1 of 33

Lessons Learned While Building a Privacy Operations Center at Headspace Health

Shobhit Mehta

​

2 of 33

About me

  • Security & Compliance Director at Headspace Health

​

  • Held Security & GRC roles at PayPal, Fidelity Investments, Deutsche Bank, Credit Suisse, HSBC

​

  • MS - Information Assurance & Cybersecurity, Northeastern University, Boston

​

  • Interested in Healthcare Compliance, Privacy, Running, Writing

​

3 of 33

Goals

  • Why build a dedicated POC?

​

​

  • Considerations for building a POC.

​

​

  • Guidance on initiating successful privacy programs and cross-functional projects between Engineering, Privacy, Product, and Legal teams.

​

​

​

4 of 33

Assumptions

  • Some familiarity with Privacy laws such as GDPR, CPRA/CCPA and requirements of HIPAA.��
  • Your role is at the intersection of Privacy, GRC, Product, Engineering.

�

  • You have a dedicated Security/Privacy exec to garner the management support from other teams.

​

5 of 33

Why? (1/4)

Legal and regulatory requirements.

6 of 33

Why? (2/4)

Mandatory requirements from app stores.

Apple

Google

7 of 33

Why? (3/4)

145 breaches reported as of Apr 10, 2023

Prevent financial and reputational loss.

8 of 33

Why? (4/4)

Ongoing media scrutiny.

Helps earn (or lose) trust.

9 of 33

But, most importantly…

​

​

​

Privacy is an existential risk.

​

​

10 of 33

Privacy is:

  • a fundamental human right.
  • a competitive advantage for organizations.
    • make promises
  • a foundation of trust.
    • keep promises

11 of 33

Privacy is not:

  • only security.

​

​

  • solely an individual or organization’s responsibility.
    • legal and regulatory framework
    • industry best practices
    • foster a culture of privacy awareness
  • a zero-sum game.
    • Privacy can and need to co-exist with innovation, efficiency, transparency, usability, and accountability.

12 of 33

Guiding Principles of Privacy (1/4)

  1. Consent – Obtained through clear and specific language, record it, and provide members the right to withdraw at any time.�
  2. Accuracy – Accurate, up-to-date, and members have the right to correct inaccuracies.�
  3. Security – Implement reasonable security measures to protect against unauthorized access, disclosure, or use with physical, technical, and administrative safeguards.

13 of 33

Guiding Principles of Privacy (2/4)

  • Accountability – Accountable for complying with data privacy laws and regulations. Provide members access to their information and a means to request deletion. �
  • Transparency – Be transparent about data collection, use, and sharing practices. �
  • Confidentiality – Maintain the confidentiality of personal information.

14 of 33

Guiding Principles of Privacy (3/4)

  • Privacy by Design – Integrate privacy considerations into the design and implementation of the systems, products, and services. Conduct privacy impact assessments to identify and mitigate potential privacy risks.

​

  • Breach Notification – Have policies, procedures and template notifications in place to detect and respond to data breaches. Notify affected individuals in a timely and transparent manner.

15 of 33

Guiding Principles of Privacy (4/4)

  • Data minimization – Only collect the minimum amount of information necessary to achieve the stated purpose. Never collect additional information not needed or improve the member experience.�
  • Data Retention – Establish policies and procedures for the retention and deletion of personal information. Only retain information for as long as it is needed for its stated purpose, and securely delete or anonymize when no longer needed.

16 of 33

What constitutes a POC?

Privacy Operations Center

Governance & Management

Tools

Security

& Awareness

Partnerships

17 of 33

Data Management v/s Data Governance

Governance & Management

Organize

Store

Protect

Maintain

Classification

Frameworks

Policies

Procedures

Stewardship

Strategic

18 of 33

Data Classification

Governance & Management

Highly Restricted

Restricted

Confidential

Public

Traditional data classification didn’t fit our requirements.

19 of 33

Headspace Health Data Classification

Governance & Management

Parent Classification

Child Classification (US / International)

Examples

Sensitive

PHI / Health

Health records, chat transcripts

Sensitive Personal Information / Special Category Data

Government ID, religious beliefs

Private

PII / Personal Data

Name, Email (not direct identifiers to PHI)

Customer Confidential

Customer Confidential

Eligibility files

Company Confidential

Company Confidential / Internal

Business plans, meditations

Research

Research

De-identified PHI, anonymized aggregate data sets

Public

Public

Marketing materials, press releases

20 of 33

Governance & Management

Classification is incomplete without inventory.

&

Complete data inventory is extremely hard.

21 of 33

Milestone for initial inventory

Governance & Management

This only covered the data that we already have.�{we’ll come back to this slide in a moment}

Name

Purpose

Internal / External

Storage Type

Storage Name

​

Classification

Structured / Unstructured

​

Retention Period

​

Owner

22 of 33

Data Subject Access Requests (DSAR) Tools

Governance & Management

  • no one-size fits all.
  • buy v/s build.
  • whatever you choose - keep it live.

23 of 33

Milestone for initial inventory

Governance & Management

This only covered the data that we already have.

Name

Purpose

Internal / External

Storage Type

Storage Name

​

Classification

​

Structured / Unstructured

​

Retention Period

​

Owner

24 of 33

Privacy Impact Assessments

Partnerships

Legal team is your best friend. :)

25 of 33

Privacy & Security Review Procedure

Partnerships

Product

Engineering

Legal, Privacy, Security

26 of 33

Shifting Privacy Left & Right

Tools

Embed privacy tools as part of SDLC

​

​

​

​

Automated Data Classification & Labeling

​

​

​

​

Data Governance

27 of 33

Privacy Threat Modeling - Data Oriented

Security & Awareness

Minimize - Limit collection of personal data.

​

Abstract - Limit processing of personal data.

​

Separate - Separate the processing of personal data.

​

Hide - Protect personal data, or make it unlinkable or unobservable.

​

Source - Privacy Design Strategies

28 of 33

Privacy Threat Modeling - Process Oriented

Security & Awareness

Inform - Inform members about processing.

​

Control - Provide members control over the processing of their data.

​

Enforce - Enforce processing personal data in a privacy-friendly manner.

​

Demonstrate - Demonstrate processing personal data in a privacy friendly way manner.

​

Source - Privacy Design Strategies

29 of 33

Privacy Awareness

Security & Awareness

  • Headspace Health specific HIPAA training�
  • Monthly office hours�
  • Dedicated Slack channels�
  • Privacy intranet & form�
  • Master Privacy FAQ

30 of 33

Summary

  • Recognize that privacy is hard and the industry guidance is vague.

​

  • There is always an opportunity to improve.

​

  • When in doubt, ask yourself - ‘how this will look like on the front page of WSJ?’ to guide and influence your decisions.

​

​

​

​

31 of 33

Security enables Privacy.

​

#putmembersfirst

​

Building world’s most trusted mental health organization.

32 of 33

Resources

  • CRISC Exam Handbook, Chapter 17, Information Security & Privacy Principles - Link
  • Privacy conferences
  • A Taxonomy of Privacy - Link
  • IAPP - iapp.org

​

​

​

​

​

33 of 33

​

shobhit@ginger.io

​

​

GRCMusings.com

�linkedin.com/in/shobhitmehta

​

shorturl.at/jkPV4