The People Ready Corpus

Today, as Steve Ballmer earlier today observed, is a bittersweet day.   Today is Bill G's last full time day at Microsoft. 

I first visited Microsoft's HQ in Redmond in July 1993.  It was a transformational part of my  career because that is when I firmly decided I wanted to be a part of this company and the greater software industry.  While some great software has already been created, the future potential is still just as large as it ever was.   Bill's impact on the industry and this company is undeniable.   Bill, thanks for having such vision and motivating us all to see beyond ourselves.  You will be missed, but we hope to make you very proud as we continue to help people and businesses worldwide achieve their full potential.   We are looking forward to watching you solve some of the world's most pressing issues and wish you all the best!

These topics are not meant to be trivial.   Volumes could be written about them.  However, ACTION is what is needed.  We can ill afford to waste time trying to get it all correct.  My goals in writing this series would be that the stakeholders in providing healthcare services in the US would take customer service seriously, understanding that doing so could help them reduce costs while improving outcomes and revenue.  That's what today's topic is all about--getting valuable information today that can then be translated into action.

Again, here is both the ground we have covered and what's left in this series:

Why Healthcare is Not Ready for Change

1. Who is My Customer?  Achieving improved knowledge of the customer/patient.
2. Who Manages My Customer?  Modeling the healthcare business for service excellence.
3. How Do I Better Understand My Customer?  Overcoming the insight and analysis technology paralysis.
4. How Can I Better Connect With My Customer?  Connecting people with information.
5. How Can I Get the Monkey Off My Back?   Overcoming obstacles to deliver stellar health services.

How Do I Better Understand My Customer?  Overcoming the insight and analysis technology paralysis.

My writings up to this point have been iterative, so if you missed my urging to take a hard look at the Connected Health Framework and Architecture Blueprint for Connected Health--stop right here and invest some time to read it.   Here is the link for the more meaty Parts 1-5 (http://solshare.net/files/folders/healthcare/default.aspx)

Fail to plan...plan to fail

You need the right team and the right plan for data integration and migration projects.  Spend some time to make sure everyone has adequately planned and make sure you have the right team. 

garbage in..garbage out

Healthcare organizations must examine the data integrity of clinical information prior to moving.   Spending time to explore if the data is good data rather than trying to do so reactively after a migration has occurred not only saves time, it could save lives.  

The data dilemma and its impacts

First, there is a large problem in healthcare of too much data, not enough knowledge.   In essence, we have a hard time tapping all of the data that already exists.   Physicians know this.  Take for example the prevalence of severe sepsis which strikes 3/4 of a million people annually in the US with fatality rates from 28-50% and accounts for 40% of total ICU expenditures (Angus DC et al. 2001. Crit Care Med 29:1303-1310 and Natanson. 1998. Crit Care Med 26:1927-1931).   Better instrumentation of data has proven to yield dramatic benefits.   Don't look to merely implementing CPOE and expecting it to solve the problem.   Implementing CPOE, although organizations spend millions on it, is really only digitizing the information that has been relied on for years.   While this is a step in the right direction, it should not be construed as revolutionary in any sense.  Furthermore, for all of the hype of CPOE and EHR's being the nirvana of health information, there are still some flaws that remain.   Some  have actually concluded that CPOE can facilitate medical errors if clinicians aren't mindful of best practices and cannot process the queues.    (Ross Koppel, PhD, et al (2005). "Role of Computerized Physician Order Entry Systems in Facilitating Medication Errors" (abstract). JAMA 293: 1197–1203. doi:10.1001/jama.293.10.1197).     RFID also has the ability to improve processes and supply/service chains but at the expense of adding lots and lots of data.   Clinical research in the areas of genomics, proteomics, clinical trials, and personalized medicine are all amping up the demand for data.  We are swimming in data, but often lack knowledge or insight.  We continue to invest in islands of information until we decide we need a lifeboat.   Healthcare CIO's need to understand that technology alone is not a panacea and have the vision to see beyond vendor marketing to create an information agile organization.

Integrating data--building an agile information foundation

In order to understand the patient/customer more effectively--health information must be integrated so it can be shared in the healthcare information system.   You must have a plan for data integration.   A great majority of companies I talk to fail to leverage their investments in Microsoft SQL Server fully.   SQL Server Integration Services is a capable integration technology that is included in the license cost and is interoperable with non-Microsoft data platforms.   Some customers have opted to jettison the multi-year task of clinical data integration across multiple systems by implementing a unified solution for clinical intelligence.   While Amalga may not be for everyone, one this it does is help harness seemingly disparate information and unify it for improved outcomes.  Find a good partner who can help is critical.  While there are many companies out there, a few like Accent on Integration focus specifically on data in healthcare.

Data visualization for rapid decision making

One of our business partners,  Vital Images,  has developed software leveraging our platform that that allows physicians to view CT, MRI, and PET images in two, three, and four dimensions (relying on some of the same technology in Windows Vista--imagine that). These images can be dissected, reconstructed, archived, and later retrieved by physicians on the Web.   Now, less invasive surgeries can be accomplished reducing hospital stays and improving outcomes.  What's better, is they can aggregate thousands of disconnected images in a matter of seconds.

Microsoft has developed industry leading business intelligence solutions that can be leveraged within healthcare to solve complex problems, such as revenue cycle management.   Many organizations employ expensive consultants and waste millions just to understand how to bill a patient for service.   In some hospitals, it is almost impossible for a patient/customer to pay at the time of discharge.   The process is just too complex.  This is a perfect solution for data visualization.  Wouldn't it be nice to have solutions that would allow you to :

Monitor	Analyze	Plan
Business Scorecards and Strategy Maps Web-based and personalized performance dashboards let more employees work with information that is relevant, actionable and aligned to their organization’s objectives.	Performance dashboards and analytics PerformancePoint dashboards and analytics provide better insight, allowing users to work with and understand complex information faster.	Planning, Forecasting and Budgeting in Office Connectivity with Office allows more employees to participate in the processes of planning, budgeting and forecasting, while relying on centrally-managed business definitions and security.

Microsoft Office Performance Point Server is just one solution that is extremely cost effective to implement.  

Collaboration and personalization of data

Above I likened most CPOE efforts as mere digitization efforts.   Once you have developed an organizational framework where data is easily shared, then the next logical genesis is to share it with the people who can leverage it to do amazing things.   This is the heart of Microsoft's People Ready message--great people, equipped with the right information tools can do extraordinary things.   One of the most impactful solutions I have seen is from our partner Interknowlogy who helped cancer researchers conduct better research, faster.   Personalizing healthcare data is the last mile in this journey.  While personal health records have been much ballyhooed, their success has proved limited.  That's because what your patient/customer wants is their infromation, their way.   You may send them home with a bunch of X-ray images, but who is to say happens next.   They could share them with their primary care physician, their flight surgeon, their bariatric specialist, their oncologist, their hematologist, etc.   This is why Microsoft created HealthVault.    HealthVault enables organizations to deliver data to their patient/customers so they can expand on its relevance and meaning to their personal health decisions.   This is exactly why Kaiser and Microsoft  are partnering on personalized health information in one of the largest extensions of healthcare data personalization to date.

Overcoming paralysis

Raymond James knows that if it is able to better understand its customers, the result will equate to higher valued relationships, satisfaction, and revenue.   Formula One Racing's engine control units continuously send performance information to pit crews so they can immediately make decisions about how to win the race.  Overcoming paralysis is not something that is far fetched, but it does require leadership.  Leadership must believe that the complexities of the healthcare data problem are solve-able and plan then execute the plan with low cost solutions and savvy project and consulting teams.  In the end it is not simply better data, it is morally responsible for improving the quality of care for our customers.  You never know when you or a loved one might demand nothing less than our best. 

Parts 3-5 of Why Healthcare is Not Ready for Change are coming this week (June 16th-20th).   My plan was to release them last week, but I needed to get some facts stratight so I made the decision to hold off until this week.   This is something that is a very challenging topic to write about both personally and professionally.  As a patient of a hospital that has received numerous national accolades and awards for their enabling technology, I would like to share my first hand experiences that clearly show they have neglected the patient as both a person and as a customer.   While this is a damning contention, it has been my reality.   For professionalism's sake, I will forgo the "kiss and tell" but instead will contructively offer my insight to readers of this blog.  I hope you appreciate me tempering my words and for my desire to get some facts straight.

So while you are debating questions like should I eat those tomato's, how much $ is it going to take to fill up my tank this week, and when will we get there (to all those lucky to be vacationing somewhere) I thought I would add something more lighthearted....

Check out this new element of Live Search called Farecast.   I have used other travel services, but farecast can help me save money in timing my purchases which to me is pretty cool.  And if you are fed up with the major airlines, then check out some new era on demand airlines such as Linear Air and Day Jet.

There is a drumbeat of change across the land.  Both presidential candidates talk about change, and they are talking about healthcare.   Next to the price of gas and food, it is common to hear people talk about the price of healthcare.  Like Bob Dylan once sang "The Times They Are A Changin'". 

Knowing detailed information about your patient/customer will open up new opportunities.  But just connecting information about your patient/customers is not enough.  You need to have a customer service czar.  So today, I will profile what value this person might add to your organization.

Why Healthcare is Not Ready for Change

1. Who is My Customer?  Achieving improved knowledge of the customer/patient.
2. Who Manages My Customer?  Modeling the healthcare business for service excellence.
3. How Do I Better Understand My Customer?  Overcoming the insight and analysis technology paralysis.
4. How Can I Better Connect With My Customer?  Connecting people with information.
5. How Can I Get the Monkey Off My Back?   Overcoming obstacles to deliver stellar health services.

Look at the images below (click the images for links).  Notice anything obvious?

OK--Here it is.  I picked the top 3 hospitals in the US as rated by US News & World Report (#1 Mayo Clinic, #2 Johns Hopkins, and #3 UCLA Medical Center) and compared them to  Minute Clinic and McDonalds.  What I found was health care organizations want their customers to know exactly what departments are in their hospital.  They want you to know how to get in touch with shipping and receiving, security, and supplies.  McDonalds makes it real easy with one service number and one for their business address of headquarters.  Then then offer common requests as an add on (kind of like the SuperSize concept).   Same with MinuteClinic--one number to rule them all.  They even call it CUSTOMER SERVICE.  Okay, this is the time when it should start sinking in.   Everyone needs to be customer service oriented, but you need to make it easy for customers to get information quickly.  In the Information Economy, decisions are made in seconds.  Make it hard to work with you, customers will go elsewhere.  So we have talked primarily about the patient/customer, but what about the other physicians you are trying to recruit, the pharmacies that call in, the patient's families who need information.  How are their customer needs being met?

In order to manage customer relationships, you will need a customer relationship czar.  In most businesses, this person is in operations and typically has some title with the word customer.  Czar may seem a bit harsh, but in healthcare I can't think of a better word.   Next, they need to have worked in a service industry, typically managing or creating a customer contact center.  This is one place where all inquires from multiple modes of communication come into the organization (Letters, faxes, email, telephone, instant message/chat, etc.).

I know what you are thinking right now---SOUNDS EXPENSIVE!!

Try to look at this in relative terms.   If you are a neighborhood hospital, you might have a contact center of 4 -6 people.  Scale it as appropriate.  Invest in some type of contact center software to track these inquires and interchanges.  Check out what ePartners has built on top of Microsoft CRM.   Pretty interesting huh?   It sure would be nice to be able to:

• know who your new and repeat patient/customers are
• track follow up communications
• measure lifetime value or profit from patient encounters

So once you have appointed your czar and have some sort of process for tracking customer contact and connections, you need to evaluate what is happening in terms of service delivery internally.  Involve the core measures and quality teams.  Have the czar be your torchbearer and create your customer service culture.  Once you know who you customer is and you start managing your relationships with them, the possibilities are endless.

Right now, when I go to Lowe's and look at kitchen cabinets, two days later I receive a card in my mailbox with my name on it.  Companies like Nimbelfish provide marketing engines that can help you connect with your customers.   For example, imagine proactively sending targeted emails to customers who have scheduled services pending with your facility.   Expectant mothers guides, co-marketing coupons with area retailers for formula, diapers, etc.  Nutrition guides for diabetics.  The possibilities are endless.  I certainly know which healthcare providers send me relevant information look to them first when I am shopping for service.  

In order to do some of these things, stay tuned for tomorrow's topic  How Do I Better Understand My Customer?  Overcoming the insight and analysis technology paralysis.   We will explore what it takes to move beyond intuition to understanding your customer and the technologies that can significantly help in this endeavor.

I have been mulling over my latest Consumer Reports magazine on the topic of healthcare from a variety of angles.  It was surprising to see that CR has started its Cover America tour to listen 1 on 1 with people to help diagnose what ails our healthcare system.  The challenge in this approach is that most American's have high expectations for healthcare and most do not understand the complexity of the system.   I argue that they shouldn't have to understand the complexity.  Healthcare is a service business and patients compare the quality of health services to other services they deal with (see Dr. Crounse on Healthcare IT or Not:  No excuse for bad service).   It is clear CR wants to be an agent for change and it is also clear that most in the healthcare system are woefully unprepared for it.  I believe there are at least 5 reasons why.  I'll start today with the first reason and continue through the other 4 each day this week.

Why Healthcare is Not Ready for Change

1. Who is My Customer?  Achieving improved knowledge of the customer/patient.
2. Who Manages My Customer?  Modeling the healthcare business for service excellence.
3. How Do I Better Understand My Customer?  Overcoming the insight and analysis technology paralysis.
4. How Can I Better Connect With My Customer?  Connecting people with information.
5. How Can I Get the Monkey Off My Back?   Overcoming obstacles to deliver stellar health services.

 Who is My Customer?  This question seems basic enough, but sadly one that most healthcare providers cannot seem to answer.  Understanding who the customer/patient is often involves a never ending litany of paper and arcane processes.   I use the word customer deliberately.  I think we all ought to think of patients as customers.  Patients today often pay for healthcare in the form of some contribution to employer paid coverage, health spending or savings accounts, co-pays, and other financing for out of band services.

Where health providers have spent some time on this issue has been in consolidating disparate patient information into a master patient index.  While this certainly helps in retrieving patient information, it isn't always all of the information, or even the right information.  And it most certainly doesn't help me answer the question--who is my customer/patient. 

To better understand the customer/patient, providers are often curious about the impact to their revenue.  Who is the insurance provider? What does the coverage look like? Any outstanding collections?   This information might be important when a customer is sitting in front of registration or after accounting is trying to submit to insurance and collect for treatment.  However, as you move through various stages in a customer/patient encounter, the questions about who is my customer often change.   Typically, the next person in the cycle of care only needs to be concerned with the information provided by predecessors.   This is analogous to a track and field handoff--"Just hand me the baton so I can run my leg".   So often this relevant information exists in multiple silo'ed systems, further complicating their view of the customer.   Is the challenge so hard we should just sit back and wait for something miraculous to happen?  Well, actually, NO!

A.   Inventory your customer information systems.   For your organization, determine what is the customer/patient encounter typically like.  Map this out from a process perspective and account for the big exceptions.  Don't go wild, just focus on 5-8 typical exceptions.  Then inventory all of your customer information systems.  Where is customer information stored?  Don't worry yet about how to get to it, just figure out where it is.

B.  Evaluate how customers interact with you.  It may seem trivial again, but how do customers find you and interact with you.  Do they rely on physician referral?  Do they use the phone book?  Do they look at your web site (and if so--what do they look at)?  Where are they reaching your web site from (your internal marketing, search words, etc.).   Do they go to a 3rd party referral service (i.e. through their company, through an association)?  Do they trust you?   Are they consulting other opinions to determine if they are getting the right treatment (like Doctor Evidence)?  You get the point.  Get a few diverse people on your team and brainstorm all the ideas.  Then test them with a few customers.  Invest in some surveys (Microsoft Office SharePoint Server enables you to do some great surveys at a relatively low cost).  This is not an easy process, but would be worthwhile if at this point you are committed to change.

C.  Knock down the silos--Connect your people.  If it seems all of you information is locked into silos, then go find the key and unlock it.   Want to know where the key might be.  Read about the Connected Health Framework.  This is a vendor agnostic framework for connecting all the various stakeholders with relevant information.   If you really dive into this framework, you may feel like you have found the key.  Try to get through the easier reads, then graduate to the entire 300+ page white paper.  It is worth it.   Of course from a product standpoint, we have some innovative solutions such as  Microsoft Amalga, but I believe products alone don't solve complex problems, so that's why I advocate looking at your architecture first.  I could also go on and on about how looking at service orientation and data integration are both worthwhile pursuits, but this is almost like treating before you diagnose.  Look at the architecture you have first and foremost.  What are the bottlenecks?  Where is information stranded?   How do you connect people with knowledge so they can act?  Knowing this will help you take further steps to becoming more customer centric.

..................Tomorrow I will talk about the next steps you need to explore, and that is understanding who manages the customer/patient relationship?  Who should?  And what will it mean if you fail to develop some proactive steps for developing a relationship with these customers (yes, I said relationship).   If you don't work on it,someone else will.  Just look at the site PatientsLikeMe.  This is sort of a Facebook for the patient population. Here they can rate their patient experience, share information, make friends, etc.   When compared to Best Doctors (another fine site), it is truly a social networking approach that I believe has some merit.

Today Microsoft announced a new strategy to help people communicate more effectively in an age of increasingly complex and overloaded mediated communication vehicles.  This was seen as big news to many business leaders and the story appeared prominently in the WSJ.  However, I think the majority of folks may still be missing the point.  This is not about the next techno-gadget or even about your phone.  It is bigger than that.

HCI, or Human Computer Interaction, is something Microsoft has always been exceptional at.  Just look at the innovations in how a user interacts with their computer that have emanated from our company over the last 20 years.  It is truly amazing that the "personal computer" became so personal in such a short time.  But it has not always been about the computer, rather it has always been what the technology can do to help make our world a better place.

In our information economy, we have come to expect information at our fingertips through devices that we rarely perceive as a "computing device".  These are things we call our PDA's, our phones, navigation systems, voicemail, our tablets, our laptops, and even our MP3 players.  We want rich user experiences with multi-modal delivery options--voice, video, graphics, and IM all at the same time-ubiquitously.   Technology has truly made the world a smaller place, and I am proud to be part of the next era of innovation as we make the process of communicating via mediated methods even  more transparent. 

I can envision a day when we really don't think or distinguish between face-to-face interaction and mediated interactions.  Conducing a meeting will have similar levels of richness and potentially greater reach through new technologies.  Doctors will be able to effectively collaborate with their peers to solve some of the world's most perplexing diseases (AIDS, Avian Flu, Diabetes, Alzheimer’s...).   Students will be able to learn from the best educators in the world regardless of their present longitude and latitude--bringing cutting edge to the most remote Indian reservations in North America.  Families will be able to stay connected across geo-political and time boundaries.  Not to sound like a commercial, but this is the true power of people and surprisingly something we have been doing for a while.  It seems now the economics and technology are converging at a pace to make this real, and that is exciting.

This past Monday, May 1st, 2006, Microsoft published 2 new sites that are great resource sites for developers and IT Pro's.  As I was reviewing my mail and blog (now integrated in one cool interface in my Outlook 2007), I saw Luke's recent post about these new content sites.  The BizTalk Developer Center has been completely redesigned and it is much easier to find what you are looking for (samples, docs, etc).    The BizTalk Technology Center is more broadly focused at IT Pro's who are involved in deployment and management with some great virtual lab resources.  Check out these sites!

If you are wondering where I have been spending my time lately, I have two simple answers:

1) Spending time with my predominately healthcare provider and payor customers in TX, OK, LA, and Arkansas  (a lot of time South Louisiana to help those businesses prepare for another hurricane season)

2)  In and around hospitals as an observer (due to some unfortunate and welcome family events).

So, whenever you are around customers it is easy to learn something.  It is no newsflash that healthcare technology is as much an oxymoron as military intelligence  (as an 8 year veteran I can make these first hand observations).  It is interesting to see how healthcare is tackling system to system interoperability and starting to dabble in connecting with partners and suppliers.  One leading school of thought suggests that the large HIS providers who seemly provide everything in an integrated suite of products is the way to go.  The rationale is that if you standardize on one set of technology, then the integration problem is minimized.   Healthcare, despite all its noble intentions is still a business and businesses morph.  Hospitals acquire or are acquired by others, strategic partnerships are created, and workers typically are not on staff and may float from hospital to hospital, demanding to stay connected to their work.  The other school of thought suggests in investing in best of breed solutions, then integrating (which is easier said than done).  Regardless--Microsoft has some great solutions to these problems and it is my opinion that every healthcare provider, payor, or life sciences manufacturer could optimize their business and drive out costs with a solution such as BizTalk.  A few of my customers have made investments in BizTalk, yet lack the required skills to get the most bang for their investment.  They simply bought it to do a simple orchestration or maybe one of our ISV partners leverages its power.  Whatever the reason, there are good training solutions available for the BizTalk novice looking to be an IT hero by putting this platform to good use to drive out inefficiencies.  The BizTalk team posted a great training roadmap for those people who are new to the technology and are looking to deepen their perspective. 

JP

I just recently returned from vacation (a ski trip to Whistler, Brittish Columbia, Canada) and Microsof't's TechReady conference in Seattle.  Of course there are lots of great innovations that are starting to come to market and I could blog on and on about these things for hours.  However, one technology has made an impression on me because I used it daily during this trip:  My PocketPC phone.  While skiing, I used it on the ski lifts as an added measure of security after I heard a story of two skiiers who died after being left on the lifts.  Not wanting to suffer a similar fate, I tucked my PocketPC phone in my ski jacket.  My reasoning was that if stuck then I could easily phone for help, surf the web for the nearest pizza joint and order sustenance, or journal my last thoughts using MS Word.   I also used it for entertainment, playing hours of mp3 songs from my 1GB SD drive and also stored some Tivo to go shows I like to watch. 

When I arrived in Seattle for TechReady it was raining (surprise).  With my device tucked neatly in my pocket I could easily make phone calls without getting my phone wet using my Blueooth headset.  Even more impressive was my ability to view my calendar, search contacts, and open files using nothing more than my voice using MS Voice Command .  I attended multiple sessions and transcribed notes in Digital Ink that I later transferred to my OneNote.  If it sounds like a bad infomercial by now, you must realize that I can never go back to any simple phone device.  It is a smartphone, or better yet a PocketPC phone, or nothing at all.  Yes, I have also used a BlackBerry device in my past, so my head is not in the sand.  The great thing about our mobile computing devices is that they are getting better and better and delivering more value to workers in scenarios where people cannot be connected with a traditional RJ-45 tether.

At TechReady, on of the best demonstrations of this mobile computing world was highlighting the use of Speech Server in an Exchange "12" Beta unified messaging environment.  This was very cool, but also a very real and compelling use of technology.  Think of all of those workers who are on their feet, day after day.  To tie them to a desktop or a laptop would be foreign to their work rythym (think doctors/nurses, stockbrokers, construction workers).  If you are developing applications, it really is no big stretch to develop a VUI (voice user interface) to accompany your traditional GUI interface.  At the link above you can order a 180 day free eval of this technology and see for yourself.  There is also no complex telco switch access needed to get this to work.  I truly think this is a technology ahead of its time that will only become richer as it is integrated in new ways within companies over the next few years.  Try it, you might become an addict like me.

Happy Holidays!   Since many people are still on vacation this week, it seems easy for a significant story to get lost in the clamor of holiday retail spending and how we are securing Time Square for the 2006 festivities.  But there is one that I wanted to bring to the forefront because, in my opinion, it is an important security and privacy issue that IT needs to be certain they have a good handle on.

This week, it seems Marriott Vacation Club International, the vacation ownership/timeshare arm of Marriott International misplaced data tapes containing financial, banking, and social security information from more than 200,000 customers.  It is still unclear if these tapes got lost or were stolen since there is not a lot of public information on the matter.  The only reference I found was from watching ABC World News Tonight.  This is not a new phenomenon as other well known companies in industries such as banking and healthcare have recently had similar incidents.

So, the question is--what are executives (CEO/CFO/CIO's) and IT professionals doing to prevent this from happening to their company?  What can individuals do to protect themselves?

I have a few ideas of where we should start to address the issue, but this is by no means comprehensive nor prescriptive since every company is unique.

1.)  Bring backup and storage to this century.   Too many companies have left their key backup, recovery, and data storage systems in 1990's (or worse) technology.  It is easy to misplace data tapes and Wall Street would shudder to know the companies where I have seen them just lying around.  Companies should be looking at implementing a storage area network (SAN) or similar solution.  Vendors such as EMC and HP have great offerings in this area.  SANs help companies manage their growing volumes of data and support their disaster recovery plans.  Here is a great article on how Greenwich Hospital implemented a SAN that helped improve patient outcomes and manage HIPAA compliance.

2.) Secure your data.  A great new feature in SQL Server 2005 is native database encryption for all versions.  This is extremely valuable for HIPAA and anyone dealing with Privacy legislation like the California Privacy Act.  Encrypt your data.  Also review your data management plans.  How many people touch customer data? Who are they?  What controls are in place to protect from theft, abuse, misplacement, etc?  How are external agents/partners monitored (UPS/DHL)? How often are people trained on protecting customer data?

3.)  Safeguard your customer systems.  Do your systems contain names that would give away their value to anyone who hacks into the system (i.e. a customer database instance is called "Customers" or your Siebel instances are called "Siebel"?  If so, get creative.  If you are not creative, try a naming convention that is non-intuitive to outsiders such as XST01965AC (doesn't appear to be customer data now does it).

4.) Review your software patch strategy.  Review your strategy for keeping up to date on virus signatures, dB patches, etc.

I could probably go on and on about security and privacy, but since I am not an expert in that area-- Check out this resource for IT Pro's--lots of good content.  Here are some other resources you might want to check out.

Microsoft-Help Prevent Identity Theft From Phishing Scams

Microsoft-Security at Home:  Protect Personal Information

Happy Holidays!  I hope you, your families, and your companies have a very safe and SECURE 2006!