Information Technology and Data Management
Core concepts
IT and data management support safe, efficient care and sound decisions. Know the EHR/EMR distinction (EMR is a single-organization record; EHR is shared across organizations) and the role of interoperability standards.
Data governance covers ownership, stewardship, quality, access, and retention. Understand the data quality dimensions: accuracy, completeness, timeliness, consistency, validity, uniqueness. Know the data life cycle: capture → store → use → share → archive → dispose.
Security concepts: confidentiality, integrity, availability (the CIA triad); authentication vs authorization; least privilege; encryption at rest and in transit; audit logs; backup and recovery; and business continuity/disaster recovery planning. Recognize threats: phishing, ransomware, insider misuse, and lost devices.
Analytics: distinguish descriptive (what happened), diagnostic (why), predictive (what will happen), and prescriptive (what to do). Dashboards should have defined owners and refresh cadence.
Traps
- Confusing authentication (who you are) with authorization (what you may do).
- Assuming backups alone equal disaster recovery - recovery requires tested restoration and time objectives.
- Treating audit logs as optional - they are the evidence trail for access and integrity.
- Confusing predictive with prescriptive analytics.
Rule of thumb
Apply least privilege: grant the minimum access needed for the role, review periodically, and log all access to sensitive data.
Worked example
A clinician needs records for a new role. Grant role-based access matching the job, require authentication, enable audit logging, and schedule an access review. Do not grant broad access "just in case."