Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / Privacy in Healthcare with Timothy Nobles and Punit Bhatia in the FIT4PRIVACY Podcast E155 S07

Transcript

Privacy in Healthcare with Timothy Nobles and Punit Bhatia in the FIT4PRIVACY Podcast E155 S07 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  My best wishes for 2026 to you and your family.
• 0:04
  I hope you have a wonderful year full of health, full of
• 0:07
  vitality, and full of growth. And as we talk about health, how
• 0:10
  about talking about healthcare and privacy?
• 0:12
  Privacy in healthcare has immense relevance, especially if
• 0:17
  you're a company based in the US.
• 0:19
  You have to comply with the GDPR because you may want to come to
• 0:22
  Europe at a certain time. You have to also comply with the
• 0:25
  HIPAA and many other legislation because in pharmaceutical and
• 0:29
  healthcare industries, what happens is you also have to do
• 0:32
  clinical trials and that is a long process.
• 0:35
  And if you're following HIPAA, you also have to do expert
• 0:38
  determination. You also have to do risk
• 0:39
  assessments. You have to comply with, of
• 0:41
  course, all the laws, though it's not easy.
• 0:44
  Now, how about exploring how is privacy in the field of
• 0:48
  healthcare and how would it evolve in coming years?
• 0:52
  Let's do that with a special guest who is the chief product
• 0:56
  officer in a company that's serving healthcare data and
• 1:00
  privacy technology and who has also been in the healthcare and
• 1:04
  privacy space for a long, long time.
• 1:05
  And I'm talking about Timothy Nobles.
• 1:07
  So let's go and talk to him. And of course, remember to take
• 1:11
  advantage of Grow Skills dot Store and learn about ISO
• 1:14
  standards and EU regulations. Welcome to the Fit for Privacy
• 1:18
  Podcast where your host Puneet Bhatia discusses the latest
• 1:22
  trends, challenges and opportunities in privacy,
• 1:25
  artificial intelligence, sourcing and related fields with
• 1:27
  industry leaders and experts. Whether you're a professional
• 1:30
  business leader or just passionate about topics like AI
• 1:33
  and privacy, this is your go to place for insightful
• 1:36
  conversations and practical advice.
• 1:39
  The Fit for Privacy podcast is brought to you by Fit for
• 1:42
  Privacy, your trusted partner in AI privacy and sourcing matters
• 1:45
  and gross skill store. Your go to destination for top
• 1:48
  tier training on ISO standards and key EU regulations.
• 1:52
  Remember that opinions expressed in this podcast are not legal
• 1:55
  advice. Now it's time to dive in today's
• 1:58
  episode. So here we are with Timothy.
• 2:03
  Timothy, welcome to the Fit for Privacy podcast.
• 2:06
  Thank you, glad to be here. It's a pleasure to have you and
• 2:09
  with someone who has such an expertise in pharma industry,
• 2:12
  I'm tempted to ask you or start with how do financial or not
• 2:18
  financial, I should say pharmaceutical companies
• 2:20
  navigate the challenge of GDPR, the new laws that are coming up,
• 2:24
  and especially HIPAA in the USI mean, what's happening?
• 2:28
  How do they see it? Do they see it as a problem?
• 2:31
  Do they see it as a solution? Do they see it as a business
• 2:33
  enabler? What do you observe?
• 2:36
  I observe D all of the above. So you know that that said, what
• 2:43
  we most commonly see is, you know, hey, the regulatory
• 2:45
  landscape is changing, right? So technology all around us is
• 2:48
  changing. And then the use cases in which
• 2:50
  data can be valuable to these companies is also very rapidly
• 2:55
  evolving and without the appetite to try new things is
• 2:58
  evolving. But then how do you do that
• 3:00
  against the backdrop of the regulatory frameworks?
• 3:03
  Where we see companies be the most successful is when they
• 3:06
  think about it, not necessarily in the explicit letter of the
• 3:09
  law. And to be clear, I'm not saying
• 3:10
  we don't pay attention to the letter of the law, but they kind
• 3:12
  of distil it. So what are the core concepts?
• 3:14
  And the idea of mitigating the risk of re identification is
• 3:18
  actually a central theme to pretty much any territories
• 3:20
  regulation on consumer or patient privacy.
• 3:24
  And so now they word it differently.
• 3:26
  They sometimes describe it in different ways, but at the same
• 3:29
  time, at its core, that's what they're after.
• 3:32
  These companies are really taking this approach of like,
• 3:34
  OK, so how can I extract utility from the information without
• 3:38
  actually, you know, raising the risk of re identifying an
• 3:42
  individual? And if we do that, then we have
• 3:44
  the opportunity to produce strategic advantage because, you
• 3:47
  know, especially as you start thinking about machine learning,
• 3:49
  you know, data science capabilities, the almost dreaded
• 3:54
  buzzword of AI, you know, in some extent that gets a lot
• 3:57
  more, you know, kind of complicated, but it also becomes
• 4:00
  a lot more unique because No2, even if you're running the same
• 4:03
  type of models, you get 2 very different answers at the end
• 4:06
  based on what your business knows about the domain and then
• 4:09
  the types of information that you give it.
• 4:12
  And so starting in that position enables the companies to better
• 4:16
  navigate the various territorial regulations.
• 4:19
  Yeah, I agree with you. And in this multi, what do you
• 4:23
  say landscape, multi law landscape, especially for
• 4:27
  companies that are conducting clinical trials and clinical
• 4:31
  trials as you would imagine they have to be conducted across the
• 4:36
  board. You can't say we'll conduct it
• 4:37
  with European data or U.S. data or African data.
• 4:40
  It has to be globally done. So what kind of challenge do
• 4:44
  they face and how can that challenge be solved?
• 4:46
  Because it's practically very challenging to comply law by
• 4:49
  law. Yeah, and clinical trials are an
• 4:52
  extremely complicated thing, you know, whether it be site
• 4:54
  selection or how do you, you know, attract qualified
• 4:58
  participants and how do you sort of reduce waste and time.
• 5:01
  You know, the, the most heartbreaking thing is, you
• 5:03
  know, the pursuit of a, a trial and it takes 5 or 6 years to
• 5:06
  even build the panel for participants, right.
• 5:08
  And so with that, though, you know, again, kind of a similar
• 5:12
  spirit to the previous answer is that when you're kind of focused
• 5:16
  on what are the, you know, kind of particular spirit of the law,
• 5:20
  where how how might you approach the idea of, hey, are there
• 5:25
  other data points that I can pull from sort of non
• 5:27
  traditional considerations? And how, you know, how might
• 5:30
  that be used to go create, look, alikes and audience panels that,
• 5:35
  you know, aren't actually getting at one individual
• 5:37
  uniquely? But how could you use historic
• 5:39
  information out of consumer data and you know, clinical data from
• 5:45
  say, you know, medical claims, you know, and equivalents around
• 5:49
  the world to kind of understand the types of, you know,
• 5:53
  preceding conditions that often lead to the things that are of
• 5:56
  concern for a trial, you know, where diagnosis have been made
• 6:00
  in the past, those types of things.
• 6:01
  And then how might you merge those, you know, in a way that
• 6:03
  is compliant? And that's where there's a lot
• 6:06
  of very robust privacy enhancing technologies, tokenization
• 6:09
  capabilities, and then also very robust statistical models to
• 6:16
  help with some of the remediation and then models to
• 6:18
  help with what are the look alikes, you know, what are
• 6:21
  where, how can you go attract, you know, clinical participants?
• 6:26
  And what, what's kind of interesting in these types of
• 6:29
  approaches where we've seen them deployed so far is that the
• 6:31
  ability to kind of clear the territory regulation starts to
• 6:34
  increase because at the core, you're kind of in a rolling
• 6:38
  start. And so then it's really more
• 6:39
  around, are there other considerations for how you
• 6:42
  manage consent for, you know, how, how do you manage like the
• 6:46
  ability to be forgotten, you know, those types of things.
• 6:48
  So they become a little bit more administrative versus the core
• 6:51
  data set. And the secondarily, it also
• 6:52
  allows you to kind of spin up the idea of running the
• 6:55
  recruitment in parallel to the site selection versus what's
• 6:59
  often a bit of a kind of chicken and egg argument that, well, if
• 7:04
  I don't have this, I can't go get people, but then it takes a
• 7:06
  whole long time to get people. So, you know, then the clinical
• 7:08
  side's on hold and you know, just produces a lot of
• 7:12
  frustration for all involved because, you know, the intention
• 7:14
  behind it is still, you know, very good and very pure.
• 7:17
  But you know, it's like, how do you get rid of the regulation as
• 7:20
  being the core challenge? And so that's that's a bit of
• 7:22
  the way we can network. That makes sense.
• 7:24
  And if we continue the conversation between the GDPR
• 7:28
  and hip hop, I think the US and the EU have taken different
• 7:32
  approaches towards the regulation.
• 7:35
  Is there anything? And of course, end of the day,
• 7:38
  the regulation is same as you mentioned earlier, it's about
• 7:41
  achieving certain objectives. But what is it that can be
• 7:44
  learned from both perspectives or both approaches?
• 7:47
  Yeah. So you know, GDPR, you know,
• 7:50
  strictly my opinion, GDPR has done a really good job about us
• 7:53
  as individuals, right. So they were very thoughtful and
• 7:56
  the way they lay out the framework to give we as
• 8:00
  individuals a lot more rights and control over our data.
• 8:03
  And that kind of has a universal application.
• 8:05
  And you know, here in domestic US, we saw the state of
• 8:08
  California as it started to introduce its Consumer
• 8:12
  Protection Act, it, it actually had a lot of sort of kindred
• 8:16
  spirit, if you will, to GDPR in terms of introducing very
• 8:19
  similar types of rights, you know, for us individually as
• 8:22
  consumers. HIPAA, on the other hand, kind
• 8:25
  of originated from a slightly different place.
• 8:27
  And you know, it, it's, it's always kind of fun to remember
• 8:30
  that HIPAA actually started with the intention of being it
• 8:34
  preventing the idea of discrimination based on a health
• 8:37
  condition, right? And then it evolved very quickly
• 8:39
  from that, where it's also really important to be able to
• 8:42
  share information around and then the idea of minimum
• 8:44
  necessary. So like, how much information
• 8:46
  really is required to, you know, handle the task at hand?
• 8:50
  And then how do you use this data in such a way that you're
• 8:53
  not betraying someone's identity that's increasing the risk of
• 8:56
  discrimination. And so, you know, their starting
• 8:59
  points are very different. But over time, you know, they
• 9:01
  are kind of starting to come towards the middle of it.
• 9:04
  You know, whether or not the US will ultimately adopt, you know,
• 9:07
  a federal that's a national standard similar to GDPR, you
• 9:11
  know, that's up for, you know, our, our friends in Washington
• 9:15
  to figure out, you know, but that, that said it, it has been
• 9:20
  very interested to watch how companies that act in the US,
• 9:23
  you know, that are global. So they're headquarters
• 9:25
  somewhere in the EU are just kind of coming up with a default
• 9:27
  position of saying, Hey, we're, we're going to balance these two
• 9:30
  things. And then, you know, how do we
• 9:32
  harmonise across the regulatory standards?
• 9:34
  And then here the US in particular, how do we navigate
• 9:37
  what our state level regulations where they they might have a
• 9:40
  different or slightly more strict interpretation?
• 9:44
  And when you talked about HIPAA and one thing that prompts me is
• 9:48
  there was, but there is something called expert
• 9:51
  determination concept in HIPAA. Now not many people know it.
• 9:56
  So would you be kind enough to elaborate what is it and why
• 10:00
  does this expert determination under HIPAA offers an
• 10:04
  interesting approach for other global privacy laws or regimes?
• 10:08
  Yeah, absolutely. So HIPAA is this huge bill all
• 10:13
  the way around, you know, and within it there's this security
• 10:17
  arm and then there's this privacy rule.
• 10:20
  And the privacy rule basically outlines how you can work with
• 10:23
  data and pursue the idea of de identified, which is the
• 10:27
  language the the the regulation uses.
• 10:29
  But it finally means that you've successfully mitigated the risk
• 10:32
  of re identification within the data set.
• 10:35
  The privacy rule affords 2 methods by name. 1 is called
• 10:39
  Safe Harbour. Safe Harbour has identified 18
• 10:42
  unique identifying attributes within any data set.
• 10:47
  But the trick there is that it's very destructive.
• 10:49
  And so you just have to remove them wholesale.
• 10:51
  There's no nuance. They just have to go.
• 10:53
  They're gone. You know, cutting room floor to
• 10:55
  use the editing analogy, experts termination, however, is
• 10:59
  actually a statistical method. And so that brings on the idea
• 11:03
  that hey, you can make various modifications and
• 11:06
  transformations to the data in such a way that you are provable
• 11:10
  through statistics have successfully mitigated the risk
• 11:13
  of your identification to a, you know, a testable and adequately
• 11:18
  low level. And you know, not to get too
• 11:20
  mathy, but you know, you're kind of talking about as close to 0
• 11:23
  as you can possibly get without it being pure 0, which is really
• 11:26
  powerful. And so, you know, examples, you
• 11:30
  know, in this kind of end up being the idea of why you might
• 11:33
  want to, you know, group and then age, you know, ages, right?
• 11:38
  So 5 or 10 year increments and then, you know, anyone above the
• 11:41
  age of 89 and it's just you just generally top code them to 89 or
• 11:45
  plus. And then you can also think
• 11:48
  about a geographic area. Here in the US, we use this
• 11:52
  framework called the zip code, you know, again, just for postal
• 11:55
  routing. And so there's a nine digit
• 11:58
  version of it. OK, that's pretty precise, you
• 12:01
  know. And so if you have somebody that
• 12:02
  has an advanced oncology or a complicated, you know,
• 12:06
  neurosurgery, something of that nature, the probability of there
• 12:10
  being more than one of those in a 9 digit zip code is pretty
• 12:12
  low. So, so with that, you know, you
• 12:16
  can't keep that level of fidelity, but at the same time
• 12:18
  you also don't have to get rid of the idea of a geographic
• 12:20
  definition. So how could a ZIP 3 work or how
• 12:24
  could a different geographic definition, you know, here like
• 12:27
  ADMA or CBSA be used and then you'll see the same types of
• 12:33
  things and you know, codes. So like ICDS and what in which
• 12:38
  case, OK, some of this gets so super precise, especially when
• 12:41
  you're dealing with oncology and ultra rare diseases, where, OK,
• 12:44
  is it OK to roll that up, you know, just take it up a digit or
• 12:47
  two kind of idea to enable the utility of the information to
• 12:51
  persist and be less destructive to the data set at large.
• 12:56
  The other thing that's really powerful that I think we're
• 12:59
  starting to see an increasing number of pharma and life
• 13:02
  science groups really latch onto about the expert determination
• 13:05
  method is that it, it can actually be living and
• 13:08
  breathing. And I'm sure you'll appreciate
• 13:11
  the point here. Very often, you know, compliance
• 13:14
  and especially privacy. Is this like, all right, you go
• 13:16
  through this exercise one time, you sit there for 12 or however
• 13:19
  many months, you know this, this particular configuration has
• 13:22
  been blessed. And but the reality is that the
• 13:26
  landscape is moving so fast, the needs are moving so fast.
• 13:29
  Technology is moving so fast. The data strategy has to be
• 13:32
  keeping pace. And if you have this very, very
• 13:35
  static and kind of cumbersome and honest stubborn sort of set
• 13:41
  of rules around privacy, businesses tend to get blocked
• 13:44
  by that. And the beauty of experts
• 13:45
  determination is that, you know, again, I, I, I sort of sometimes
• 13:49
  playfully refer to it as like, it's a bunch of really quick
• 13:51
  math to go do. Now it's a very complicated
• 13:53
  math, to be clear, but but you know, if we can go run the math
• 13:57
  more quickly, you know, how does that actually enable a company
• 14:00
  to better understand even before they go make a date of purchase
• 14:03
  decision or before they make a strategic commitment at the
• 14:07
  board level even? How can they understand what
• 14:10
  this data set might look like post compliance?
• 14:13
  And is these types of things where the expert determination
• 14:16
  has, you know, I think kind of a bit of a universal opportunity
• 14:20
  to support kind of regardless of the territory in which you, you,
• 14:23
  you operate? When you say you can use it
• 14:26
  regardless of the directory which you are in, do you in your
• 14:30
  view think that it's in alignment with GDPR's
• 14:33
  requirements? Parts of you know, the GDPR, a
• 14:37
  very good question by the way. The you know, the GDPR
• 14:40
  requirements are considerably more expansive and again you
• 14:42
  know, where there are rights for the individual and where data
• 14:46
  originators, you know, first party and 3rd party
• 14:49
  participants, you know they have sets of rules.
• 14:52
  But the ability to say that the data has been you know
• 14:55
  sufficiently anonymized and you know de identified to be in
• 14:58
  compliance with a very large portfolio of territorial
• 15:04
  regulations. The expert determination, like
• 15:06
  the math of that and like what it actually produces seems to be
• 15:11
  very durable and seems to have a lot of application.
• 15:14
  Now, I'll be very clear to say it's not a one for one port.
• 15:18
  You know, I have a number of lawyer friends that say, you
• 15:20
  know, it's like 97 and then 3% leftover, you know, and so
• 15:25
  there's always a little bit of fine tuning relative to the
• 15:27
  specific regulatory framework, but in the spirit of like
• 15:30
  covering a lot of ground very quickly to help with
• 15:32
  perspective. And then you can work with the
• 15:34
  specialist in that area to do the fine tuning that that has
• 15:39
  shown to be a a very durable path.
• 15:42
  That makes sense. And we are in the age of AI and
• 15:46
  expert determination used to be very tedious exercise, if I can
• 15:50
  call it like that in the past. And is there a way or is AI
• 15:55
  going to transform this expert determination process in your
• 15:59
  view? I think it already is, to be
• 16:01
  quite candid. You know, we, we, we like AI in
• 16:06
  no uncertain terms. And you know, that said AI has a
• 16:10
  lot of dimensions to it, right? So The thing is, is that, you
• 16:12
  know, we kind of very similar in the spirit of like, you know,
• 16:16
  GDPR, I'll say there's a lot of consideration around what state
• 16:21
  does the data go condition of the data is going into the
• 16:24
  models, you know, these frontier models and how are they being
• 16:27
  trained, right? And so with that, we actually
• 16:29
  see the experts termination technique, you know, and method
• 16:33
  being highly valuable for model training because you're
• 16:37
  mitigating the risk of identifiable elements wandering
• 16:40
  in. And you know, the pattern
• 16:42
  matching and the predictive capabilities that are these
• 16:46
  large scale language models, like they're so good at that
• 16:50
  kind of pattern matching. The ability for them to
• 16:52
  potentially rehydrate an identity is, I mean, that's a
• 16:56
  keep you up at night kind of scare, right?
• 16:59
  And so that said, you know, this is where that method can be used
• 17:03
  to help allow data to be used in this, this training corpus, you
• 17:07
  know, in a very ethical and respectful way relative to, to
• 17:11
  the, the standards of the, the, you know, the, the nations and
• 17:15
  territories. Now the other part of it though,
• 17:17
  is that now think about it, if you're, you know, a farmer or a
• 17:19
  life sciences company, it's like what's allowable, you know, in
• 17:22
  my data, what's allowable in my configuration.
• 17:24
  And so this idea of, you know, you know, AI agents and the
• 17:28
  ability to kind of go query, you know, I, I'm sure all of our
• 17:33
  friends listening have had the joy of reading more than one
• 17:35
  compliance report or an expert determination.
• 17:37
  And it's, it's pretty dry and often a little confusing, right?
• 17:43
  But say you're a product manager or say you're, you know, a team
• 17:48
  lead or an engineer who's just really trying to go in and
• 17:51
  understand like, Hey, can I use this data in this way?
• 17:54
  You know, that's another place where, you know, we actually see
• 17:56
  a lot of potential at AI to help also describe and understand and
• 18:01
  help distil some of the more complicated aspects of
• 18:04
  compliance to make it more approachable.
• 18:06
  And that's more adoptable by all of those that participate with
• 18:09
  data that does have this privacy regulation on it.
• 18:13
  And especially when working with these clinical trials or
• 18:17
  international research, we have this concept just like expert
• 18:21
  determination, something called data clean rooms.
• 18:24
  What's what? What exactly is that?
• 18:27
  I think if anybody can actually get a firm definition on a clean
• 18:30
  room, I want to buy them a coffee.
• 18:34
  You know that that said, the the spirit of the clean room is
• 18:37
  really this idea of, you know, hey, go bring your high fidelity
• 18:40
  data into this environment. And then the only way any
• 18:43
  information can go route is because it's in a, you know,
• 18:46
  sufficiently aggregated level to mitigate this, this risk, right?
• 18:51
  And it also ends up being a much easier way to share.
• 18:53
  It's sort of like a neutral territory for, you know,
• 18:56
  companies to participate in shared data.
• 18:57
  So you're also limiting data movement, which, you know, I'm
• 19:01
  sure we all appreciate that. You know, if you don't need to
• 19:03
  move data around, don't you know, it's just lessen your risk
• 19:06
  exposure, you know, But with that, I mean, we've seen, you
• 19:09
  know, lots and lots and lots of adoption in clean room.
• 19:13
  You know, we're, we're also seeing a lot more of the spirit
• 19:15
  of take the code to the data versus the data to the code, you
• 19:19
  know, across the industry, which I I think is a very wonderful
• 19:22
  and very powerful move all the way around.
• 19:25
  And it also helps with the risking in a pretty significant
• 19:28
  way because, you know, HIPAA in particular has this idea of
• 19:31
  minimum necessary that that specific language here in
• 19:35
  Nashville, TN where I'm based, like we that's sort of like our
• 19:38
  shorthand for like, OK, just because it's here, do we need
• 19:40
  it? You know, and it's like, well,
• 19:42
  what's the minimum necessary? Like we don't want anything we
• 19:44
  don't need to have. And so as a result, a clean room
• 19:47
  really kind of embraces that spirit.
• 19:49
  It allows you to take out only what you need and it of what
• 19:52
  you're taking and it's aggregated sufficiently such
• 19:54
  that you know you can go support your use case, but you're also
• 19:57
  not taking on additional liabilities by having more
• 20:00
  fidelity than than what you need.
• 20:03
  So while we talk about what is the situation in privacy and how
• 20:07
  people are approaching it, especially in healthcare, I'm
• 20:11
  with the knowledge and breadth of experience you have.
• 20:14
  I'm tempted to ask you, how do you see the future evolving,
• 20:18
  especially from healthcare and privacy perspective in next few
• 20:22
  years, say 10 years or something?
• 20:24
  Because we will have this AI, we will have this quantum.
• 20:27
  Who knows when quantum will come or some say it's already there.
• 20:30
  Depends on how who you talk to. How do you see this evolving?
• 20:33
  What what changes do you see in data privacy, especially in
• 20:36
  healthcare context? Yeah, I, I, that's a really fun
• 20:40
  question. I Daydream about it routinely,
• 20:42
  you know, so you know, that that's it.
• 20:45
  I I sort of anticipate as the technology itself gets better
• 20:50
  and cryptography gets better and the ability to make secure at
• 20:54
  rest increasingly more robust, we will anticipate, especially
• 20:58
  in healthcare, you know, we could potentially anticipate
• 21:01
  having more direct control over our records, right?
• 21:04
  So instead of, you know, a health system uniquely sort of
• 21:08
  owning that information about us, we own it such that, you
• 21:12
  know, as we need to, you know, traverse or go through various
• 21:16
  different points of healthcare. You know, the, the team at
• 21:19
  Harvard University had this really, you know, great point of
• 21:23
  view on the idea of a diagnostic odyssey, right?
• 21:26
  And the fact that you end up seeing multiple specialists, you
• 21:29
  know, on a multi month, even maybe even a multi year, you
• 21:33
  know, journey just to get something diagnosed that's not
• 21:37
  over and obvious. But how, how complicated it is
• 21:40
  to share the historic, what has been done, you know, to inform
• 21:44
  the new specialists that you're seeing, you know, on this
• 21:46
  journey. And so the, the patient in that
• 21:49
  case is having to rehash a lot of your previous efforts in
• 21:54
  order to catch up the latest. And so, you know, again, kind of
• 21:58
  as these cryptographic and at rest methods get better, how
• 22:00
  might we actually take a more proactive role?
• 22:02
  And how might we, you know, directly consent to allowing,
• 22:05
  you know, being kind of more proactively involved in making
• 22:07
  these decisions on, you know, hey, here you go.
• 22:11
  This is the history, you know, and then subsequently, how could
• 22:13
  that potentially help the, the, the care teams that we're
• 22:17
  working with make better decisions more quickly?
• 22:20
  And you know, with that too, you know, of course, there's,
• 22:23
  there's the, the inevitable, you know, AI is doing very magical
• 22:27
  things, you know, in terms of discovery and, you know, when we
• 22:31
  can actually get the information more centralised and more
• 22:34
  purpose, you know, where could, you know, kind of fit for
• 22:36
  purpose, you know, models be more supportive.
• 22:40
  So I could see a lot of that happening.
• 22:42
  And then I think too, like the, the spirit of like the ability
• 22:44
  to edit what information is on file about ourselves at large.
• 22:49
  I, I really do have a huge aspiration that becomes more
• 22:52
  reliable, you know, and it's like data brokerage and data
• 22:55
  originators. That's a very hard job for them.
• 22:58
  And, you know, every one of those that we talked to, they
• 23:00
  all seem to share that like, hey, like we're into it, you
• 23:04
  know, they're very committed to it.
• 23:06
  But the ability to get that to propagate and go far and wide
• 23:10
  and get, you know, historic information deleted, you know,
• 23:13
  based on our individual request, you know, that's, that's, that's
• 23:17
  not a trivial problem. So, you know, where and how
• 23:20
  could, you know, evolving processes And then, you know,
• 23:24
  you know, I'll just loosely use the idea of like AI also
• 23:28
  contribute to to helping with that so that you're looking at,
• 23:31
  you know, not only your current but historic data to ensure
• 23:35
  compliance with the current configuration.
• 23:38
  So while you have said so much about privacy, how it will
• 23:43
  evolve and what's happening in pharma sector, tell us also
• 23:46
  something about you. How did you end up in privacy
• 23:49
  and what are you doing in your day-to-day job?
• 23:52
  Yeah, thank you. So I kind of always like to joke
• 23:54
  that I started life as a as a rock and roller.
• 23:57
  So I was a professional musician for simplest years.
• 23:59
  That was very gracious and took me around the world and then a
• 24:04
  couple times over and then, you know, along the way I kind of
• 24:07
  found myself in marketing roles. Being based in Nashville, TN,
• 24:10
  It's like very, very heavy healthcare.
• 24:12
  So it was an issue of, you know, when, not if.
• 24:14
  And along the way in marketing, I was very data savvy, really
• 24:19
  liked working with predictive models as early as that idea
• 24:22
  was, was true. And you know, kind of along the
• 24:27
  way, the more sophisticated the team and I we're getting with
• 24:31
  the data, the more of the question of just because we
• 24:33
  could, should, you know, we do that and which really kind of
• 24:38
  put me off down the journey of, of privacy.
• 24:41
  And so, you know, the deeper then I kind of made the
• 24:43
  conversion over to the product side of my profession where we
• 24:48
  started building a lot more data products and analytics products
• 24:50
  that are being used by top health systems and top payers,
• 24:54
  you know, and top pharma companies.
• 24:56
  And, you know, in that that introduced many, many, many,
• 24:59
  many more complicated regulatory considerations.
• 25:02
  And so instead of fussing about it, I just leaned into it and
• 25:05
  I'm like, OK, well, this is not a sweet process by any means,
• 25:09
  but like, let's go do this, right.
• 25:11
  And I was always very, very grateful to to have, you know,
• 25:14
  CE OS and boards that were like, we're going to, we're doing what
• 25:17
  the law says we're going to do and, you know, just get it
• 25:21
  right. And that was always a really
• 25:24
  great mandate to have. And so that allowed me to work
• 25:27
  with some really great counsel and, you know, determiners over
• 25:29
  the years to really get in and learn the particulars.
• 25:33
  It also led to a lot of good sparring matches of, you know,
• 25:36
  hey, I still have to have this to hold on to the utility of the
• 25:39
  data. Otherwise I don't have anything
• 25:40
  of commercial value. So how do we find the middle
• 25:43
  ground? That's really where I learned a
• 25:45
  lot about the depth of what can be done with an expert
• 25:47
  determination as a statistical model.
• 25:50
  And, and then out of that, you know, then just the opportunity
• 25:54
  presented itself to come participate in making the
• 25:56
  process better, right? I mean, my experience and
• 25:59
  product was always that every time you realise you're going to
• 26:01
  need to get a new opinion letter or access station or expert
• 26:05
  determination, you just kind of pause for a second because you
• 26:09
  knew like on a good day it was going to be a 12 week process,
• 26:11
  in some cases 6912 months, you know, and you know, there's 9
• 26:16
  and 12 months when just the business impacted.
• 26:18
  That is dreadful, you know, because very often you know, the
• 26:22
  the strategic budgeting for the business had considered a
• 26:25
  product being available that compliance ultimately blocks.
• 26:29
  And I don't know a single compliance professional that
• 26:32
  wants to be business prevention. They all want to help the
• 26:34
  business move and grow, but at the same time, going through
• 26:38
  this very arduous process was, you know, very difficult.
• 26:41
  And so the opportunity to participate with company
• 26:44
  integral that was really re reconsidering how that could be
• 26:48
  done and how could you do that literally in a matter of days,
• 26:51
  not, you know, an issue of weeks or months was a very, very
• 26:54
  exciting proposition to me. So I packed my bags immediately
• 26:59
  and set forth. And so it's, it's been really
• 27:02
  great to be able to support some of the biggest names, you know,
• 27:05
  in pharma and be able to help them find this path towards
• 27:11
  literally the idea of a living and breathing compliant relative
• 27:16
  to privacy regulated data. You know, such that we have many
• 27:21
  companies that every month they're bringing on new data and
• 27:24
  you know, we're able to help support them with that.
• 27:26
  Just just ongoing and constantly it's been really selfishly, it's
• 27:31
  been really amazing to watch just the different in the way in
• 27:35
  which teams are starting to work and think about data because
• 27:38
  we're removing the barrier of, you know, the process of getting
• 27:42
  compliant. We're just turning that into
• 27:44
  something that's just natural. You just do it in real time
• 27:47
  along with the other work that you're doing.
• 27:49
  No, you're doing well, you're doing great.
• 27:51
  So thank you so much for continuing to do that.
• 27:53
  And now based on this conversation, if somebody says I
• 27:57
  want want to get in touch with you, what would be the best
• 28:00
  possible way? Yeah.
• 28:02
  So the the website useintegral.com or LinkedIn.
• 28:07
  So it's just Timothy Nobles and those are the two that get
• 28:11
  monitored the most. OK, that's good.
• 28:14
  So thank you so much. I didn't realise that the time
• 28:17
  has just elapsed and I'm so happy to have you.
• 28:22
  So thank you so much for your time and insights.
• 28:26
  It was great. Thank.
• 28:26
  You. Yeah.
• 28:27
  Thank you. I really enjoyed being here
• 28:29
  today. Thank you for the thoughtful
• 28:31
  conversation. Thank you for joining us on the
• 28:34
  Fit for Privacy podcast. We hope you found today's
• 28:37
  conversation valuable and thought provoking.
• 28:39
  Subscribe for more insights like this.
• 28:41
  If you enjoyed this episode, we'd appreciate that you'd share
• 28:44
  it and write us a review. For consulting, visit
• 28:47
  www.fitforprivacy.com. For certifications and training
• 28:52
  on ISO standards, visit www.growskills.store.
• 28:57
  You can also contact us for bespoke training for your staff
• 29:00
  and management. Until next time, stay safe, stay
• 29:03
  compliant, and grow your skills.