CIPM: Certified Information Privacy Manager

Privacy by Design requires privacy protections to be embedded in a system’s design and architecture from the beginning, rather than bolted on after development. Excluding the privacy lead from product development and assessing the product’s privacy practices only after external questions arise conflicts with integrating privacy throughout the development life cycle.

No organization can guarantee that personal information will never be lost. Security and privacy controls reduce the likelihood and impact of loss, but residual risk from technical failures, human actions, physical events, and evolving threats remains.

Data retrievability requires that authorized people can obtain needed information reliably when it is required. Restricting access to only two individuals makes records unavailable if both are absent, incapacitated, or otherwise unable to provide access; this conflicts with the availability principle of timely, reliable access to information.

Privacy compliance requires ongoing monitoring and periodic reassessment because regulatory changes can require updates to policies and procedures. A one-time analysis cannot reliably establish compliance for the following five years. NIST’s privacy risk-management guidance describes continuous monitoring and updating to address changing requirements and risks.

HIPAA is the priority concern because acquiring a medical supply company may bring health information and health-care-provider obligations into the business. The HIPAA Privacy Rule protects individually identifiable health information and applies to covered health care providers, including providers of health care supplies that conduct covered electronic transactions.