Data Governance
Governance defined
Data governance is the decision rights and accountability framework for data: who can define, change, access, and use it. It is not the same as IT operations or a single security tool. Core components include a charter and sponsoring committee, policies and standards, defined roles - data owners (accountable for a domain), data stewards (day-to-day quality and definitions), and custodians (technical storage and access) - a data quality program, metadata and a business glossary, data lineage, and issue escalation.
Privacy and security obligations
Know the HIPAA basics: the minimum necessary standard, permitted uses, the Privacy Rule versus the Security Rule (administrative, physical, and technical safeguards), and the two de-identification routes - Safe Harbor (removal of the 18 specified identifiers) and expert determination. Understand limited data sets and data use agreements, role-based access, audit logging, retention schedules, and breach notification duties. Consent and authorization requirements differ for treatment, payment, operations, and research.
Quality and lifecycle
Governance covers the data lifecycle: acquisition, storage, use, sharing, archival, and destruction. Data quality dimensions should be monitored against documented thresholds, with issues tracked to resolution by named owners. Metadata makes data findable and interpretable; lineage makes results reproducible.
Traps and rule of thumb
Questions conflate data owner with data steward (accountability versus hands-on stewardship), or treat de-identification as eliminating all re-identification risk - it reduces risk, especially with dates, geography, and rare conditions, but does not remove it. Another trap: assuming a governance committee builds reports; it sets policy and resolves conflicts. Rule of thumb: if a metric has two definitions in two reports, governance has failed at its core job. Certify one definition, publish it in the glossary with an owner, and require changes to go through review.