Protecting Customer Data: A Cost/Benefit Analysis

Privacy policies that strictly protect customers' personal data may seem draconian, almost a noose around companies that rely on mining their customer data to better target new products and services, or that make a few bucks in selling lists to other companies. But good privacy policies are not dams. They are more like finely tuned control valves that direct the flow of information where customers'-along with company executives-want it to flow for the best outcome.

That's why good privacy practitioners follow the first rule of valuing the information they have-figuring out what the information is worth to them in helping meet specific goals, be it better health or more revenue-versus protecting that information so that others cannot view or abuse it. That's the balancing act John Glaser, CIO at Partners HealthCare System in Boston, was faced with when developing the health-care organization's intranet. All health-care providers who have privileges at Partners' eight hospitals and medical centers and the administrative and clinical staffs (37,000 in all), have access to the intranet to check on the electronic medical records of patients. Glaser knew the intranet must protect patients' records from unauthorized users, as well as from health-care providers who should not be looking at the records, but he also knew the records had to be easily accessed and immediately available so that doctors and other health-care providers could administer the best care in an emergency.

As a result of that value analysis, Partners' intranet does not have a complicated identity management application that controls access to patient records. When a health-care provider or administrator signs onto the intranet to check a patient's health record, the user must provide her name and relationship to the patient, whether she is the patient's personal physician, attending nurse or lab technician. The system allows access only to those health-care providers who have a working relationship with Partners. However, there is no electronic means to verify the provider's identity through a password or some other second-factor identification.

"Technically, we have never been able to figure out how to do that," Glaser says, or at least how to do it in a way that would not hamper providing the proper health care for patients. Glaser says when a patient comes in to the ER because he suffers from, say, a cardiac arrest, and other complications are found, such as a malignant tumor, specialists have to be consulted immediately. "You are smothered with people, and you'd better be smothered with people," Glaser says. "We have no idea who has been called in to consult on a patient. We have to protect privacy on the one hand, but we don't want to unintentionally shut out a provider that can give the proper care now."

When immediate access isn't such a high priority, and personal information is handled by a wider set of people, a more strict value set should be applied. At health researcher I2B2-which stands for Informatics for Integrating Biology and the Bedside, a federally funded research program at Partners HealthCare System-doctors are developing a protocol that requires asking the permission of people before collecting their DNA. In addition, researchers must follow a defined process for accessing patients' health records and then comparing their DNA to the medical histories to find links and causes for genetic diseases, along with possible treatments.

Because such information could be so readily abused (employers could conceivably refuse employment to people with a certain genetic makeup, for instance) the value bar researchers must clear to access such information has to be higher. "The investigators allowed to see this genetic data are also required to sign contracts saying they will not share the data with anyone," says Dr. Shawn Murphy, principal investigator at Massachusetts General Hospital and a founder of I2B2.