Privacy in the modern age of technology is not limited to a set of rules that restrict or prohibit how data can be used. Rather, it is a tool for empowering individuals as they navigate increasingly sophisticated and complex systems, and for enabling innovation and growth while protecting a basic individual right.

This white paper provides a comprehensive framework for building and managing a health care privacy program (also referred to throughout this paper as a health care privacy function) based on the collective insights from in-house and external privacy counsel. While this paper is not designed to comprise a generally applicable “gold standard” for a privacy program, we hope it can provide a practical framework that can be leveraged by privacy professionals in building and managing their particular health care privacy functions.