Harmonizing Privacy Governance After a Three-Hospital Merger
Regional Health - three hospitals, 61 clinics, 4,200 workforce members - completed a merger eighteen months ago and still runs three separate privacy programs. Hospital A's paper authorization form was last revised in 2016 and omits the expiration-date and revocation statements; Hospital B lets unit managers approve EHR access for their own staff; Hospital C's privacy officer reports to the CIO and has never briefed the board. There is no enterprise privacy charter, no single policy library, and no consistent sanction process. After two reportable incidents last quarter, the board's audit committee has asked for a quarterly privacy dashboard. The new CFO has frozen privacy headcount at 1.0 FTE plus a 0.5 FTE analyst who splits time with security. The CCO wants a realistic 90-day plan, not a wish list.
1. Recommend a governance structure and the first three privacy office actions for the next 90 days. Justify the sequencing.
Read the worked answer
What is missing is authority, not activity. Three programs exist because no instrument says who decides. Sequence accordingly.
- Charter and designation (weeks 1–3). A CEO-signed enterprise privacy charter naming one privacy officer with delegated authority across all three hospitals, a solid line to the CCO, and a dotted line to the audit committee. Without this, every later step is a negotiation between peers.
- One policy set, adopted at the most restrictive existing standard (weeks 3–8). Do not average the three programs. Take the stronger version of each control - Hospital B's electronic consent workflow with Hospital A's content elements, corrected to include expiration and revocation - and publish an interim policy so the workforce has one answer during harmonization.
- Access governance and enforcement evidence (weeks 6–12). Replace unit-manager approval with role-based access templates, adopt a sanction ladder, and stand up one enterprise incident log.
Rationale: the charter creates authority, the standard creates a single benchmark, and enforcement creates the credibility the board dashboard will later measure.
2. Design a board dashboard of no more than six measures. Identify two measures you deliberately excluded and defend the exclusions.
Read the worked answer
Six measures, each tied to a decision the audit committee can actually make:
- Percent of workforce completing role-based privacy training within 30 days of hire or role change.
- Percent of access requests completed within the regulatory deadline, plus median days to completion.
- Incidents per 1,000 workforce members, with median days from occurrence to containment.
- Percent of required business associate agreements executed and current on file.
- Percent of audit findings closed by the agreed remediation date.
- Percent of high-risk EHR roles recertified on schedule.
Deliberately excluded:
- Raw complaint counts. Volume-based complaint metrics reward under-reporting and penalize the units that trust the privacy office enough to call it. If the committee wants a culture signal, pair an anonymous reporting-channel utilization rate with a 'would report again' survey item.
- Sanction counts. They measure punitiveness, not deterrence, and they will chill self-disclosure - the opposite of what produced last quarter's incidents.
3. Hospital B's surgical director refuses to give up manager approval of EHR access, arguing it is faster for his staff. How do you resolve this?
Read the worked answer
Reframe the disagreement from speed to accountability. Manager approval makes unit managers de facto access administrators: untrained, unaudited, and with no documented basis for the grant. That is precisely the model that produced the incidents the board is now asking about, and it is indefensible if a regulator or plaintiff asks who approved access and why.
Practical path:
- Build a role-based template for surgical staff that auto-provisions what most requests actually ask for, so the common case becomes faster than the manager route.
- Keep an exception path with a 24-hour service level and privacy office approval for unusual access (e.g., cross-coverage, VIP charts).
- Ask the director to name the specific requests that would be slowed, then test the template against them. Concessions on real cases buy more than argument.
- If he still refuses, escalate in writing to the CMO and CCO with a one-page risk statement. The basis is the charter's delegated authority, not personal persuasion.
- Document the outcome either way. An accepted risk must be explicitly accepted, with a named owner and a review date.