Skip to content
Michael MancusoProduct & technology executive
Projects & case studies

Complex work.
Concrete results.

Product launches, operating-model changes, and complex AI-enabled builds. Explore the business problem, the decisions I led, and what changed.

Built with agents

Product strategy and a repository-based second brain.

Phase 3 Benefits brings eight health, commuter, and wage-law account types onto one payment card. I built a repository-based second brain—product strategy, specifications, verified facts, and agent memory—to keep AI development aligned.

Specification-driven development at platform scale.

Shared FHIR-based contracts coordinated parallel development across clinical, operational, and financial workflows.

Leadership case studies

Showing 6 of 38

SmileMD

Strengthened data security by implementing security controls at SmileMD to protect patient information.

01

Challenge

SmileMD needed to enhance its data security posture to protect sensitive patient information and meet stringent HIPAA compliance requirements. The existing security measures were insufficient to address the growing threats and regulatory demands, risking data breaches and non-compliance penalties.

02

Action

To address these challenges, I led the implementation of comprehensive security measures at SmileMD. Key actions included:

  • Advanced Threat Protection: Configured Azure Advanced Threat Protection and Microsoft Defender for Identity to detect and respond to security threats in real-time.
  • Mobile Device Management: Deployed Microsoft Intune for comprehensive Mobile Device Management (MDM), ensuring secure access and management of mobile devices.
  • Cloud Security: Implemented Microsoft Cloud App Security to monitor and control access to cloud applications, addressing unauthorized access and data-sharing risks.
  • Data Loss Prevention: Implemented Office 365 Data Loss Prevention (DLP) policies to prevent unauthorized data sharing and ensure sensitive information was protected.
  • Security Policies: Drafted and implemented security policies to ensure compliance with HIPAA and other relevant regulations.
  • User Training: Conducted training sessions for employees to raise awareness about security best practices and ensure adherence to compliance policies.
  • Regular Audits: Established regular security audits and assessments to monitor compliance and identify areas for improvement.
  • Incident Response Plan: Developed a robust incident response plan to quickly address and mitigate any data breaches or security violations.
03

Results

The implementation of these security measures led to significant improvements in data protection and regulatory adherence at SmileMD:

  • Enhanced Data Security: Strengthened overall data protection through advanced threat detection and response mechanisms.
  • Healthcare Data Controls: Implemented technical safeguards, policies, training, and incident-response practices to support healthcare privacy and security requirements.
  • Reduced Risk: Minimized the risk of data breaches and unauthorized access through comprehensive security tools and policies.
  • Employee Awareness: Increased employee awareness and adherence to security best practices through targeted training programs.

Questions

What security measures were implemented at SmileMD?

Comprehensive security measures included Azure Advanced Threat Protection, Microsoft Intune MDM, Cloud App Security, DLP policies, security policy development, employee training, and incident response planning.

What supported ongoing control implementation?

The program combined policies, access and data-protection controls, employee training, monitoring, and incident-response planning. Tools supported tracking and implementation; their scores are not an independent audit or certification.

How were third-party vendor risks managed?

A vendor compliance program was established to evaluate and monitor all third-party providers handling protected health information, ensuring they met HIPAA requirements.

How does this security program differ from the HIPAA compliance initiative?

The compliance initiative focused on policies, requirements, and control tracking. The security program focused on deploying and operating identity, device-management, threat-protection, and data-loss-prevention controls.

What metrics were used to measure security posture improvement?

Security posture was measured through compliance scores, threat detection rates, incident response times, and the breadth of protection coverage across endpoints, cloud apps, and data loss prevention.

Need a leader who can
build with AI?

Let's talk about the product challenge, the team, and the outcomes you need—whether you're improving how your business runs or building something new.

Discuss your product challenge Connect on LinkedIn