3. Big Data Definitions & Understanding
D
Big
Data Gathering (Integrate, Extract, Secure, Transmit & Transform) and Analytics
are quickly becoming a new frontier of competitive differentiation.
McKinsey 2011….
4. Big Data – Enablement & Protection
D
Big
“Protect the Customer brand by ensuring control, compliance, information
security and data protection in everything we do.”
5. Big Data – Understanding the Prize
D
Big
One of the key principles to seizing the potential of “Big Data” is to first size the
opportunity as well the threat and to ultimately understand what is the prize.
Many big data strategies arise when executives feel an urgent need to respond
to a threat or see a chance to attack and disrupt an industry’s value pools.
6. Big Data – Digging for Gems in all that Data
For many years enterprises have been collecting data from multiple
sources - sometimes because of regulation that data is stored away for
years and makes up for the Volume those “Big Data” references. Now
those same enterprises are trying to extract value from all this information
and in some cases are creating new revenue generating services from
what was at one time classified as “Slag” or having no value.
10. Managing & Securing E2E Data Flows
“Technology is at the heart of automating Secure Data Transmissions, ensuring a consistent level of quality
and compliance by providing a highly scalable “Data Exchange and a Shared Services Framework” that
automates the distribution of information between all the various sources and recipients of “Big Data”
11. Secure Enterprise Collaboration
D
Big
Enterprise Data is generally not created to be hidden away – it is ultimately
created to be shared. This naturally increases the need to create internal
core competencies and the means to control and manage information across
all data flows including “Big Data”
13. Leveraging Data Content & IAM
control
identities
control
access
control
information
D
Big
D
Big
Data security solutions not only prevent information leakage but control
information from accidental, negligent and malicious misuse when data is
in-use, in-motion or at rest. They deliver precise, business-oriented policies,
advanced information detection and contextual behavior monitoring enabling
intelligent enforcement of information policies.
14. Converting Big Data into Big Value
D
Big
Data Governance is an outstanding “Business Strategy” that leads all
companies towards greater efficiencies, lower risk and increased revenues.
The management and control of “Big Data” will underpin the success of
most strategic initiatives within every major enterprise.
SDTU = Secure Data Transmission Utilities ( Cloud like Services) for Enterprise & Cloud
IAM = Identity & Access Management
HIPPA De-Identification
Authorization
A research authorization is a document signed and dated by a subject/participant that satisfies the requirements of the Privacy Rule (required elements) and grants permission for the researcher to use and disclose the subject/participant’s protected health information (PHI) to perform a research protocol. (Research Authorization.) A research authorization is the preferred method under the Privacy Rule for researchers to obtain permission to use PHI. The use of a research authorization is intended to involve a consent process.
Altered Authorization
An altered authorization is a form of waiver of authorization.
Covered Entity
UW-Madison Health Care Component (HCC)
A covered entity, i.e., an entity to which the Privacy Rule applies, includes a health care provider (person or entity) that provides, bills for, or is paid for health care. UW-Madison (UW) is a special type of covered entity, called a “hybrid entity,” which means that for the purposes of implementing the Privacy Rule, UW has both covered and non covered units. The covered units of UW (which include all the employees of those units and certain researchers outside those units) are called the health care component or HCC. Currently the HCC includes the following units:
Medical School clinical departments
School of Pharmacy (clinical units only)
School of Nursing
University Health Service
State Laboratory of Hygiene
Athletic Department (athletic trainers and health information systems only)
Waisman Center (clinical units only)
L&S Psychology Clinic
UW Internal Audit
UW Privacy Officer
Office of Clinical Trials
UW Legal Services (health law group only)
UW Accounting Services
UW IRBs
Researchers who have appointments in units outside the HCC and who conduct research involving protected health information (PHI) in collaboration with researchers within the HCC are considered within the HCC for the purposes of that collaborative research. For example, scientists in the basic science departments of the Medical School or in the Waisman Center who collaborate with scientists or clinical faculty in the Medical School’s clinical departments are considered within the HCC for the purpose of the collaborative research.
Affiliated Covered Entity (ACE) UW-Madison is also one of three entities that have agreed to form an affiliated covered entity (ACE). These three entities have agreed to provide consistent protection of patient/subject/participant rights.
The ACE includes:
University Hospitals and Clinics (UWHC)
University of Wisconsin Medical Foundation (UWMF)
A subset of the UW health care component (HCC)
The subset of the HCC in the ACE is comprised of the Medical School clinical departments (including Family Medicine and its five clinics in the Madison area, but not those faculty practicing on the Milwaukee Clinical Campus), the School of Nursing, the School of Pharmacy (clinical units only), and the Waisman Center (clinical units only).
Sharing of protected health information (PHI) within the HCC or within the ACE for research purposes is a “use” for which no accounting is required. Sharing of PHI outside of the HCC or outside the ACE, even with other parts of UW, for research purposes is a “disclosure” and in certain circumstances requires an accounting at the request of any subject/participant in research.
Data Use Agreement
A data use agreement (DUA) is an agreement required by the Privacy Rule between a covered entity and a person or entity that receives a limited data set. The DUA must state that the recipient will use or disclose the information in the limited data set only for specific limited purposes.
De-identified Information
Information that does not allow an individual to be identified because specified identifiers have been removed.
Disclosure of Protected Health Information
A “disclosure” of Protected Health Information (PHI) is the sharing of that PHI outside of a covered entity. The sharing of PHI outside of the health care component or affiliated covered entity is a disclosure. In general, a disclosure of PHI requires an accounting at the request of the individual who is the subject of the PHI, unless that individual gave permission for the disclosure by signing a valid authorization.
Health Care Operations
Any of the following activities of the covered entity to the extent that the activities are related to those functions the performance of which makes the covered entity a health plan, health care provider, or health care clearinghouse:
Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment.
Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities;
Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs;
Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and
Business management and general administrative activities of the entity, including, but not limited to:
—Management activities relating to implementation of and compliance with the requirements of this subchapter; —Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that PHI is not disclosed to such policy holder, plan sponsor, or customer; —Resolution of internal grievances; and —Consistent with the applicable requirements of § 164.514, creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity.
Health Care Provider
A person or organization that furnishes, bills, or is paid for health care in the normal course of business.
Limited Data Set
Protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual:
Name;
Postal address information, other than town or city, State, and zip code;
Telephone numbers;
Fax numbers;
Electronic mail addresses;
Social security numbers;
Medical record numbers;
Health plan beneficiary numbers;
Account numbers;
Certificate/license numbers;
Vehicle identifiers and serial numbers;
Device identifiers and serial numbers;
Web Universal Resource Locators (URLs);
Internet Protocol (IP) address numbers;
Biometric identifiers, including finger and voice prints; and
Full face photographic images and any comparable images.
Preparatory to Research Activities
The Privacy Rule regulates some of the typical activities done before submitting a protocol to an IRB for review. These activities are designated as “preparatory to research ” in the Privacy Rule and are defined as:
the development of research questions;
the determination of study feasibility (in terms of the available number and eligibility of potential study participants);
the development of eligibility (inclusion and exclusion) criteria; and
the determination of eligibility for study participation of individual potential subjects
The recruitment of subjects or participants is NOT a preparatory to research activity. A recruitment plan is part of a research protocol and requires IRB approval before contact or other information about subjects/participants may be collected. Recruitment is a research activity.
Protected Health Information (PHI)
The Privacy Rule protects “individually identifiable health information,” referred to as protected health information or PHI. The Privacy Rule defines PHI to include information that:
is created or received by a “covered entity,” including a health care provider, and
relates to the past, present, or future physical or mental health, or condition of an individual, or
relates to payment for an individual’s health care, or
relates to the provision of health care in the past, present, or future, and
identifies an individual or could be used for identifying an individual.
Psychotherapy Notes
Psychotherapy Notes are notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record.
Psychotherapy Notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. [45 CFR 164.501, psychotherapy notes]
Public Health
the HIPAA Privacy Rule does not define “public health.” Should you have questions or concerns, please consult the University’s Privacy Officer, Rebecca Hutton.
Research
A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
Use of Protected Health Information (PHI)
A “use “ of PHI is any sharing of that PHI within a covered entity. The sharing of PHI within the health care component (HCC) or within the affiliated covered entity (ACE) is a use. Uses, unlike disclosures, of PHI do not require an accounting at the request of the individual who is the subject of the PHI.
Waiver of Authorization
When obtaining subject/participant authorization is "impracticable," the IRB may approve a waiver of authorization for a researcher to use and disclose protected health information (PHI). The purposes of the research must be described in a waiver application and the IRB must determine that the researcher has satisfied all Privacy Rule requirements for the waiver.
Big Data Wizardry: Pay Attention To What's Behind The Curtain
Guest post written by Axway, John Thielens, Chief Security Officer and Cloud Strategy VP
Axway, are a provider of Secure Enterprise Collaboration & Multi Enterprise Integration solutions.
Big data needs big secure plumbing.
There’s been a lot of hype lately around the concept of big data, with the lion’s share of that hype related to things like analytics, data management and data storage technologies (like NoSQL).
That’s all well and good. But there are other key issues to consider. For instance, as you field all of that big data, how will you feed your endpoints?
This quandary brings to mind a visit I made to a rocket museum in Huntsville, Alabama years ago, chaperoning for a Cub Scout pack. There were many old rocket engines on display at the museum, accompanied by monitors playing films of rocket launches. As always, the launches looked like the simplest concept unfolding perfectly: massive amounts of fuel feeding gigantic fires that send projectiles into the stratosphere.
The camera’s focus was almost always centered on the nozzle – the visible part of the engine, the point at which thrust is created and from which all that sound and fury comes. It’s a focus that provides no perspective on what’s making it all happen, even though it’s that mysterious “something” that is really the most amazing thing of all – a sophisticated choreography of fuel tanks, oxidizer tanks and pumps, governed by a boatload of math and computing power.
Big data analytics strikes me as similar. Like the explosive thrust blowing out of a rocket nozzle, data appears in spectacular volumes, but what all that data means, where it comes from, and how to maximize its value remains a mystery to most of us. It pushes us to ask questions like:
How do we manage where all of these data flows come from and then go?
What’s the timeliness of the delivery of all these data flows?
Is there a real-time use case?
Is there an ipso facto forensics use case?
One thing is certain: Big data can add a huge amount of value, in multiple ways, across most industries. But it’s not a one-size-fits-all proposition. All companies, no matter the industry, must manage the “feeds and speeds” of their data flows, and that means creating reliable models that identify where the information is coming from, what type(s) of analysis it requires once it arrives, what the timeliness of the analysis must be, and where the data should fire off to next.
For instance, particular data types might be necessary to feed a near-real-time complex-event type of analysis; but they might also factor into a more rolled-up, digested analysis that delivers insight into a longer term view.
For example, real-time correlation of a consumer’s location with active coupons relevant to the consumer’s preferences could be used to trigger an alert directly to the consumer; but in addition, the location data could be analyzed in aggregation with other consumers’ location histories to develop trends and patterns that can then be marketed back to retailers to get them to sponsor offers within a particular geography.
It’s an incredibly complicated exercise in digital plumbing and storage management, and it’s ushering in a new era for technologies we’re already familiar with – like NoSQL. In fact, I predict that technologies involving bandwidth management, software and hardware management, dynamic file transfer, dynamic file and message routing, and hierarchical storage management are about to be recast as important players in the big data drama. And these technologies will have new, cloudy versions, too.
It’s easy to get carried away with all the hype around big data and its seemingly endless possibilities. But for me, the really exciting part is the business value of big data – the new ways businesses can discover value in their property and value in the relationships within their customer base.
With these new advantages come new responsibilities. Some industries, for instance, might need to mature their understanding of some “old fashioned” things, like security and networking – a fact that underscores the importance of considering the needs of your specific industry before applying a one-size-fits-all approach to big data analytics.
Let’s take a closer look at security. If you’re a bank, the data you’re analyzing – in an attempt to squeeze as much business value as possible from it – may be loaded with information that must be redacted to comply with payment card industry regulations. If you’re a hospital, and you’re looking for trends in diagnostic therapies, some of that data will very likely be held to strict privacy safeguards under the new HITECH law. The question is, how does anonymizing the data affect the big data analyses of other players in those industries?
It’s a very real question: I remember years ago a prominent search engine hoped to glean value from their search data through anonymization, but researchers given access to the data correlated different types of queries in a way that effectively undermined the anonymization altogether – an unfortunate development that was simply embarrassing then, but would be absolutely unacceptable (as well as potentially illegal) now.
Or take the issue of transmission technologies, and the sheer scale of transmissions involved in big data. At Axway, we work extensively with very large data sets on a global scale, and over the years we’ve discovered that TCP/IP has limitations when you transmit those very large data sets. And this is why we are now seeing an emerging class of file acceleration technologies that fall back on the use of UDP featuring bandwidth management controls quite different than those offered by TCP.
Again, this is an example of how a technology that is relatively “old” still has value, but must be reinvented in order to leverage big data effectively.
Am I looking at this topic like a technician more fascinated with the rocket’s inner workings than the aerodynamics of its chassis? Maybe. But I believe that the security, privacy, performance, storage and transmission issues orbiting big data are posing really interesting problems. The solutions to those problems will require the kind of enabling and supporting technologies that actually get fuel to the engines, generating the upward force that will drive business value across the board.
Now that’s something to get hyped up about
