SGA Internal · Planning Pack · Prep for Ron & Scott
Data & AI Governance
Our first committee — the agenda, the charter, the ask.
A working frame for the kickoff meeting: what it covers, who owns what, and the decisions we should lock before we convene.
Roadmap
How to use this pack
A thinking tool, not the final deck
Everything here is a proposal to talk through and adjust. Once we align, sections 5–11 convert directly into the kickoff deck we present to the committee.
01
The mandate
Why we're standing this up now — the two competing destinies.
02
The meeting at a glance
Proposed date, length, structure, and who presents what.
03
Proposed agenda
A 60-minute run-of-show for the kickoff.
04
Charter & structure
Purpose, scope, roles, and member expectations.
05
Strategy, highlights & security
The value story, the framework, and the compliance posture.
06
Decisions & next steps
What to lock with Ron, plus the pre-read context.
SGA · Data & AI Governance · Planning
02 / 14
01 · The Mandate
Why now
Two competing destinies. Governance decides which one we get.
As SGA moves toward IPO and top-10 DSO scale, we become an official HIPAA target. AI is either part of that story — or the reason it goes wrong.
The opportunity
Move fast with AI
- Practice-level AI, enterprise licensing, automation across scheduling, referrals, RCM
- Tools already delivering real operational value today
- A genuine first-mover edge in the DSO space
The exposure
A breach at the worst time
- PHI shipped into a non-compliant AI endpoint pre-IPO
- SOX scrutiny on anything AI touches in finance
- Regulatory attention that comes with public-company status
The answer
A committee of “how,” not “no”
- Tell teams how to use AI compliantly — don't block adoption
- Structural guardrails, not case-by-case veto
- Enable the upside while removing the downside
“The group's job is not to say no. It's to say — here's what you've got to do to do that, and find those solutions.”
Guiding principle — Ron, Sponsor
SGA · Data & AI Governance · Planning
03 / 14
02 · The Meeting
The kickoff at a glance
One hour to set the frame, show the proof, and assign the responsibility.
Target window
Week of Jul 20
Proposed — confirm the exact date with Ron
Length
60 min
Kickoff; then a standing monthly cadence
Structure
2-tier
AI subcommittee reporting to senior leadership
Framework
NIST AI RMF
Adopted for SEC / investment-bank readiness
Who presents — the split we agreed
Scott — value proposition + the pilot highlight reel. Brooke — security & compliance posture. Ron — sponsor framing, stays high-level.
What "done" looks like for meeting one
Members leave knowing the committee's purpose, what's expected of them, how AI is already delivering, and the guardrails that keep it safe — with a ratified charter and a cadence on the calendar.
SGA · Data & AI Governance · Planning
04 / 14
03 · Proposed Agenda
Kickoff run-of-show · ~60 minutes
The agenda — framed around Ron's four asks
Committee purpose · member expectations · strategy · highlights. Ordered so the value story lands before the guardrails.
01
Welcome & why this committee exists
The mandate and the two competing destinies.
Ron · 5 min
02
Purpose & mandate: “how, not no”
Charter, scope, and guiding principles.
Ron / Scott · 10 min
03
Where AI already delivers
The highlight reel — proof the upside is real.
Scott · 10 min
04
Security & compliance posture
PHI boundaries, BAA, the data architecture.
Brooke · 10 min
05
The framework & strategy
NIST RMF, policy split, two-track model.
Scott · 10 min
06
Member expectations & cadence
What each seat owns; how we operate.
Ron · 5 min
07
Open decisions & next steps
Ratify the charter; assign follow-ups.
All · 10 min
SGA · Data & AI Governance · Planning
05 / 14
04 · Draft Charter
Purpose · draft language to react to
“To let SGA adopt AI aggressively and safely — helping teams use AI compliantly rather than blocking it, so no AI use puts PHI, SOX, or the IPO at risk.”
In scope
What the committee owns
- AI tool adoption, review & approval
- Data access & the PHI boundary
- Vendor & BAA posture
- Policy, training & secure-environment architecture
Out of scope — for now
The hard lines
- Nothing AI-driven feeds back into Sage (SOX)
- Patient-facing clinical AI stays Phase B (post-BAA)
- Finance AI limited to validation / outside-checking
Guiding principles
How we decide
- “How, not no” — enable, don't gatekeep
- The model can't be its own cop — structural separation
- Default-deny on PHI; two-track by sensitivity
SGA · Data & AI Governance · Planning
06 / 14
04 · Structure & Roles
Two tiers · one accountable seat per function
Who sits on the committee
Air cover, resourcing, and executive escalation. Frames the mandate; keeps it high-level in the room.
Owns the agenda and the program. Presents value & strategy; reports progress up to senior leadership.
Brooke
Technology / Security Lead
Secure-environment architecture, PHI screening, and the technical guardrails behind every approval.
AI policy, HIPAA exposure, patient disclosures, and BAA/vendor terms.
Myles · Kyle
Operations & Data
Surface function use cases and risks; carry decisions back into their teams.
Rebecca · Sarah
People & Enablement
Training, LMS rollout, and adoption across the org.
DECISION TO LOCK: Executive sponsor. The April framework listed Jordan as exec sponsor; a later note says the sponsor should be Ron, not Jordan. Confirm before the invite goes out. (See slide 12.)
SGA · Data & AI Governance · Planning
07 / 14
04 · Member Expectations
What we ask of every seat
A seat on this committee is a commitment, not an audience.
The difference between the chicken and the pig at breakfast — the chicken's involved, the pig's committed. Every member is committed.
Show up
Attend & engage
- Attend the monthly meeting; send a delegate only if unavoidable
- Review policy changes & exception requests between meetings
- Come prepared with your function's updates
Bring the work
Surface use & risk
- Bring your team's AI use cases and the risks you see
- Flag any AI touching PHI, finance, or patient comms early
- Hold decision rights for your domain
Carry it back
Champion & enforce
- Champion “how, not no” inside your function
- Enforce approved policy where your team uses AI
- Close the loop on assigned follow-ups
SGA · Data & AI Governance · Planning
08 / 14
05 · Strategy
The operating model behind every approval
Fast where it's safe, controlled where it isn't
Track the work by sensitivity
Two-track model
Non-sensitive & exploratory work runs on subscriptions (skunkworks). Sensitive & production work runs through the enterprise API.
Why it matters: keeps innovation cheap and fast while every PHI-adjacent workload sits behind a BAA with zero data retention.
The compliance backbone
NIST AI RMF + policy split
Govern · Map · Measure · Manage. Low-risk AI use is allowed freely; PHI / PII / proprietary use requires committee review.
Why it matters: the framework SEC and investment banks expect — and a clear, teachable rule for the whole org.
The enabling infrastructure
Dual-warehouse data
A masked, PHI-free warehouse for AI development, and a full PHI warehouse for production reporting — separated by architecture, not instruction.
Status: targeted for mid-September. This is what lets us use AI broadly without exposing patient data.
“The model cannot be its own cop. It cannot be its own regulation.” — the reason we separate PHI structurally, not by asking the AI nicely.
SGA · Data & AI Governance · Planning
09 / 14
05 · Highlights
Scott's section · the proof the upside is real
AI isn't a someday bet — it's already running the floor.
A sample of what's live today. The point for the committee: we're governing something that already delivers, not gating a science project.
Operations
Daybreak
A daily AI-written morning brief for office managers — the top actions per office, scored and fed back each cycle.
Live. Runs every morning against Power BI across the network.
Growth & Payer
Payer & Expansion Intelligence
Payer employer map, a weekly payer digest, and the expansion index — external data enriched with drive-time and market signals.
Live. The weekly digest runs at a few dollars a week.
RCM & Data
Fee, UCR & PMS unlock
UCR fee tooling, AR audit support, and a daily Dentrix data extract that opens our own AR/claims pipelines.
In flight. The data-access unlock the whole program was waiting on.
NOTE: Swap in the exact tools and any hard numbers you want to headline at kickoff — kept qualitative here and PHI-free.
SGA · Data & AI Governance · Planning
10 / 14
05 · Security Posture
Brooke's section · what's already true today
The guardrails aren't theoretical
Already in place
Controls live now
- Anthropic Enterprise BAA + zero data retention signed
- Single sign-on enforced across dashboards
- Phase A boundary: no patient data in AI
Rolling out
In progress
- Azure VMs + DLP allow/block PHI screening on AI traffic
- AI processing moving off local hardware onto managed VMs
- Dual-warehouse masked/PHI split (mid-September)
The hard lines
Non-negotiable
- Nothing AI-driven writes back into Sage (SOX)
- PHI separated by architecture, not model instruction
- Default-mask: new fields are hidden unless cleared
HANDOFF: Brooke owns the deep-dive at kickoff — open items include SharePoint as an AI-accessible source of truth and the automated PHI “red-team” check on the masked warehouse.
SGA · Data & AI Governance · Planning
11 / 14
06 · Decisions To Lock
Resolve these with Ron before the invite goes out
Seven decisions, one short conversation
| Decision | The question | My lean |
|---|
| Committee name | “AI Governance” or the broader “Data & AI Governance”? | Data & AI — the data architecture is the guardrail |
| Executive sponsor | Ron or Jordan? (April deck said Jordan; a later note says Ron) | Confirm — lean Ron, given day-to-day ownership |
| Kickoff date | Confirm the exact day in the target window. | Pick a date |
| Meeting-one scope | Ratify the full charter, or intro + align and ratify next time? | Ratify — charter is close; don't lose momentum |
| Invitee list | Subcommittee only, or include senior-leadership tier? | Subcommittee — report up separately |
| Cadence | Monthly, or tighter while we stand it up? | Monthly + async between |
| Decide vs. inform | What does the committee actually approve at meeting one? | Charter + policy split |
SGA · Data & AI Governance · Planning
12 / 14
06 · Pre-Read Context
Additional context captured ahead of the meeting
What's moved since we set up the framework
Anthropic Enterprise
BAA + zero-data-retention live. ~20 seats; initial users Scott, Brooke, Dan, Ron. Cost model shifts from flat-rate to token-based — budget must be set (worst case ~2027).
Engineering capacity
A dedicated engineering role is being stood up under Scott (redirected from Modus). Today it's “build OR validate, not both” — the single biggest bottleneck.
Infrastructure
Azure VMs + DLP/PHI screening rolling out; AI processing & cron jobs migrating off local hardware onto managed VMs.
Data foundation
Single source of truth / “one clock” on the crosswalk; dual-warehouse masked+PHI split targeted mid-September; SharePoint-as-source-of-truth under review.
Vendors & partners
Henry Schein Dentrix eSync extract + MCP (CISO / SOC2 review pending); Incline for the compliant data-load path.
Hard constraints
SOX / Sage line; Phase A PHI boundary until BAAs close; open question on state-level AI opt-out for patient data.
SGA · Data & AI Governance · Planning
13 / 14
Next Steps
To lock before the kickoff
Six moves stand between here and meeting one.
Confirm date, invite list & sponsor
Owner · Ron
Lock charter, committee name & scope
Owner · Ron / Scott
Build the highlight-reel section
Owner · Scott
Build the security & compliance section
Owner · Brooke
Circulate this pack as the pre-read
Owner · Scott
Convert sections 5–11 into the kickoff deck
Owner · Scott
Get governance right, and AI becomes part of the IPO story — not the reason it goes sideways.
SGA · Data & AI Governance · Planning
14 / 14