Insights

Data minimization in practice

The rule that decides what a system holds: if nothing changes when a value changes, do not collect it.

Minimization is easy to write into a policy and hard to implement, because the default pull of any system is toward keeping everything. Here is the operational version we use.

The test

For every data element: name the decision it changes, and name who makes that decision. If nothing changes when the value changes, it is not collected. Not “collected and restricted” — not collected.

This test kills more than you would expect. A great deal of what health systems accumulate is collected because it was available, and it survives because nobody asks the question.

Three places it changes a design

  1. Pull rather than push. ProviderSynch returns a scoped summary in response to a specific prescription transaction, rather than broadcasting records to a subscriber list. The pharmacist gets what the decision needs, when the decision is being made, and no copy accumulates anywhere.
  2. Summary rather than record. The pharmacist needs the diagnosis relevant to this prescription, the treatment plan, prior therapy and the co-prescription picture. They do not need the full chart, and giving it to them is not generosity — it is an unjustified exposure with no decision attached.
  3. Aggregate rather than individual. An agency needs to know whether components are being delivered and what they find at population level. Almost no agency decision requires individual-level behavioral health or social determinants data, so that path does not exist.

Retention

Every category gets a retention period agreed in design, and deletion actually happens. “Indefinite pending review” is not a retention period. If a period cannot be justified against a purpose, it is too long.

Why this is a security control, not a privacy nicety

The severity of a breach is a function of what was in the pool. A system holding scoped summaries resolved at transaction time, with defined retention, has a materially smaller worst case than one holding replicated records indefinitely. Minimization is the cheapest security control available and it is the one most often skipped, because it constrains the product rather than adding to it.

More: data governance.