How does your institution structure privacy and security?

[Tina Darmohray <tmd () STANFORD EDU>]

A quick question for security & privacy folks - especially those in
institutions with medical schools and hospitals dealing with HIPAA:

How does your institution structure its information privacy and security
functions?  Are they combined, peers, one within the other, or totally
separate?  Where do they report in the organization?  How are responsibilities
divided between them?  How effective do you think the arrangement is?

I'll summarize responses back to the list, anonymized in case anyone
wants to respond privately.

Thanks!

        Tina

-- 

Tina Darmohray
Assistant Vice President and Chief Information Security Officer
tmd () stanford edu
(650) 724-7661