Information Governance in Healthcare
Domain 2 tests how PHI is governed across its lifecycle - who decides, who provides day-to-day oversight, how long records are kept, and how disposal is proven.
Governance versus management
Governance sets decision rights, policy, and accountability; management executes. A common role split: the data owner (a clinical or business executive) is accountable for a data domain; the data steward owns definitions and quality day to day; the custodian (IT) operates the systems. Governance bodies approve classification, retention, and access standards.
Classification and lifecycle
The lifecycle runs capture → use → share → archive → dispose, with metadata and provenance recorded so you can prove where a record came from and who changed it. Classify by sensitivity: PHI, limited data set, de-identified, plus special categories (behavioral health, HIV, genetic, minors).
Retention
There is no single national medical record retention period - HIPAA requires covered entities to keep compliance documentation for six years, while clinical record retention is set by state law and payer contracts (commonly 7–10 years, longer for minors). Legal hold suspends destruction immediately. Disposal must be defensible: NIST SP 800-88 media sanitization, shredding, crypto-erase, and a certificate of destruction.
Worked example
A hospital decommissions a legacy EHR. Correct reasoning: inventory record types and map each to its state retention rule; check for litigation holds and open audits; confirm interfaces and migrate active records; validate completeness against the master patient index; then sanitize media per SP 800-88 and file certificates. The record's retention obligation follows the record, not the system being retired.
Traps
- Quoting one retention period for all records.
- Destroying data under legal hold.
- Calling IT the data owner.
- Retaining everything indefinitely, which enlarges breach exposure.