Former Attorney · Security · Healthcare GRC
Michael A Ortenberg
Bridging legal strategy, HITRUST-grade security compliance, and hands-on software and analytics execution to build secure, audit-ready systems.
About
I'm a former attorney and governance, risk and compliance leader with more than 25 years of experience helping Fortune 500 organizations and major healthcare systems solve complex cybersecurity, privacy, governance and enterprise risk challenges.
Most organizations hand regulatory requirements to counsel, security controls to a GRC team, and implementation to technologists, then spend months reconciling the three. I work across all of them: I read statutes and contracts for what they actually obligate, translate those obligations into practical governance an auditor will accept, and build the dashboards, automation and software that put it into practice.
Core Expertise
Each pillar stands on its own. The value is in the overlap: legal obligations that map cleanly to controls, and controls that are enforced in the software itself.
Turning healthcare privacy and security law into clear obligations, defensible positions and workable contracts.
Building privacy and security governance that holds up under audit and actually reduces enterprise risk.
Shipping secure web applications, analytics and automation with the controls designed in, not bolted on.
Case Studies & Solutions
Selected work across governance programs, production software and decision-support tooling.
Governance & Risk
A turnkey privacy and security governance model for enterprise acquisitions and large-scale healthcare client engagements.
Software Engineering
From directing enterprise deployments of secure healthcare web portals to building modern cloud applications hands-on.
Automation & Data
Automated assessment tools, security dashboards and executive reporting that replace manual effort with repeatable, accurate data.
Projects
14 applications, from compliance and security tools to client platforms and personal projects.
Showing 14 projects
Compliance & Security
A guided Data Protection Impact Assessment tool built for a national diagnostic laboratory company. It walks assessors through a 7-step workflow, detects the applicable framework (GDPR, HIPAA, US state PIA), flags compliance pitfalls in real time and exports a standardized report, cutting roughly 30 hours of weekly work to about 2.
Client tool
Compliance & Security
A zero-knowledge digital legacy and estate vault. Owners encrypt emergency information client-side so no one, including the operator, can read it, then share specific entries with trusted contacts through a cancellable, owner-vetoable Break Glass protocol.
Private
Compliance & Security
A multi-tenant PWA for private, permission-aware coordination among trusted people: caregiving schedules and medication logs, estate and financial access, shared credentials, and PIN-protected read-only broadcast links for extended family.
Compliance & Security
An internal proposal workbench for a principal-led consultancy. It imports public-sector notices (SAM.gov, state and municipal RFPs), scores fit with Claude, builds Section L/M compliance matrices and drafts proposal sections from a reusable knowledge base.
Internal tool
Business & Client Apps
An AI-assisted job-search workspace. It audits a user's work history into a structured Experience Database, scores it against target job descriptions dimension by dimension, and generates tailored resumes, cover letters and interview prep, with application tracking and a browser-extension autofill.
Business & Client Apps
The operations platform for a mobile, in-home dog-training business: client intake, drive-time-aware scheduling, invoicing and payments, per-dog records and training logs, and a client-facing portal.
Client project
Business & Client Apps
Meal pre-ordering for a Connecticut charter school. Staff sign in, browse breakfast and lunch menus and order before a daily cutoff; admins import PDF cycle menus, tag allergens and manage orders.
Private deployment
Business & Client Apps
Marketing site for Michael's boutique software studio, presenting custom software case studies and a Healthcare Privacy & Compliance consulting practice (HIPAA readiness, program build-out and automation).
Personal & Consumer
A co-developed executive-function and task-management app designed around how ADHD brains work, adding structure and support to planning, tracking and follow-through instead of a generic to-do list.
Private
Personal & Consumer
A local-first home-inventory app: photograph what you own and Claude's vision API itemizes it into a searchable catalog that works fully offline, with optional household sync for shared inventories.
Android app, private
Personal & Consumer
A personal flight search and award optimizer. It searches several home airports at once, keeps only itineraries that meet carry-on, seat and airline preferences, prices each as cash or points across travel portals and transfer partners, and hands off to guarded ticketing.
Personal tool
Personal & Consumer
Step-by-step picture guides for common phone and computer problems, written for non-technical family and friends: big text, one action per step, the exact button circled, and a printable view.
Personal & Consumer
Learn world geography on an interactive 3D globe. Tap where you think a country, capital or body of water is and get scored on distance, across four levels that progressively remove map help.
Personal & Consumer
Play out an MLB playoff team's pitching rotation and lineups across the real postseason calendar, with rest-aware auto-scheduling, short-rest warnings and split lineups against right- and left-handed starters.
Credentials
Licensure, certifications and education spanning law and information security, backed by more than 25 years of leadership.
VSB
Former Member, Virginia State Bar
Virginia State Bar · Issued 1995
JD
Juris Doctor
Columbus School of Law, The Catholic University of America
CISSP
Certified Information Systems Security Professional
ISC2 · Issued 2013 · Formerly certified
CCSFP
HITRUST Certified CSF Practitioner
HITRUST · Issued 2016 · Formerly certified
BA
Linguistics and Cognitive Science
Brandeis University
More than 25 years leading governance, risk, compliance and advisory work for Fortune 500 organizations and major healthcare systems, from building a new consulting practice to running enterprise governance programs.
2015 - 2026
Cognizant Technology Solutions
Associate Director, Healthcare Governance, Risk & Compliance
Teaneck, NJ
2002 - 2015
Siemens Health Services (Cerner)
Principal Consultant, Privacy, Information Security & Risk Management
Malvern, PA
2000 - 2002
Covansys (CBSI)
Senior Manager, Global Health Practice
Middletown, CT
1998 - 2000
Metalogics, Inc.
Manager, Network Services / Y2K Project Leader
Hoboken, NJ
1996 - 1998
Legal Services of New Jersey
Manager, Computer Information Systems
Edison, NJ
1995 - 1996
Legal Services of Northern Virginia
Manager of Information Services
Falls Church, VA
Selected speaker and panelist at national healthcare conferences and industry events.
Contact
Available for advisory engagements, fractional GRC and legal technology consulting, and senior leadership roles where regulatory, security and engineering decisions need a single accountable owner.