What happened
Help Net Security covered a PhD dissertation by Beyazıt Bestami Yüksel at Istanbul Technical University that takes a familiar vendor claim apart. Ask most companies how they protect sensitive health data and the answer is encryption in transit and at rest. Both are true, and neither answers what happens while the data is used, because a cloud service that needs to compute an average heart rate has to decrypt first. In that window, plaintext sits in memory on someone else's server.
The research splits the data lifecycle into three trust boundaries, each with its own protection. At the source, the sensor and edge device, latency dominates, so the scheme is lightweight. Across communication and storage, standard tools such as TLS and AES apply. At the third boundary, where institutions compute and train together, homomorphic encryption and federated learning are used so that values can be aggregated while encrypted. Each site trains locally and sends only model updates, and an aggregator that follows the protocol but is curious about the data cannot read any single hospital's contribution.
Then comes the bill. Yüksel tested the approach on a public dataset of roughly 21,800 ECG recordings, partitioned to simulate several hospitals. Where each site held different patients but the same kinds of measurements, encryption added about 30% computational overhead. Where sites held different pieces of information about the same patients, overhead rose to roughly 450%. In the most tangled arrangement, it reached 1,200%. Diagnostic accuracy stayed broadly flat, between about 97% and 99.9%. The experiments were simulated hospitals, not a live deployment, and real institutions should expect costs to push upward.
Why this is a GRC story
This is a threat model that most questionnaires never reach. Encrypted in transit and at rest answers a network question. The gap is data in use, where the risk sits in any pipeline that sends telemetry through a gateway to a cloud service feeding a model. One line in the vendor review, asking who can see the data while it is processed, does more than another page of encryption assurances.
The cost driver is organisational, not technical. Overhead moved from 30% to 1,200% depending on how data was divided between sites, a division set by data sharing agreements and what each party accepts in writing. Those are governance decisions made before an engineer configures anything. Privacy by design is often described as a methodology. In practice it is a negotiation that sets the compute budget.
Privacy controls need a budget line. The reassuring finding is that accuracy barely moved. The uncomfortable one is that the same control can multiply compute costs by an order of magnitude depending on an agreement nobody in engineering signed. A privacy commitment with no budget and no owner will be dropped the first time a project runs over.
What to watch
Watch for data in use to become its own category in procurement templates, alongside data in transit and data at rest. Once buyers ask for it, vendors will have to describe the protection rather than the transport.
Map one pipeline in your own environment, mark what protects the data at each hop, and note where decryption is unavoidable. That map is short, uncomfortable, and the most useful privacy document most organisations do not have.
Attribution: Analysis based on Help Net Security and related public reporting. This article is original commentary, not a repost of the source material.