grant administration systems — for healthcare-related lending/grant programs, and separately for government grants — that were legally required to meet full Section 508 compliance, including accessibility scanning and checks.

This administered loans and grants — it never touched healthcare or patient data, and carried no HIPAA exposure. Classified here as Government, not Healthcare.

The governing standard for this 2010–2011 engagement was 36 CFR 1194.22 — a flat 16-point provision checklist (a–p) — and that checklist is the accurate framework for describing this work.

The team pushed for more than the required minimum on that checklist. Lighter, secondary 508 work also touched PVH and a few other clients.

Best Ring POS carried real card-present PCI scope — physical point-of-sale hardware and transaction flow squarely inside PCI DSS requirements.

Described plainly: "a whole ordeal." This is the strongest, most direct PCI claim in the portfolio.

Across most other commerce clients, PCI exposure genuinely shifted over time rather than sitting at one fixed level.

Early on, integrations went directly against Visa/Mastercard and other card networks, so those systems took orders — and card data — directly, with real PCI exposure at that stage.

Later, that shifted toward third-party processors (PayPal, Amazon, Braintree, Authorize.net) absorbing the PCI burden, and the work became about ensuring those systems never stored or maintained card data themselves.

Across multiple publicly-traded-company engagements, SOC-aligned discipline was often self-driven rather than a formal top-down mandate — "pressed for that as much as I could once I heard and learned of it."

Production-deployment access — "keys to the kingdom" — came with real separation-of-concerns responsibility, and some environments carried formal audits and checks.

Wayfair is the anchor PII story: work credited as part of a roughly $5M reduction in lost inventory involved obfuscation and handling of PII for audits.

That work balanced Amazon-partnership PII isolation requirements against legitimate last-mile-delivery PII needs — two valid but competing access requirements on the same data. Several other engagements touched PII to a lesser degree.