Health care privacy sits at the center of a deep tension. On one hand, there is a strong push by health care and technology companies to use and leverage ever-increasing amounts of health information for a variety of purposes, including precision medicine. On the other hand, regulators around the world treat health information as sensitive data, restricting and limiting its uses. The navigation of this tension is at the core of a health care privacy professional's job.

The goal of this paper is to tackle some of the most pressing challenges in-house health care privacy teams face and describe concrete solutions. We interviewed more than 20 in-house privacy experts for on-the-ground insights and ideas. The interviewees were primarily from the health care industry, but we also interviewed those working on privacy outside of health care. The challenges faced by nonhealth care privacy teams, it turns out, have a great deal of overlap with the challenges faced by health care privacy teams. To supplement the insights from privacy experts, we also interviewed other roles that work closely with privacy, including product counsel, general counsel and chief information security officers.