Tracy Griffin

Tracy Griffin is the Chief Information Security Officer of Bon Secours Mercy Health, a Cincinnati-based health system, appointed in August 2025.

Career path

Griffin joined Bon Secours Mercy Health in 2010 as information security audit and compliance manager. She later served as Director of Information Security Risk and Assurance, also described as Director for Cybersecurity Risk and Assurance, at the health system.
In that role she led development and maintenance of the organization's cybersecurity risk management, assurance and compliance, policy administration, third-party risk management and digital forensics programs. She holds the CCSFP and PCI-P certifications. Griffin has more than 20 years of experience in healthcare operations and leadership, including 13 years in cybersecurity. She moved into the interim CISO position in May 2025 before being named to the role that August. As CISO, she oversees the health system's vision and strategy to ensure its information assets and technologies are protected.

Public talks and remit

As Director of Information Security Risk and Assurance, Griffin joined Cathie Brown, Vice President of Consulting Services at Clearwater, for a govinfosecurity.com webinar titled Making the Connection Between Cybersecurity and Patient Care.
The session, published March 30, 2023, addressed how ransomware, third-party breaches and insider threats have affected patient care, the trade-offs of expanded cloud access, and how to build enterprise-wide understanding of cyber risk.
It also covered building organizational buy-in for cybersecurity standards and policies and safeguarding against shadow IT. Griffin has described her focus as building a culture of cybersecurity risk management aimed at minimizing risks to patient safety, and facilitating alignment between cybersecurity and business practices that benefit the health system's patients and team members.