Guiding a healthcare agency to a secure AI journey
How KPMG helped a state Medicaid agency develop a robust new framework for Trusted AI adoption
Client
State healthcare agency
Industry
Government
Primary Goal
Framework for secure adoption of AI
Leading the way on technology means moving rapidly, boldly, and responsibly. Our client, a state Medicaid agency, is a proven first-mover on technology innovation. As the agency began to explore promising new artificial intelligence (AI) opportunities, leadership knew it needed to enhance its technology governance and ensure it had the appropriate guardrails in place to guide trusted, secure adoption. Here’s how KPMG helped the agency make the difference by establishing a framework for AI security and governance that positions the agency to harness this rapidly evolving technology’s dynamic potential.
KEY OUTCOMES
Making a measurable difference
- Established generative AI (GenAI) governance committee to evaluate acceptable use cases
- Developed core principles of Trusted AI
- Updated acceptable usage policies with expanded AI guidelines
- Established security review process to prioritize AI/GenAI use cases
Client transformation journey
Click on each part of the journey to learn more about our client’s transformation.
Our client has always been comfortable moving quickly on new technology initiatives. AI, though, presented some unfamiliar new territory. They turned to KPMG to leverage our established experience setting up leading-edge, secure AI frameworks. In less than a year, we helped them quickly deploy a strong foundation for AI development and adoption that has kept them moving forward.
Mark Maitland
Principal, Advisory, Health and Government Solutions, KPMG US
How KPMG helped the agency map out its AI framework
The agency’s leadership noted the emergence of a GenAI pilot that would benefit from enhanced security and privacy policies. KPMG was engaged to help, and the project quickly evolved into a larger evaluation of the agency’s overall approach to AI. Over the course of 10 months, KPMG led a two-phase initiative that focused on (1) assessing the agency’s current state of AI readiness and defining a go-forward vision and strategy and (2) enabling that vision and strategy through newly created governance structures. During the project, KPMG deployed a multidisciplinary team, drawing on our experience in areas that included AI strategy and development, cybersecurity, health and government services, data management, technology innovation, and project management and governance. Here’s a closer look at each phase of ourwork.
Establishing the vision: A strategic foundation for AI
This first phase was focused on assessing the agency’s current AI landscape—existing policies, procedures, and projects already in the roadmap—and then creating an overall guiding vision for AI. Key steps included:
- Workshops: Led executive strategy sessions with cross-functional teams to create a common foundation of awareness around AI risks and leading practices. In addition to the chief information officer (CIO) and chief information security officer (CISO), C-suite representation included leadership from data, privacy, technology, governance, and legal.
- Acceptable usage policy (AUP): Drafted proposed addendum to the existing AUP to bring enterprise governance of AI technologies in line with the organization’s risk tolerance and documented AI use cases.
- Security framework: Developed an initial AI security framework, based on established AI guidelines from the National Institute for Standards and Technology (NIST), but then tailored to meet the agency’s unique requirements and risk tolerances in both the short term and long term.
Empowering governance: Making it operational
The second phase focused on establishing an operational foundation for AI that aligned with the agency’s overall technology infrastructure. Key steps included:
- GenAI Steering Committee (SteerCo): Established a SteerCo to oversee AI going forward, which includes the CIO, CISO, and key stakeholders from privacy, data, and legal. Group meets at least monthly to ensure alignment with the new AI framework and make adjustments when needed.
- AI intake process: Created an AI intake form to help the SteerCo prioritize AI use cases by evaluating their potential risks versus their potential opportunity to meaningfully enhance the agency’s services.
- Core principles: Established foundational guidelines to govern the responsible use of Al, with periodic review and updates by the SteerCo.
- Risk assessment: Operationalized an Al risk assessment framework that enables the SteerCo to vet the risks of each potential use case across multiple functions. For example, in looking at potential AI models, the CISO might look at security issues, legal can identify possible bias risks, and the privacy officer can evaluate data transparency concerns.
- Data provenance standards: Updated enterprise data standards to include new requirements around AI, ensuring clear documentation around the origin and evolution of data throughout the AI lifecycle.
Taking a pause to stay ahead of the pack
The agency is accustomed to leading the way on technology, but that doesn’t mean racing ahead on AI without the proper guardrails. With a robust new AI governance foundation now in place, the agency’s entire organization is moving ahead with innovation on all fronts—rapidly, capably, and responsibly.
Meet the team that is empowering innovation through Trusted AI
At KPMG, we combine our deep industry experience and modern technical skills to help businesses harness the power of AI in a trusted manner—from strategy to design through to implementation and ongoing operations. Join us on a bold, fast, and responsible AI journey, turning vision into value. You can with AI.
Mark Maitland
Principal, Advisory, C&O Health & Government, KPMG US
Katie Boswell
Managing Director, Cyber Security & Tech Risk Management, KPMG US
David Rodriguez
Principal, Advisory, Health and Government , KPMG US
Kristy Hornland
Director Advisory, Cyber Security Services, KPMG US
Mark Maitland
Principal, Advisory, C&O Health & Government, KPMG US
Katie Boswell
Managing Director, Cyber Security & Tech Risk Management, KPMG US
David Rodriguez
Principal, Advisory, Health and Government , KPMG US
Kristy Hornland
Director Advisory, Cyber Security Services, KPMG US
Explore more insights
Insight
An Illustrative AI Risk and Controls Guide
Start designing practical controls to manage your organization's AI risks.
Insight
Can government agencies trust AI to handle zero trust?
AI promises make zero-trust security a reality. We look at what you might be missing.