Quietly making noise: An inside look at how VCU Business students safeguard patient data in health research
A student-led project helps build a privacy system for one of Virginia’s public health agencies. It might change how researchers study behavioral health across the state.
By Megan Nash
In Virginia’s public health system, behavioral health data is both an asset and a liability. It holds the potential to improve care for thousands of people. But it’s also deeply personal, and mishandling it could do more harm than good.
This spring, five students from the VCU School of Business—Byron Aguirre-Zelaya (B.S. ’25), Kevin Chavez (B.S. ’25), Adam Funge (B.S. ’25), Jaella Lahat (B.S. ’25) and Aryan Venkangari (B.S. ’25)—teamed up with the Virginia Department of Behavioral Health and Developmental Services (DBHDS) to take on that tension directly. Their challenge: design a prototype that could help the agency share sensitive health data with researchers—without compromising anyone’s privacy.
The solution they developed relies on a concept called differential privacy, which adds randomness, or “noise,” to data in a mathematically controlled way. The more noise you add, the harder it is to trace information back to an individual. Add too much, though, and you lose what made the data useful in the first place.
“We’re making sure that we comply with regulations,” said Jaella Lahat. “We’re making sure that we’re privatizing the data to a point enough that it’s not identifiable.”
The students were enrolled in an independent study with Michael McGarry, D.B.A., professor of information systems at the School of Business. From January to May, they worked in agile sprints, held weekly check-ins with state agency staff and developed their code in a secure Amazon Web Services (AWS) environment. They used synthetic versions of real-world data from the Substance Abuse and Mental Health Services Administration (SAMHSA) to test their approach.
“This was a way of keeping talent in the Richmond area … and being able to provide great opportunities for young adults to launch their careers while really moving the state of Virginia forward from a technology perspective,” said Chief Information Officer Russell Accashian (B.S. ’99) of DBHDS.
Midway through, the project expanded. In addition to building a differential privacy engine, the team also developed a Power BI dashboard, a lightweight user interface and a serverless backend adaptor capable of processing standard health data from formats like HL7 and FHIR. They documented every step so that the agency could pick up where the students left off.
One of the project’s biggest challenges was figuring out how to keep data useful without over-sanitizing it. Finding that middle ground meant building a hybrid system: one part of the architecture used AWS Lambda to inject controlled noise into the data; another enabled secure collaboration through AWS Clean Rooms.
They also built tools that let users adjust privacy settings and preview outputs before running full transformations—giving the agency more flexibility as new use cases emerge.
The technical build was only part of the job. Working with a live agency meant the goals could change at any moment.
“We learned to be adaptable,” said Lahat, noting that creating quick mock-ups and iterating feedback helped the team—and DBHDS—stay on track.
At the end of the semester, the students presented their system to DBHDS leadership. The agency had been involved from the beginning, but this was the first time they saw the full system in action. The team walked through how their solution could help analysts explore trends in treatment, service use and access, all without exposing individual identities.
“This experience gave me a taste of [what it’s like to work in the real world]—showing how we’d meet every week for scrum meetings and having to deliver what we said we would deliver,” said Aguirre-Zelaya. “And if not, then that’s what stops the process.”
The system is designed to comply with federal regulations like HIPAA and 42 CFR Part 2 while still allowing researchers and internal analysts to extract insights. If adopted more broadly, it could help inform policy decisions, guide resource distribution, support statewide research and help identify unmet behavioral health needs.
“Being able to privatize this data allows us to do research for substance use and mental health patients,” said Lahat. “There’s a lot more study that can be done on this data if we’re able to anonymize it … to help people in this state get access to services they need.”
McGarry, who advised the team throughout the semester, said the partnership has helped students apply classroom knowledge in a way that benefits not only their careers, but the Commonwealth.
“The CIO came to us because he knew what our students could do,” said McGarry. “We just had to respond to the opportunity.”
That opportunity is already expanding. DBHDS plans to return in the fall with a new student team, a new problem—this time centered on generative AI—and the same belief in what collaboration can build.
“This was the mission all along—to create this talent pipeline,” Accashian said. “We do have plenty of ideas … and we intend to engage in the fall and spring of next year.”
And for him, the experience offered something else, too.
“What I learned is… there’s still hope,” he said. “There are very smart young adults out there… ready to take the torch and be part of something bigger than themselves.”
Categories News