Minimization is easy to write into a policy and hard to implement, because the default pull of any system is toward keeping everything. Here is the operational version we use.
What does data minimization mean?
For every data element: name the decision it changes, and name who makes that decision. If nothing changes when the value changes, it is not collected. Not “collected and restricted” — not collected.
This test kills more than you would expect. A great deal of what health systems accumulate is collected because it was available, and it survives because nobody asks the question.
What are examples of data minimization in a health program?
- Pull rather than push. ProviderSynch returns a scoped summary in response to a specific prescription transaction, rather than broadcasting records to a subscriber list. The pharmacist gets what the decision needs, when the decision is being made, and no copy accumulates anywhere.
- Summary rather than record. The pharmacist needs the diagnosis relevant to this prescription, the treatment plan, prior therapy and the co-prescription picture. They do not need the full chart, and giving it to them is not generosity — it is an unjustified exposure with no decision attached.
- Aggregate rather than individual. An agency needs to know whether components are being delivered and what they find at population level. Almost no agency decision requires individual-level behavioral health or social determinants data, so that path does not exist.
How long should health program data be kept?
Every category gets a retention period agreed in design, and deletion actually happens. “Indefinite pending review” is not a retention period. If a period cannot be justified against a purpose, it is too long.
How does data minimization affect data security?
The severity of a breach is a function of what was in the pool. A system holding scoped summaries resolved at transaction time, with defined retention, has a materially smaller worst case than one holding replicated records indefinitely. Minimization is the cheapest security control available and it is the one most often skipped, because it constrains the product rather than adding to it.
More: data governance.
Frequently asked questions
What are the principles of data minimization?
One test and three habits. For every data element, name the decision it changes and who makes that decision; if nothing changes when the value changes, it is not collected. Then pull rather than push, share a summary rather than a record, and give agencies aggregates rather than individual data. Every category gets a retention period, and deletion actually happens.
What are the challenges of data minimization?
The default pull of any system is toward keeping everything. A great deal of what health systems accumulate is collected because it was available, and it survives because nobody asks what decision it serves. Minimization is easy to write into a policy and hard to implement, because it constrains the product rather than adding to it.
Does a public agency need individual patient data?
Almost never. An agency needs to know whether program components are being delivered and what they find at population level. Almost no agency decision requires individual-level behavioral health or social determinants data, so in this program that path does not exist. Agencies get aggregates, and the pharmacist gets a scoped summary tied to one prescription.