Privacy engineering, WISP and 201 CMR 17.00 compliance, HIPAA programs, AI governance frameworks, and GRC program maturity. Built for operators, auditors, and the product teams that have to live inside the policy.
Data mapping, minimization, retention, and technical privacy controls. DLP architecture, encryption standards, and access governance engineered into the stack — not bolted on.
Written information security programs drafted to the Massachusetts standard. Annual review, incident response plans, and third-party oversight language that matches your operational reality.
End-to-end HIPAA Security Rule and Privacy Rule programs for covered entities and business associates. Policy, technical safeguards, workforce training, and BAA management.
Framework alignment, control-testing cadence, evidence automation, and audit readiness. We run GRC programs for the way your business actually works.
Acceptable-use policy, model risk management, and NIST AI RMF alignment. Guardrails that product teams can actually ship against — not documents nobody reads.
Vendor due-diligence frameworks, SIG questionnaire response strategy, and ongoing third-party risk monitoring. For the supply chain you actually depend on.
Virginia leads Colossus's privacy, GRC, and AI governance practice. She's built WISPs for Massachusetts-regulated entities, stood up HIPAA-compliant data-handling programs in healthcare, and drafted AI acceptable-use frameworks for enterprises moving past pilots. Before Colossus, Virginia held privacy and compliance leadership roles at technology services firms.
Request a consultationDesign and build a secure, compliant data pipeline to support a HIPAA-regulated application. AWS-native architecture with a PostgreSQL datamart.
Automated pipeline using AWS Glue and Python, integrated with PostgreSQL in AWS, with controls aligned to SOC 2 compliance requirements from the start.
HIPAA-compliant data platform delivered. Streamlined analytics workflows and reduced compliance risk through pipeline automation.
Every engagement begins with a short scoping call. If we're not the right fit, we'll tell you.
Schedule a call