Negotiating Privacy
Two federal laws require organizations to protect the private information of customers: the Gramm-Leach-Bliley Act (GLBA) of 1999 and HIPAA. Generally, GLBA requires any organization that stores personal financial information on customers to have a comprehensive security program that identifies threats and risks, and the steps it has taken to address them. HIPAA is similar to GLBA, but instead of protecting financial information, the act requires healthcare organizations to secure health records and guarantee patient privacy.

Both laws, by design, are not highly prescriptive. The Federal Trade Commission, which enforces the so-called Safeguard Rule as part of the GLBA, states that “the plan must be appropriate to the company’s size and complexity, the nature and scope of its activities, and the sensitivity of the customer information it handles.” Which leaves a lot of room for interpretation.

And interpretation usually requires negotiation. Glen Damiani, director of IT at the money management firm United Capital Markets (UCM), says much of his job involves mediating between employees who insist they need access to certain information and the compliance officer who insists on strict access controls. Mostly, a middle ground can be worked out, he says.

For example, when Damiani was head of technology at a healthcare organization (prior to joining UCM), a clinician was transferred from the oncology department to the obstetrics unit. The clinician asked Damiani for permission to access the records of her former oncology patients. She wanted to continue to track their progress and provide them moral support. But the company’s privacy officer ruled that the clinician’s new responsibilities in obstetrics did not give her the right to access the oncology database.

Damiani negotiated a compromise in which the clinician could have access to those patients she had had direct contact with while working in the oncology unit. Strictly speaking, HIPAA does not allow such access, but Damiani argued that it would facilitate continuity of care, an important medical principle. “Compliance has got to be a give and take,” Damiani says. “The compliance officer may be dead set on not giving access, but another senior person is trying to do their job.”

Auditors are increasingly looking for guidance in these matters, Pedro says. But be advised: CIOs should document the discussions and highlight the main points of why the decision was made to allow access to certain data. That way, you can explain your reasoning to state and federal regulators when they come knocking on your door if data is lost or leaked. A clearly worded argument backing up a decision may help convince regulators that you thought about the risks, you thought about how to mitigate them and you took compliance with the law into consideration.