Chief Technology Officer at Zama Dr Pascal Paillier talks to Open Access Government about why privacy in healthcare matters, the privacy barriers faced by the industry and how Fully Homomorphic Encryption (FHE) could help
Q: Tell us a bit about you and your area of expertise
I’m currently the Chief Technology Officer (CTO) and co-founder of Zama, a startup that powers machine learning and other applications with homomorphic encryption to ensure data privacy.
I am a researcher and entrepreneur specialised in cryptography and have more than 27 years of experience in the security industry, with a specific interest in designing and developing secure cryptographic primitives (homomorphic encryption, anonymous credentials, etc.) as well as crypto software for embedded architectures such as smart cards.
I have a PhD in cryptography from Telecom Paris and am a member of IACR. I also am an expert at ISO, contributing to international standardisation efforts for cryptography.
Q: Why do you think data privacy in healthcare is considered a critical concern, and what are the potential consequences of data breaches in this sector?
Data privacy in the healthcare sector is a huge concern, primarily because it involves highly sensitive personal information. Patients entrust healthcare providers with their most intimate health records, and any breach of this trust can have profound consequences; unauthorised access to medical records, for example, can expose personal and medical details, leaving individuals vulnerable to identity theft, fraudulent activities, or other malicious actions.
Financial losses are another major consequence. Data breaches can result in substantial financial burdens for both healthcare organisations and the individuals affected, legal actions, regulatory fines, and efforts to mitigate the breach’s impact.
The reputation of healthcare providers is also on the line. When patients believe their confidential information is not adequately protected, trust in the healthcare system simply erodes. Patients may become hesitant to share sensitive information with their healthcare providers, potentially compromising the quality of care they receive.
Q: What are the existing barriers and challenges to maintaining data privacy in healthcare?
One major issue is the lack of interoperability among healthcare systems, leading to data silos that hinder secure data sharing and integration across institutions. Legacy systems – still in use in many healthcare organisations – may lack modern security measures and can be more vulnerable to cyberattacks, which, due to the value of patient data, are rising at an alarming rate in healthcare.
Human error is also a concern. Data breaches in healthcare often result from mistakes such as sending patient information to the wrong recipient, mishandling physical records, or falling for social engineering attacks like phishing. Inadequate training on data security best practices can contribute to these errors, and determining data ownership and obtaining informed consent for data sharing can be a complex business.
Many healthcare organisations also rely on third-party vendors for services like cloud storage, which can introduce new security risks, while balancing the need for collaborative research with privacy concerns is another challenge, especially when sharing patient data among multiple institutions and researchers. And finally, resource constraints, particularly in smaller healthcare organisations, can limit their ability to implement robust data privacy measures.
Q: Can you explain the basic principles of Fully Homomorphic Encryption (FHE) and how it differs from other encryption methods?
With traditional encryption, you essentially lock up your data in a secure “box” (the encrypted form) using a key. To do anything useful with the data, like performing calculations or searches, you must first “unlock” or decrypt it using the key.
Once decrypted, the data is vulnerable, and if someone gains access to it during this phase, your privacy is compromised.
FHE, on the other hand, takes encryption to the next level by allowing you to perform operations directly on the encrypted data without revealing the underlying information. Imagine your data is in a secure “box,” and with FHE, you can perform operations on the data while it’s still inside the locked box.
The result of these operations is also encrypted, preserving the privacy of the data at every step. Only when you’re done with all the calculations and ready to see the final result do you unlock the box through decryption to reveal the output?Â
We’re already seeing Fully Homomorphic Encryption medical potential come to life, and we have started to demonstrate the technology’s practical application in this area through a demo that’s currently available on Hugging Face.
Q: In what ways can FHE address the challenges of data privacy in healthcare, particularly with regard to secure information sharing and analysis?
In the context of healthcare, Fully Homomorphic Encryption offers a transformative solution to the challenges of data privacy in the industry, especially in the context of secure information sharing and analysis. With FHE, medical organisations can perform computations directly on encrypted data, allowing them to securely share or collaborate on research, diagnosis, and treatment planning without the risk of exposing sensitive patient information.
Essentially, FHE acts as a secure intermediary, allowing multiple parties to work with sensitive data without compromising its privacy.
Q: What are the benefits of this approach?
Eliminating the need for data decryption during collaboration not only enhances security but also streamlines the research and decision-making process. It fosters trust among healthcare providers and institutions, encouraging active participation in improving patient care. This is why I am expecting to see a wide adoption of FHE in healthcare in the coming years.
Q: Can FHE contribute to improving patient-provider relationships?
Yes, it plays a pivotal role in empowering patients to have greater control over their personal health data because they no longer need to choose between data security and quality healthcare. With FHE, patients can securely share their encrypted health information with healthcare providers, allowing for accurate diagnoses and tailored treatment plans while safeguarding privacy.
Patients are more likely to actively engage in managing their health when they know their sensitive information is protected. The trust established through FHE ensures that patients feel comfortable sharing their health-related data with healthcare professionals, leading to improved communication and better healthcare outcomes.
Q: What regulatory and compliance issues does Fully Homomorphic Encryption help healthcare organisations address, and how does it impact their ability to use data for research and analytics?
FHE helps healthcare organisations address various regulatory and compliance issues, particularly those related to data protection laws such as GDPR and HIPAA. FHE ensures that data remains encrypted throughout processing, even during research and analytics. This adherence to strict data protection regulations is crucial for healthcare organisations to avoid legal consequences and maintain public trust.
The impact of FHE on the ability to use data for research and analytics is significant. It allows healthcare organisations to harness the power of their data while remaining compliant with regulatory frameworks. By securely performing computations on encrypted data, FHE enables innovative research and analytics without compromising patient privacy.
It opens up new possibilities for deriving valuable insights from healthcare data while adhering to stringent legal requirements. In other words, FHE gives all institutions the superpower of full legal compliance by design by completely eliminating the risk of data breach so that they do not have to care about that anymore.
 Q: What are the current limitations or challenges associated with implementing FHE in healthcare settings, and what steps are being taken to overcome these obstacles?
Implementing FHE in healthcare settings is not without its challenges. One significant limitation is the computational overhead associated with FHE, which can slow down data processing and analysis. This is a practical challenge that requires significant research efforts to optimise Fully Homomorphic Encryption algorithms and make them almost as efficient as usual data processing.
As we speak, cryptography and computer science experts across academia and industry are collaborating to develop faster and more practical FHE implementations by releasing cutting-edge software tools and, soon, hardware acceleration. These advancements aim to make FHE more accessible for real-world healthcare scenarios. Additionally, the healthcare industry is actively exploring ways to integrate Fully Homomorphic Encryption into existing systems and workflows to maximise its benefits while addressing these limitations.
Dr Pascal Paillier, CTO at Zama
Dr Pascal Paillier is a researcher and entrepreneur in cryptography. He has spent the past 25 years inventing new cryptographic techniques for critical industries. From embedded security to whitebox crypto to homomorphic encryption, he has contributed to groundbreaking research in corporate environments.
In addition to being the famed inventor of the Paillier cryptosystem, Pascal is one of the most widely cited authors in homomorphic encryption with more than 12,000 citations.
