Working knowledge of HIPAA (or equivalent regulated-data) practices: least privilege, secrets management, PHI/PII handling in AI pipelines. Strong experience building RAG systems (chunking, embeddings, retrieval evaluation, grounding, citation, safe refusal patterns).