AI Readiness and Implementation

Assess identity, sharing, devices, and data boundaries. Then enable only approved tools.

Request a tenant review Read acceptable-use rules

Identity and access

Entra identities, MFA, admin roles, joiner/mover/leaver processes, and conditional access.
Service accounts, guest access, groups, and ownership for systems that may connect to approved tools.

Sharing and collaboration

SharePoint, OneDrive, Teams, external sharing, “anyone with the link” exposure, and stale permissions.
Mailbox and file ownership, retention, auditability, and the boundaries staff can explain.

Devices and endpoints

Managed Windows, macOS, iPhone, and iPad devices; browser controls; approved applications; and local data handling.
Endpoint protection, updates, encryption, and the practical controls available for remote and multi-site staff.

Data classes and current use

ePHI, HR, financial, legal, and public marketing information.
Current tools, vendors, add-ons, users, data flows, licenses, and business owners.

Who this is for

AI Readiness and Implementation gives Austin and Central Texas clinics and regulated small businesses a practical way to evaluate AI inside the environment they already use. ALCON starts with identity, sharing, devices, and data boundaries; writes the rules; remediates the gaps; and enables only approved tools.

This service is for clinic owners, operations leaders, and regulated SMB teams that want useful AI without losing control of business information.

Clinics with Microsoft 365, mixed Windows and Apple devices, or multiple locations.
Regulated teams handling ePHI, HR, financial, legal, or proprietary information.
Organizations that have adopted public AI sites, meeting assistants, or add-ons without a clear owner.
Teams that need acceptable-use rules connected to day-to-day IT, security, and HIPAA/GRC responsibilities.

Why readiness comes first

AI use often begins informally. A staff member pastes work into a public site, adds an unreviewed extension, or shares a file more broadly than intended. That shadow AI can create an exposure before anyone has documented the tool, the data flow, or the accountable business owner.

Oversharing is a related problem. If identities, guest access, SharePoint, OneDrive, Teams, endpoints, and email are not understood, an approved assistant may surface more information than its user should see. A license or button does not fix permissions.

Assessment scope

We assess the tenant, devices, data classes, and current use together. The review is scoped to your environment and produces a prioritized view of what can proceed, what needs remediation, and what should remain out of bounds.

We assess identity, sharing, devices, data classes, and current use together—then turn the findings into a prioritized path.

Implementation after assessment

After the assessment, ALCON can help write acceptable-use rules, classify approved and prohibited uses, remediate identity and sharing gaps, and apply the controls that fit your IT relationship. Staff guidance, training, reporting, and escalation can be scoped with the security program.

Implementation may include Microsoft 365 tenant configuration, endpoint policy, email and web controls, logging, vendor review, and a measured rollout. We do not enable a tool simply because it is available. The sequence is identity and roles, sharing and data boundaries, policy and controls, an appropriately scoped pilot, then ongoing review.

1. Identity and roles

Confirm identities, roles, and accountable access.

2. Sharing and data boundaries

Review sharing and the boundaries staff can explain.

3. Policy and controls

Write the rules and apply the controls that fit.

4. Scoped pilot

Pilot an approved tool for the appropriate users.

5. Ongoing review

Keep evidence, training, reporting, and review in operation.

Microsoft 365 tenants

For a Microsoft 365 tenant, Copilot is a subsection of the readiness conversation—not the starting point. ALCON reviews permissions, guest access, sharing, Entra roles, Purview/DLP, auditability, and license assignments first. Only then can an approved rollout be planned for appropriate users. See Managed Microsoft 365 and how to prepare permissions.

What is excluded

No license-first enablement or blanket approval of every available tool.
No permission to place ePHI, credentials, client matter, or proprietary information into an unapproved public site.
No replacement for an EHR, line-of-business platform, human review, legal advice, or the covered entity’s HIPAA obligations.
No automatic compliance, accuracy, savings, or business outcome guarantee.
Vendor due diligence, contracts, data-flow decisions, and any Business Associate Agreement remain subject to documented scope and review.

FAQ

Will Copilot be enabled immediately?

No. For Microsoft 365 tenants, Copilot is considered only after permissions, sharing, roles, data boundaries, and controls have been reviewed. A rollout is planned when the tenant is ready.

Can staff use public AI sites?

Only as the acceptable-use policy allows, with approved uses and clear data boundaries. Public AI sites are never a place for ePHI.

Are Mac and iPhone devices included?

Yes. The device review includes managed Windows, macOS, iPhone, and iPad devices, along with browser, application, update, and local-data controls that fit the environment.

Can this support a HIPAA program?

Yes, when scoped with the existing program. ALCON DTS can connect vendor review, data flows, policies, training, Business Associate tracking, and evidence to the documented HIPAA work. The covered entity retains its legal obligation. See Healthcare IT and HIPAA consulting.

What does the first review produce?

A prioritized view of current use, data exposure, readiness gaps, and practical next steps—not a guarantee that every tool or rollout is appropriate.

Start with a tenant and data-boundary review

Start with the tenant, devices, data classes, and workflows you already have. ALCON will show you the next practical step for readiness and implementation.

Request a tenant/data-boundary review · Managed Microsoft 365 · Healthcare IT

Call 512-892-6900 · Email info@alcondts.com