It seems like a week cannot go by without reading about a major privacy breech somewhere.  Hundreds, or thousands, of names got compromised, along with some associated personal information.  The offending party is sanctioned, fines and punishments are levied, restitution in the form of identity theft protection for a year follows, and the brand is damaged.

This is Privacy: Level One.  We, as an industry, are still new to the reality of digital information.  It's not that paper-based information could not be stolen, it is just that it took a big truck and some strong guys to steal much of it.  Now, an evil hacker in the mountains of a far off country can make a large haul.

We'll get this solved and are making good progress.  There is a constant battle between the protectors of large databases of information and those with nefarious aims, but the good guys are getting better faster. 

Part of the problem is the business people who make the decisions have not yet wrapped their minds around this as a cost of doing business.  That is in part because it is new and in part because the business can't seem to handle many more new 'cost of doing business' items.  But as the price of good privacy protection continues to come down, and the cost of poor privacy protection continues to go up, more of the decisions will flip.  Recently, a one doc practice told me of the cyber insurance policy they just purchased.  So, it is coming.

Then we get to grapple with Privacy: Level Two, which is, 'How are you using my data to serve me?  Are you using it for my best interest or just yours?'  That is a much harder issue.