(Still blogging from the DigitalID World conference. The aggregation of blogs is here.)

Esther Dyson, the moderator, begins the morning general session by asking the conference organizer why there’s no list of attendees. (Actually, she began by graciously saying to this audience of 250 that in a few years, 800 people will claim to have been at the first Digital ID World conference.)

The panelists are Michael Calhoun, Principal of CSC Global Health Solutions and Nikolaj Nyholm, CTO of ASCIO Technologies.

The topic is how policy and practicality collide. Everyone, Esther says, is in favor of privacy and people controlling their own information. But what about transparency, i.e., people knowing the business model, the use of the data, who requested it, etc.?

Michael talks about HIPAA, federal legislation passed in ’96 that required the Dept. of Social Services to come up with regulations for handling patient information across the health care industry. It says that the individual owns his/her health information, possibly to a degree that can be burdensome to good sense. And the data is “tagged” so that if it’s given to a third party, there are still agreements about how it can be used.

Nikolaj says that this is the most European privacy policy he’s heard of in the US. Generally in Europe, he says, the data just isn’t collected. Stores don’t even collect phone numbers from customers.

Esther summarizes nicely: Europe is a bureaucratic culture while the US is a legalistic one. Nikolaj says that US law is very binary: you’ll get your ass sued if you get it wrong. Just as security isn’t binary, he says, – it’s all about risk management – so, too, HIPAA will not provide binary, perfect privacy but can help enforce it.

Esther, the acknowledged master of moderating panels, has now asked all the people lined up to state their questions before the panel addresses them. As a result, themes emerge and some questions that are not as helpful will undoubtedly fall by the wayside. Nice technique.

Jon Udell of InfoWorld asks if HIPAA can actually be implemented and if it will be extraordinarily expensive. Michael replies that the answer is Yes to both questions. The “drop dead” date for implementation is April ’03 and it’s going forward.

Esther’s closing comments: Most of the information about her hasn’t been gathered from transactions. It’s what has been written about her, what she’s written, emails, etc. “In the future, we’ll all have about as much privacy as a rock star.” We need transparency to enable us to fight against the invasions we don’t want.

Good session.

Categories: Uncategorized dw