Blogs - Risk in Business Process Outsourcing
| Distance helps increase your privacy quotient |
| By Pervez Workingboxwalla on 12/11/2008 6:27:00 AM |
I was recently making a presentation on data security and privacy policies to a healthcare service provider seeking to outsource their medical records processing to our delivery centers in India and Philippines. As expected, the client was extremely keen to ensure that both security and privacy of their client’s records is maintained.
Here is a perspective that we share often with our clients during discussions on the topic of privacy security. Given the fact basic data security measures such as physical, technology-related and employee sensitization through education - across the US and other mature outsourcing countries is the same, the question then is “how do you ensure privacy of personal information?”
Assume Mr A and Mr B both live on the same street. Their kids play together and their families often meet for barbeques of Sunday afternoons. One day, Mr A, who works in a medical records company, comes across the medical records of Mr B and he notices that Mr B suffers from HIV. Would Mr A’s behavior towards Mr B be the same as it was before this knowledge? What are chances that Mr A would advertently or inadvertently misuse this information about Mr B?
So the question this scenario merits is - would you be more comfortable to have a person down the street have access to your medical records or would you rather have your records maintained by someone far away – in another city or country, with whom you probably have no contact and for whom your personal information is not of any material relevance? This is of course given that the company managing your records has adequate information security programs in place.
It is therefore logical to state that the privacy quotient of personal data – be it medical or financial or any other type – increases with distance from the source.
Having presented this example to several clients, I have found it to always resonate with them. All clients, of course, must do due diligence on the service providers’ information security programs, but the basic understanding of this concept of distance helps increase privacy quotient always sits well with clients. This healthcare provider was no different.
|
Permalink | Comments (2) |
Email to a Colleague |  |
|
 2 Comments so far |
Re: Distance helps increase your privacy quotient
I find the argument of 'increased privacy quotient' artificial and self-serving. The probability that Mr A being a nextdoor neighbour of one Mr B AND having direct access to medical records of Mr B is technically not zero (practically nothing has a mathematical zero probability) but is probably close to the probability of two marked atoms in a a glass of water to collide. Practically zero. Mr B has much higher chances to die in a crash of some kind.
Further, in an event of infinitesimally small probability that Mr A indeed somehow stumbles upon the med records of B, he would be extremely cautious not to let it out or noticed given harsh consequences if found out.
Further, the record holding company as any corporation cannot be chasing probabilities of a single event like that but is driven by performance and social outlook considerations, that is to say the danger for the record-holding company of any reputation damage is even smaller than the imaginary event itself.
But the other side of the coin shows a not an unreasonable conjecture that in spite of all declarations to the contrary, the general security environment in a faraway region of the world simply cannot be, both technologically and socially, equal to that of the deceloped countries.In short, the argument pro 'higher security in outsourcing' is not convincing, and the issue is still wide open. | | |  | | | | By albatros on 3/12/2009 |
|
Re: Distance helps increase your privacy quotient
“Thanks Albatross for your comments. My focus was to highlight the significance of ‘relevance’ of information. As per the example cited, Mr A has a reason to behave differently with Mr B after Mr A becomes aware of Mr B’s condition – this is natural human behavior. This outcome would have an even lower possibility in the event that Mr B’s condition were to be known to a person in another country as it holds no relevance for him / her.
Let me address your concerns about inadequate security environment at a service provider (SP) in developing countries. The very same record holding company that you refer to is not absolved of its responsibilities relating to data security and privacy when it outsources work involving personal data to say, India. The record holding company conducts an extensive security and privacy diligence on the SP vis-à-vis their own practices, prior to determining the award of the contract. Some countries require that the onshore company file their diligence reports with the regulators.
Let me re-iterate that NOT ALL SPs would have robust security and privacy practices, but then market forces catch up with them and they suffer business losses. In my conversations with clients, I have often been told that some of the security measures that are implemented at our end are very difficult to enforce onshore. Given that outsourcing / off-shoring is a key sunrise industry in developing countries such as India, at an industry level, efforts are made to ensure that best-in-class security measures are implemented across all companies.
Although developing countries may not have privacy laws in place for their own citizens, the employees of the SP are contractually required (as an entity and individually) to adhere to practices that ensure compliance with overseas privacy legislation with serious consequences for non-compliance. As a fact, data privacy breaches do occur despite comprehensive data protection laws existing in developed countries. So other things being constant, doesn’t distance inherently increase your privacy quotient?” | | | | | | | By Pervez Workingboxwalla on 3/12/2009 |
|