Understanding the regulatory issues in test data management
The Health Insurance Portability and Privacy Act (HIPPA) does not specifically say that data cannot be copied to test, but instead states that only people who need access to the data should have that access. So, for example, someone in customer service should be able to access a current customer’s information, to the extent that they are allowed to support that customer. Ultimately, is it up to the company, and their auditors, to determine how much test data is necessary.
Financial regulations are more stringent, including the Payment Card Industry Data Security Standard (PCI DSS) and Personally Identifiable Information (PII). For reasons that are likely obvious, banks and insurance companies are not excited about everyone having access to the trifecta of full name, date of birth, and unique legal identifier. In the US, that identifier will likely be a social security number. This creates a tension between testing...