Research and
Working Papers

Healthcare cybersecurity, organizational security behavior, and the governance of AI-assisted security work.

Wlad Pierre-François, Ph.D.

Independent researcher
Queens, New York

Featured working paper

In preparation · Not peer reviewed

Governing Generative AI in Healthcare Security Work

A critical review and HIPAA-informed control framework

Approving an AI tool does not establish that a particular security work product can be relied on. This paper proposes a process for reviewing AI-assisted policy mappings, risk records, and incident summaries before they inform an organizational decision.

Read the scope and limitations

The process connects task purpose, permitted inputs, verification, escalation, records, and reassessment to existing governance arrangements. Two fictional examples illustrate how missing evidence changes a decision.

This is a critical narrative review and conceptual framework. The proposed process has not undergone independent evaluation and is not a HIPAA compliance certification or guarantee.

Source revision: October 22, 2026. Extensive AI assistance is documented in the review manuscript.

Full text is being prepared for author review. No public download is available yet.

Work in preparation

Historical survey · Full text held

Healthcare Security Policy Perceptions as Risk-Management Evidence

A retrospective reanalysis of October 2021 survey responses from 284 U.S. healthcare panel respondents. It distinguishes policy perceptions from intentions, observed behavior, and verified control performance.

What this study can and cannot establish

The analysis retains unsupported hypotheses and mixed model-fit evidence alongside supported associations. The findings are historical, cross-sectional, and based on self-reports. They do not establish current conditions, causal effects, or an organization’s HIPAA compliance.

Public sharing remains on hold while journal status and posting requirements are checked.

Practitioner article · Author-review draft

Stop Reporting Controls: Give Executives Decisions

A fictional cloud-platform launch illustrates a compact decision card connecting security evidence to business consequences, feasible choices, accountable owners, and conditions for revisiting approval.

Read the article’s boundaries

Recovery, privileged access, and logging illustrate different management decisions. The card is a proposed reporting practice, not a validated scoring instrument or a guarantee of security.

The full text is being considered for a department-article publication route and is not offered here.

Feasibility project · Under revision

Evaluating Generative AI Advice on HIPAA Cybersecurity

An exploratory evaluation workflow for checking unsupported claims, missing answer elements, and potentially consequential errors. The initial pilot used three scenarios, two local models, and six responses.

Why results are not offered here

The reference standard and scoring process require further review. The project is not independently validated. No model rankings, general error rates, or validated benchmark claims are offered.

Manuscript, scoring results, and evaluation materials remain withheld during methodological revision.

Conference record

Factors that influence HIPAA Secure compliance in small and medium-size health care facilities

Wlad Pierre-Francois and Indira Guzman
KSU Proceedings on Cybersecurity Education, Research and Practice
October 23, 2020

An earlier conceptual model concerning organizational influences on HIPAA security compliance. It predates the completed 2021 survey analysis and does not report that later dataset.

View the university-hosted conference record

Research and professional practice

Wlad Pierre-François is founder and president of P-Bon Consulting Services, which provides managed IT, cybersecurity, and technology advisory services. His research interests include healthcare security and HIPAA Security Rule implementation.

Commercial relationship. The author operates P-Bon and has commercial interests in its consulting services and related resources. These working papers are not independent evaluations or endorsements of those services or products. They do not establish that a client, product, or organization is HIPAA compliant.

For research questions, contact wpierre@gmail.com.

Versions and transparency

Each released paper will identify its version, date, limitations, AI assistance, and suggested citation. Later revisions will include a change note. Any subsequent journal version will be linked with its publication status clearly identified.