Areas of Expertise

Jon Fenner provides expert witness services in technology disputes where deep technical knowledge and practical industry experience are essential. His expertise spans healthcare technology, cybersecurity, AI/ML systems, and insurance technology — areas where he has built, secured, and led enterprise-scale systems.

Healthcare Data Breaches & HIPAA Compliance

As former CTO of a healthcare technology company serving 100,000+ patients across 12 provider networks, Jon has firsthand experience with the technical and regulatory requirements of protecting patient data. He architected HIPAA-compliant systems, achieved SOC 2 Type II certification, and implemented EHR integrations with Epic, Meditech, and Cerner using HL7 and FHIR standards.

Jon can evaluate and opine on:

  • Whether a healthcare organization’s data security measures met the applicable standard of care
  • The adequacy of HIPAA technical safeguards, including access controls, encryption, audit logging, and transmission security
  • Root cause analysis of healthcare data breaches, including how protected health information (PHI) was exposed
  • Whether SOC 2 controls were properly designed and operating effectively
  • EHR integration security and the risks introduced by data exchange between systems
  • The reasonableness of an organization’s breach prevention and incident response measures

Cybersecurity & Penetration Testing

Jon is a Certified Ethical Hacker (CEH) with hands-on experience conducting penetration tests, vulnerability assessments, and security audits for clients in healthcare, financial services, education, and insurance. He has performed security analysis of customer-facing applications for major insurance carriers and developed security policies for organizations managing sensitive data.

Jon can evaluate and opine on:

  • Whether an organization’s cybersecurity practices met industry standards and the applicable standard of care
  • The adequacy of network security, application security, and access controls
  • Penetration testing results and whether identified vulnerabilities were appropriately remediated
  • Incident response procedures and whether an organization responded appropriately to a breach or attack
  • Security policy adequacy, including business continuity planning and disaster recovery
  • Cryptographic implementations and their effectiveness in protecting sensitive data

AI/ML Systems & Architecture

Jon currently leads engineering for an AI/ML platform in the medico-legal space and serves as a Senior R&D Engineer working on AI systems for autonomous aviation. He has hands-on experience with deep neural networks, large language models (LLMs), recurrent neural networks, TensorFlow, Keras, and AWS SageMaker.

Jon can evaluate and opine on:

  • AI/ML system design decisions and whether they met reasonable engineering standards
  • Algorithmic failures, bias, and unintended consequences in deployed AI systems
  • Data quality and training methodology issues that led to system failures
  • The adequacy of testing, validation, and monitoring for AI/ML systems in production
  • AI-based computer vision and image recognition system performance
  • Autonomous system safety and reliability, including drone and aviation applications

Insurance Technology (InsurTech)

During 11 years at Guidewire Software — the leading provider of core systems for property and casualty insurers — Jon served as Principal Infrastructure Architect, consulting for major carriers including State Farm, Liberty Mutual, American Family, QBE Europe, and Liberty International Underwriters. He led integration projects spanning claims, policy, and billing systems.

Jon can evaluate and opine on:

  • Insurance platform implementation failures and disputes between carriers and technology vendors
  • The adequacy of security measures in customer-facing insurance applications
  • Claims processing system design and whether systems operated as intended
  • Integration failures between policy, billing, and claims systems
  • Performance and scalability issues in enterprise insurance platforms
  • Whether technology vendor deliverables met contractual and industry standards

Cloud Architecture & Infrastructure

Jon holds an AWS Certified Solutions Architect – Professional certification and has designed cloud infrastructure supporting 20 million daily requests and 9TB data warehouses. He has experience with AWS, Azure, Kubernetes, Docker, and modern DevOps practices.

Jon can evaluate and opine on:

  • Cloud architecture decisions and whether they met the applicable standard of care
  • Cloud infrastructure failures, outages, and data loss incidents
  • The adequacy of cloud security configurations, including IAM, encryption, and network controls
  • Scalability and performance issues in cloud-deployed applications
  • Disaster recovery and business continuity planning for cloud environments
  • Cost and scope disputes in cloud migration projects

Software Development Standards

With 25+ years of experience leading engineering teams and building enterprise software, Jon can evaluate whether software development practices met industry standards throughout the development lifecycle.

Jon can evaluate and opine on:

  • Whether software was developed according to reasonable engineering standards
  • Code quality, testing practices, and the adequacy of QA processes
  • Project management failures and whether technology projects were managed competently
  • The reasonableness of project timelines, budgets, and technical decisions
  • Software defects and whether they resulted from negligent development practices
  • Technology vendor performance and whether deliverables met specifications

Data Privacy & Protection

Jon has extensive experience implementing data protection controls for healthcare, financial services, and insurance clients, including HIPAA, SOC 2, and PCI-DSS compliance frameworks.

Jon can evaluate and opine on:

  • Whether an organization’s data privacy practices met regulatory requirements and industry standards
  • The adequacy of data protection measures, including encryption, access controls, and data handling procedures
  • Data breach causation and whether reasonable measures would have prevented the incident
  • Compliance with HIPAA, SOC 2, PCI-DSS, and other applicable frameworks
  • Privacy impact assessments and whether they were adequate for the risks involved