Maize Analytics @maizeanalytics - Tumblr Blog

The National Institute of Standards and Technology Privacy Framework

The National Institute of Standards and Technology (NIST) has released a request for information for the NIST Privacy Framework: An Enterprise Risk Management Tool (”Privacy Framework”).1 The purpose of the privacy framework is to improve management of privacy risk, which is a major gap across healthcare organizations today.

A good privacy risk framework should “factor the extent to which the system and processes are vulnerable to problematic data actions as well as the likelihood of a problematic data action,”2 and adverse events. Moreover, the framework should take into account that organizations work with limited resources. Due to the resource limitation, “an important function of a risk assessment is to prioritize risk to enable determination about the appropriate response. Risk can be managed, but it cannot be eliminated.”3

The NIST recognizes that a good cybersecurity program can help protect ePHI and manage some privacy risks; however, privacy risk also emerges from the ways an organization collects, stores, shares and uses ePHI.4 The Privacy Framework is intended to “provide a prioritized, flexible, risk-based, outcome-based, and cost-effective approach that can be compatible with existing legal and regulatory regimes in order to be the most useful to organizations and enable widespread adoption.”5

The NIST lists the following as the minimum attributes required for the Privacy Framework to be effective:

Consensus-driven and developed and updated through an open, transparent process.

Common and accessible language.

Adaptable to many different organizations, technologies, lifecycle phases, sectors, and uses.

Risk-based, outcome-based, voluntary, and non-prescriptive.

Readily usable as part of any enterprise’s broader risk management strategy and process.

Compatible with or may be paired with other privacy approaches.

A living document.

The request for information contains 26 specific requests grouped into the following 3 categories:

Organizational Considerations: What are the greatest challenges in improving the organization’s privacy protections, how the organization assesses privacy risks, what an outcome-based approach would look like, and should the Privacy Framework mandate the use of specific standards, methodologies, tools, guidelines, or principles.7

Structuring the Privacy Framework: Whether aspects of the NIST Cybersecurity Framework could be a model for the Privacy Framework and what organizational structure is preferred for the Framework such as lifecycle, FIPPs, or the NIST privacy engineering objectives.8

Specific Privacy Practices: De-identification; enabling users to have a reliable understanding of how information is being collected, stored, used, and shared; enabling user preferences; setting default privacy configurations; use of cryptographic technology to achieve privacy outcomes; data management, including: tracking permissions, metadata, machine readability, data correction and deletion; and usable design or requirements.9

At Maize, we believe these types of frameworks are extremely important. The request for information regarding the Privacy Framework strongly suggests NIST intends to develop a framework focusing on a risk-based approach that can be widely adopted by organizations regardless of their business objectives or industry.

If you want to get involved: comments regarding the Privacy Framework must be received by December 31, 2018. Written comments may be submitted by mail to:

Kate MacFarland National Institue of Standards and Technology 100 Bureau Drive, Stop 200 Gaithersburg, MD 20899

Electronic submissions may be sent to, [email protected], and may be in any of the following formats: HTML, ASCII, Word, RTF, or PDF. The request for information can be found here.

Sources:

1 U.S. Dept. of Commerce, Nat. Inst. of Std. & Tech., Developing a Privacy Framework, 83 F.R. 56824, (Nov. 14, 2018), https://www.federalregister.gov/documents/2018/11/14/2018-24714/developing-a-privacy-framework [hereinafter, NIST, Privacy Framework].

2 U.S. Dept. of Commerce, Nat. Inst. of Std. & Tech., NISTR 8062: An Introduction to Privacy Engineering and Risk Management in Federal Systems 21-22 (Jan. 2017), https://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf [hereinafter NIST, NISTR 8062]

3 NIST, NISTR 8062 at 22

4 NIST, Privacy Framework at 56824

5 NIST, Privacy Framework at 56824

6 NIST, Privacy Framework at 56825

7 NIST, Privacy Framework at 56826

8 NIST, Privacy Framework at 56826

9 NIST, Privacy Framework at 56826

Creating a Culture of Compliance in Healthcare Organizations through Collaboration

Privacy officials are responsible for adjudicating potential privacy violations in healthcare organizations. In the news of late, we have heard of cases of unauthorized access to patient data. Although what is considered unauthorized access can take many forms, some examples include snooping on a family member’s medical record or looking at another employee’s chart. Traditionally, healthcare organizations have relied on manual processes to determine if a suspicious or questionable access is a violation. These manual processes require a privacy official to examine long lists of access events and interview employees in order to make a final determination regarding authorization.

Over the last couple years, The University of Kansas Health System (”UKHS”) has leveraged Maize Analytics’ machine learning auditing system to help automate the manual processes surrounding access and authorization in its process to ensure its compliance efforts and to best protect patient data. The auditing system allows privacy officials to focus on high-risk behavior, while reducing false positive alerts. The system learns to recognize when access is necessary based on clinical context (e.g., an appointment, medication order, etc.) in order to identify and rank suspicious record entries which may be lacking a clinical or operational justification and flags these particular record entries for review.

Once a potential unauthorized record entry has been identified, the privacy team investigates the access. Instead of completing the review in isolation, the privacy official uses Maize’s collaborative reviewer system to help streamline the process. For each suspicious access, the privacy official assigns the user’s manager (or other relevant personnel) to the investigation. The manager then provides input on the employee’s involvement with the patient’s care (e.g., was the employee floating on a floor to provide clinical support). To date, over 150 managers have participated as a reviewer of an investigation, allowing the privacy office to more efficiently work through cases and attain relevant information more quickly than before.

The deployment of the auditing system and the collaborative privacy process is helping UKHS to ensure its culture of compliance. UKHS employees, like most healthcare institution employees, are continuously trained and educated regarding HIPAA compliance and UKHS’s policies and procedures related to HIPAA. A part of UKHS’s thorough compliance training includes making employees aware that their accesses are being monitored, which UKHS believes is helping to deter non-compliant behavior. Since the system has been deployed, UKHS has been more efficient in monitoring and investigating possible unauthorized medical record access and has been able to achieve and confirm its goals related to HIPAA compliance. Moreover, because privacy responsibilities are now shared visibly across the organization, privacy processes are increasingly becoming a visible component of day-to-day operations in addition to scheduled mandatory and annual compliance training.

Ensuring the privacy of patient data is one of UKHS’s paramount responsibilities. In collaboration with Maize Analytics, the University of Kansas Health System is working to deploy effective tools and successful processes to protect the privacy of patients entrusted to its care.

Managing Healthcare Insider Security Threats

Often when discussing hospital security threats, external breaches are the main focus. However, recent evidence shows those breaches are not the biggest concern to hospitals - they’re more concerned with breaches that can happen within their own halls, by their own staff.

HIMSS Media recently conducted a study on behalf of SailPoint, and the general consensus was that healthcare provider organizations are highly concerned about threats posed by insiders. 43% of healthcare provider respondents said they were more concerned about insider threats to data than external breaches. Given this concern, it would be assumed that these organizations have the technology in place to help them audit internal accesses; but this is currently not the case. Instead, the top tactics to thwart insider threats are training and awareness programs for users. While these are both important, training can only do so much, and it cannot be the complete process for preventing and detecting internal threats.

The best way to combat insider threats is by combining a training and awareness program with technology. With machine learning, user-based analytics, and artificial intelligence programs that monitor ePHI access, hospitals can catch inappropriate access to patient data. Although these programs have recently been on the rise in the healthcare industry, only 48% of healthcare provider organizations use access behavior monitoring and analytics as part of their approach to detecting insider threats. Many compliance officers are still using manual solutions for their internal auditing, which is time-consuming and cannot scale with millions of accesses per day.

There’s always a level of uncertainty when adding a tool to an auditing process. Users wonder if it will actually help, or if it will add more work to their day, making their job more difficult. When exploring potential tools, users should search for a system that is easy to use, ensures smooth integration into their current process, and will allow them to review and approve auditing policies so they can explain what the machine algorithm is doing and define their policy to regulators if needed.

It’s clear that insider threats are a high-priority concern, yet healthcare provider organizations are only beginning to leverage the powerful technology available to monitor these accesses. A proper training and awareness program combined with an auditing system that can detect and report on unauthorized access is vital to all of these organizations.

Get the full report here: http://pages.himss.org/u9V0004LlG0R4g03wK5ZW80

#privacy auditing machinelearning

Risks of ‘Black Box’ Machine Learning in Compliance And Privacy Programs

Recent machine learning advances have the potential to revolutionize patient care through better clinical risk prediction and precision medicine. Rightfully so, the compliance and privacy communities are adapting these machine learning methods to help protect patient data. While these technologies will likely help detect and prevent future breaches [1], careful consideration must be taken to understand the risks of these machine learning methods when applied to compliance and privacy programs.

Healthcare providers access electronic medical records systems millions of times per day, which are recorded in audit logs. Manual processes to review these audit logs for inappropriate behavior do not scale. Machine learning algorithms have the potential to automate the detection of snooping, identify theft and other threats by learning characteristics of good, bad and anomalous access patterns. However, many types of modern machine learning models are uninterpretable to humans. As a result, the ‘black box’ machine learning models make it so that compliance and privacy officers do not know which ‘privacy policies’ the system is applying, nor if they are correct.

The interpretability of machine learning models is an active area of research. While some types of machine learning problems can be sufficiently addressed with predictions without explanations describing why the prediction is made, this paradigm is risky for compliance and privacy problems. An informal adage from the HHS Office for Civil Rights (OCR) is: “What is your policy and can you demonstrate you are following your policy to regulators?” If you cannot state what the machine learning algorithm is doing, how can you define what your policy is or even defend it to regulators?

The lack of interpretability also raises concerns about incorrectly learned privacy policies. Consider a training data set in which most accesses to hypertension patients are appropriate. Would the machine learning algorithm learn a policy that states that “all accesses to hypertension patients are appropriate?” Obviously, a diligent compliance officer would not want to deploy such a broad and arbitrary policy. Unfortunately, the compliance officer may have no means to identify or remedy these issues.

Machine learning algorithms for compliance and privacy may be better applied if they keep the compliance and privacy officer “in the loop.” Compliance officer in-the-loop machine algorithms leverage large-scale data analytics to identify trends and patterns in access data, but then recommend the policy (or reason for appropriate or inappropriate access) to the compliance officer [2, 3]. The compliance officer then has the opportunity to accept the policy or reject it. As such, the compliance officer is setting the policy. The auditing system can then apply the learned policy going forward. This supervision allows compliance officers to not only defend their policies if audited by the OCR, but also take advantage of a broad class of available machine learning algorithms today.

Machine learning and artificial intelligence are extremely useful tools to help compliance officers audit at scale. However, when left unchecked, policies can be incorrectly learned, leaving the hospital at risk. Be sure you can explain and defend exactly what and why your tool makes decisions to the OCR.

References:

[1] Fabbri D, Frisse M, Malin B. The Need for Better Data Breach Statistics. JAMA Internal Medicine. 2017.

[2] Fabbri D, LeFevre K. Explaining accesses to electronic medical records using diagnosis information. Journal of the American Medical Informatics Association. 2013.

[3] Fabbri D and LeFevre K. Explanation-based auditing. Proc. VLDB. 2012

#privacy #machine learning #ai #hipaa

Often Forgotten Risk to Patient Data

Academic medical centers and health systems with large research groups present unique challenges for EMR access monitoring programs, according to a recent talk by Dr. Daniel Fabbri, Founder and CEO of Maize Analytics. Dr. Fabbri, also an Assistant Professor of Bioinformatics and Computer Sciences at Vanderbilt University, spoke on balancing the need to provide electronic medical record (EMR) access to researchers, while also ensuring patient privacy. The talk was part of the Health Care Compliance Association’s recent Research Compliance Conference held in Austin, Texas.

In his presentation, “Strategies to Effectively Monitor Researchers’ Access to the EMR,” Dr. Fabbri dove into the risk posed by researchers with access to electronic health records, and what makes monitoring researchers’ accesses so difficult. Approaches used to monitor clinician accesses are not directly transferable to detect researcher misuse, he says.

“Over the past several years we’ve seen the threat of breaches from insiders growing,” says Dr. Fabbri. “Researchers are a special class of insider whose work can involve seemingly erratic access patterns, making them difficult to monitor. As a result, standard methods, like rules-based auditing and anomaly detection, are not sufficient for monitoring researchers, creating a significant risk to patient data,”.

The talk spurred a discussion about procedures, processes and tools covered entities can employ to ensure researchers’ EMR accesses comply with HIPAA and institutional policies. According to Dr. Fabbri, this starts with researchers’ applications to the Institutional Review Board (IRB).

“Including structured diagnosis and procedure codes in the IRB application provides a guide for compliance officers to understand what constitutes appropriate access for each researcher,” he says.

Covered entities can integrate IRB submission data within their access monitoring tools to more effectively detect inappropriate behavior, continues Dr. Fabbri. “These research-aware monitoring tools can identify when a project goes beyond the listed research scope and alert the compliance department.”

The presentation—attended by researchers, compliance teams, and HIPAA officers alike—concluded with Dr. Fabbri providing monitoring recommendations and guidance so that healthcare organizations can monitor the various types of access to patient data.

#privacy #cybersecurity #hipaa #hccaresearch

Passwords Aren’t Protecting EMR Data

Many healthcare systems rely on user IDs and passwords to control access to electronic medical records (EMR). These safeguards can help protect sensitive patient data.

Unfortunately, many healthcare workers share passwords. In one study, 73% of healthcare workers reported obtaining another staff member’s login credentials. Respondents estimated that this security breach occurred 4-5 times. Most commonly, credential sharing occurred among junior staff members. Every resident who participated in the study had obtained login credentials from another staff member, while just over half of nurses reported the same.

The study found password sharing occurred most commonly when staff needed authorization for their day-to-day tasks. Many reported their login credentials did not provide adequate user privileges to fulfill their duties. They also reported delays during new employee onboarding led to password sharing. Other studies corroborate the findings, adding that employees often leave applications open or work together on one computer, which can lead to security breaches.

Health and Human Services suggests institutions craft strict password policies and complexity requirements. Institutions can also set user privileges that align with clinical workflow. Such technical approaches are essential for any modern compliance program. User education can also help address social and cultural factors that lead to password sharing. Compliance programs should include password policies, but the data suggest these are only one element of protecting EMRs.

#hipaa #privacy cybersecurity

Three Essential Elements of the Compliance Toolkit

Compliance officers regularly navigate one of the most complex systems in our country—health care. To protect patient privacy, they are charged with creating (and enforcing!) policies that align with changing regulations, while juggling practical limitations at their own facility.

There are many resources available to help compliance teams develop effective programs. The Office of Inspector General provides online education, and private companies offer products that address everything from technical needs to emotional stressors associated with the job.

Our team recently attended the Health Care Compliance Association’s regional conference in Dallas, Texas, where we had the opportunity to listen and learn from compliance experts about other ways to support compliance teams. We heard from Bret Bissey, MBA, FACHE, CHC, CMPE, and Healthcare Compliance Executive with over 30 years experience. He spoke on “What Every Compliance Officer Needs in Their Toolkit.” Three themes emerged:

1) Support. Compliance teams deserve access to the board (or hospital executives), an appropriate budget, and a respectable level of authority. Without these elements, it is hard for compliance teams to implement changes that steer staff toward a culture of compliance.

2) Independence. By acting independently from clinical operations, compliance officers can remain objective. What if a senior-level physician, or board member, violates a policy? Compliance officers must be empowered to make proper decisions without fear of retaliation. Independence allows this—but it must be clear who, or what policy, validates this independence.

3) Metrics. Certifications, analytics, audits, and documentation are essential elements of any compliance program. Quantitative data are not only important to measure success, but they can also help “sell” compliance programs to staff. Data can support compliance teams in showing why policies are needed.

As compliance teams work to oversee all aspects of healthcare operations, it’s easy to see why so many products have emerged to support their day-to-day activities. Compliance teams can choose resources and tools that integrate with their workflow. Tools designed to help teams attain organizational goals—that also keep compliance officers feeling supported and motivated—are most likely to lead to success.

#HCCA #hipaa #maizeanalytics #healthcare #privacy

The Journey to Automated Privacy Auditing

At OHIMA, Maize Analytics and Nationwide Children's Hospital presented "The Journey to Automated Privacy Auditing", email [email protected] for a copy of the presentation. #HIPAA #HIPAASummit #privacy #OHIMA

Thoughtfully Connecting EMRs

One of the largest EMR vendors in the country is expanding its services. Epic Systems recently launched “One Virtual System Worldwide,” an initiative to help connect EMRs across institutions. The multifaceted platform helps customers go beyond simply viewing patient data at other institutions and allows them to take action. Customers can message outside care teams, book appointments across the country, and view merged patient data from multiple EMRs—even those from rival vendors.

Interoperability can improve patient outcomes, but also raises data potential data security concerns. Epic customers currently exchange over 2.3 million patient records daily. With their new initiative, data exchanges will rise across institutions with varying security protocols. It is important that as an industry we move forward with interoperability, but do so with security and privacy controls always in mind. Any sacrifices in data security or patient data privacy may erode patient trust in their providers, negatively affecting utilization of the healthcare system.

Reference: http://www.healthcareitnews.com/news/epic-introduces-new-one-virtual-system-worldwide-interoperability-initiative

#EMR #HIPAA #HCCA

Beyond User Behavior Analytics.

What is beyond user behavior analytics?

Explanation-Based Auditing: A system that learns why each access event occurs. If no reason is found, it is suspicious and prioritized for review.

Learn how healthcare systems are automatically filtering over 99% of the access log.

https://www.maizeanalytics.com/maize-approach/

SIEM to PIEM: Privacy Information and Event Management Systems

Some in the #privacy community have looked to their #security counterparts to adapt #SIEM tools to the challenges of protecting #patient #data. However, there are stark differences between network monitoring and #EMR access auditing. Privacy Information and Event Management (#PIEM) systems are an emerging class of privacy monitoring system geared for medical record protection.

SiemToPiem.com

#HIPAA

HIMSS Media on the value of clinical context in privacy monitoring solutions

Check out the article: http://www.healthcareitnews.com/news/cybersecurity-context-matters-when-protecting-patient-data-expert-says

#HIPAA #privacy

Is accuracy a fair metric to evaluate EMR auditing systems?

There has been a lot of talk about new EMR access monitoring systems. These systems leverage various types of machine learning and artificial intelligence algorithms to identify and rank suspicious behavior. However, parsing their claims is often difficult for two primary reasons: (i) there is no shared data set to evaluate these methods, and (ii) claims are made using different evaluation metrics.

Putting aside the issue of a shared data set for now, lets consider some of the different metrics used today (e.g., false positive rates, false negative rates, true positive rates, true negative rates, recall, precision, and accuracy, among others), and if they tell the entire story about a system’s quality.

To do that, lets consider the following example and an auditing system that uses a Boolean model in which the system marks each access as suspicious or not (i.e., not a probabilistic model).

The system audits 100 accesses in a day.

The system marks 10 as suspicious.

Of the 10 suspicious, 5 are actually inappropriate and 5 are actually appropriate.

Of the 90 not marked as suspicious, 7 are actually inappropriate (and not detected)

Given this example, the system would have the following metric values:

True Positives: 5

True Negatives: 83

False Positives: 5

False Negatives: 7

Accuracy is defined as the total number accesses correctly classified as appropriate and inappropriate: (83 true positives + 5 true negatives)/ 100 = 88%

Recall is defined as the number of inappropriate accesses detected over all inappropriate accesses that occurred: 5/(5 + 7) = 42%

Precision is defined as the number of inappropriate accesses detected over all accesses the system thought are suspicious: 5/10 = 50%.

So how did the system do? Lets compare it to a simple auditing system that never thinks any access is suspicious. It would have the following metric values:

True Positives: 0

True Negatives: 88

False Positives: 0

False Negatives: 12

Accuracy: (88 + 0)/100 = 88%

Recall: 0/12 = 0%

Precision: 0 / 0 or undefined

As this example shows, the simple auditing system has the same accuracy as the more advanced auditing system - even though it did not find any inappropriate activity. This result occurs because the prior distributions of the appropriate and inappropriate classes are not equal; there are many more appropriate accesses than inappropriate. This distribution skew can make simple (and bad) auditing systems look good. In the real world, the distributions are likely skewed even more (i.e. 99% to 1%), compounding this problem.

If accuracy is not a fair metric, what metrics should you consider? The combination of precision and recall, known as an F-1 score, is one good alternative. F-1 scores that are closer to a value of 1 mean the system is able to find most inappropriate behavior with good precision. In our example, the first auditing system has a better F-1 score than the simple system.

In the next post, we will discuss how to evaluate systems that use a probabilistic model to identify suspicious behavior (i.e., an access can be 70% suspicious and 30% not), and how the area under the receiver-operating characteristic (or AUC ROC) is a better metric and is robust to data skew.

Steps for Effectively Monitoring Researchers’ EMR Accesses

Clinical researchers require access to electronic medical records (EMR) for chart review. However, ensuring that researchers do not overstep and access data not associated with a research study is challenging.

See the steps at: http://complianceandethics.org/steps-effectively-monitoring-researchers-emr-accesses/

EMR Access Monitoring: Can users circumvent detection by clicking more?

Monitoring and auditing ePHI have long been associated with tedious manual workflows. Privacy monitoring platforms can reduce the time an auditor spends combing through data while increasing their efficacy in catching suspicious accesses. While software platforms are not new to ePHI monitoring, those using statistical anomaly approaches are becoming more popular. These methods attempt to characterize typical vs. atypical user access patterns by looking at the access log in isolation. While statistical and workflow analyses can be a useful tool for privacy monitoring, hospital privacy and compliance officers must also be aware of their limitations.

A popular method for ePHI statistical anomaly detection first baselines a user’s access patterns (number of accesses, timing of accesses and duration of accesses), and then alerts the privacy officer if the user deviates from normal use. While such an approach can catch large scale data scrapping, they are not well suited for small-scale violation. Similarly, due to the dynamic nature of patient care, the timing of accesses can vary greatly depending on an employee’s shift or on-call service, thus introducing false positives.

More advanced statistical anomaly detection methods will consider the order of accesses and the types of accesses (i.e., accesses the lab system or patient’s medication history). These systems are based on the hypothesis that employees that access records in a typical order are appropriate, while one-off accesses in irregular orders are suspicious. For some situations, this hypothesis may hold true, but the dynamic nature of patient care can cause false positives. Even worse, these systems are susceptible to simple attacks in which the malicious user clicks more in the medical record system to circumvent detection. If the hospital employee readily knows a normal workflow (e.g., for a patient appointment), the user can easily get to the desired data while mimicking the normal access process, and avoid detection.

A robust monitoring system protects against adversarial attacks, even if the user clicks more records or accesses specific parts of a chart to appear normal. A general principle to consider when evaluating monitoring systems is: “Can the metric used to determine suspiciousness be manipulated by the user easily?” If yes, the system is susceptible to adversarial attacks. One way to build more robust systems is to incorporate clinical context into the detection system. Clinical Notes, encounter history and diagnosis information can be used in conjunction with the access log to better model normal behavior, and detect outliers. Without combining clinical evidence with access data, hospitals may be unable to detect a wide-range of attaches.

#HIPAA #HIPAAMonitoring

Empowering Compliance Officers With Technology

Big Data and Artificial Intelligence technology are improving medical data privacy and security every day. New technologies promise increased efficiency, improved accuracy, and better risk management. But to fully realize the potential of these technologies and maximize outcomes, we need tools that also empower the compliance officer to succeed.

See the rest of the article at: http://complianceandethics.org/empowering-compliance-officers-technology/

Leveraging Deep Mind's Block Chain EMR Access Log

Machine learning (ML) offers incredible promise in the diagnosis and treatment of advanced medicine. Whether it is IBM’s Watson or Google’s DeepMind Health, it seems like many of the world's biggest technology companies are getting involved in innovative approaches to improving patient care. One area gaining more ML healthcare interest is data privacy and security. For example, DeepMind has started to take important steps to enhance the security of clinical data by creating tamperproof logs of access using block chains.

At Maize Analytics, we think that machine learning has a roll to play, not only to improve patient’s health, but also to improve data privacy and security. Just as ML systems can help doctors and nurses better evaluate and treat patients, Maize’s technology can empower compliance officers to better protect the privacy of patients.

Maize’s technology takes the symptoms provided by access logs - the “who,” “what,” “where,” and “when” of a record’s access – and uses novel ML techniques to determine the diagnosis of “why” the access took place. Our peer-reviewed and published work has shown that Maize can filter 95-99% of all accesses, allowing privacy officers to focus on the real threats.

We know that the work of a compliance officer can be just as stressful and high stakes as that of a doctor or nurse and that’s why we are committed to putting the same high-powered machine learning technology to work to improve outcomes.

Read more about the technology here: https://goo.gl/ZthpMi

Trending Blogs

Recently Viewed Blogs

Maize Analytics