This is a new series for The Privacy Advisor in which we ask privacy professionals who've been in the field for at least a few years to describe how they got their starts. The series aims to help new privacy professionals gain insights and ideas on how they might jumpstart their own careers.
Kirk Nahra, CIPP/US
As a career, privacy came quite logically but completely accidentally for me. Like everyone of my vintage, privacy was not something a lawyer thought about as a career. It really didn’t exist as a practice area when I was in law school unless you were a criminal lawyer objecting to inappropriate search and seizure or a civil rights lawyer challenging a government regulation on birth control. Not exactly the typical practice of a young law firm associate.
Kirk Nahra
So, I began a career at my firm (where I have been for my entire career) doing work that had nothing even remotely connected to privacy. The meandering path toward privacy began with something completely different — an opportunity to help insurance companies investigate insurance fraud. Even that work started almost by accident, based on a single contact with an older partner at a meeting. More than five years later, that led to working with law enforcement officials and conducting investigations in pursuit of health care providers engaged in fraud — a massive and ongoing problem for the health care industry and the government that funds much of it. In fact, that fraud problem is what led to significant portions of the HIPAA statute, though not the parts privacy lawyers know.
Some of these providers — hospitals providing psychiatric or other mental health and substance abuse services — objected to the provision of patient billing records on privacy grounds. (“We’d love to provide you the records that show we didn’t commit billing fraud, but gosh darn it those privacy laws.”) So, in the pursuit of health care fraud, I became the country’s leading — and maybe only — expert on state privacy laws relating to the production of mental health care records.
Fast forward a couple of years.
The Gramm-Leach-Bliley Act passed, a fortuitous coincidence that I had no control over, creating new privacy and data security obligations for financial institutions, including the insurance industry. I thought, “I got this. I know enough privacy. The industry needs to get started, and no one else knows much at all.” So I started to learn the intricacies of privacy notices and policies and procedures for the insurance industry.
Then come the HIPAA rules, another fortuity for my career. These were similar kinds of rules. They included a similar need for the creation of policies and procedures, pertained to some of the same companies — mainly the health insurance industry — as well as a bunch of other folks, including health care providers and their service providers, the business associates. So, I'm thinking, "I know this stuff, I can do this, and not too many other people really can." It always helps when something is new and no one has much of a head start.
So, then, I am off to the races. At the beginning, both HIPAA and GLBA required companies to build, often from scratch, an internal framework to assess and apply these principles. Then, they needed to build the follow-in process for effective data security. I learned how to do this along with my clients, trying to stay one important step ahead of them by working with lots of companies, paying attention to the industry and reading everything I could. The health care industry took these obligations very seriously. They weren’t perfect, but they worked hard. Then, business associates and other vendors followed, with the challenge of managing obligations from a variety of industries based on the legal obligations of their clients. Data breach notification came next, with a broad array of investigational, enforcement and procedural implications. And now, with the expansion of the internet of things, the growing global privacy environment, and the continuity of data breaches and ongoing data security problems, privacy and data security law is now an issue for virtually every company around the world. That is, if you happen to have employees or customers.
As Bruce Springsteen wrote, "From small things, mama, big things one day come." My path makes sense, as I trace it back, but it was an unintended process from the beginning, with a number of important steps that took place outside of my control. I took advantage of some opportunities, entered new areas, had a lot of luck, and managed to stumble full steam into an entire career.
What lessons to draw from this? Be aware of opportunities. Having a plan is fine, but be ready to deviate from it if it makes sense. Stay with something if you like it, or if you seem good at it, or if you think it really can become something. But be ready to pivot to something else if it doesn’t work. There are lots of opportunities out there — you just have to be ready to take advantage of them.
Comments
If you want to comment on this post, you need to login.