In his new role, Lacey, a university employee since February 2000 who currently is executive director of its Information Security Institute.">
   About The Gazette Search Back Issues Contact Us    
The newspaper of The Johns Hopkins University September 15, 2003 | Vol. 33 No. 3
Info Security Chief Named for Hopkins

Darren Lacey

By Phil Sneiderman

An enormous amount of sensitive information is generated each day within The Johns Hopkins University and The Johns Hopkins Health System, from student and employee data to medical records, in paper documents and electronics files. To make sure this information is collected and stored in a safe and secure manner, Johns Hopkins has appointed Darren Lacey to serve as chief security officer/information security policy coordinator for the university and the health system.

In his new role, Lacey, a university employee since February 2000 who currently is executive director of its Information Security Institute, will draw on his training as an attorney and as an information technology specialist.

"This will be a complex position," Lacey said. "There's a lot of new privacy and security legislation that Hopkins is required to comply with, including several [regulations] dealing with student information and medical records. The idea of this position was to coordinate the ways we protect our information, whether it's being stored or transmitted. We need to maintain the privacy of this material and at the same time make sure we have a strategy in place to recover the data in case some type of electronic problem or property loss occurs."

Lacey will report to Stephanie L. Reel, chief information officer for the university and the health system.

"Darren is uniquely qualified to provide leadership in this complex area," Reel said. "His appreciation for the law, for technology and for institutional values is rare, and valued."

Lacey, who assumes his new post Oct. 1, believes Hopkins already is doing a good job of protecting its information. He pointed out that Hopkins' networks held up better than those of many other universities and corporations during the recent flurry of computer virus attacks.

At the same time, he said, one of his key challenges will be to make sure all offices of the university and the health system are coordinating information security rules and procedures.

For the first year or more, Lacey will focus much of his energy on the newly published HIPAA security requirements, coordinating his activities with the Johns Hopkins Medicine HIPAA Office, reporting to Joanne Pollak, JHM general counsel. He will work with Carol Richardson, the JHM HIPAA privacy officer, to ensure that the institutions are compliant with these regulations across the enterprise.

He will be responsible for the safe and secure handling of paper and electronic data at the Homewood campus, East Baltimore medical campus, Bayview Medical Center, Howard County General Hospital and other Johns Hopkins locations.

"I'll be making recommendations about privacy and security regarding our files and records," Lacey said. "Security is what allows privacy to take place. If I leave patient records or confidential student files open and unattended on my desk, I'm not securing privacy for these materials. If I use faulty passwords that make it easy for someone to break into our computer system, that can compromise privacy, too."

In his new role, Lacey will confer with attorneys for the university and the health system, as well as their information technology staffs. He comes to the job with a law degree from Harvard and extensive experience in electronic data systems. But because of the size and diversity of Hopkins' operations, he expects to have his hands full during the coming months.

"There will be a great coordination challenge here at Hopkins because this is such a large and far-flung institution," Lacey said. "My job will be to help people work together on information security matters."

Lacey expects to retain his affiliations with both the Information Security Institute and the Enterprise Development Office but not in day-to-day management roles.


The Gazette | The Johns Hopkins University | Suite 100 | 3003 N. Charles St. | Baltimore, MD 21218 | 410-516-8514 |