Information Technology and Data Governance
This domain tests how organizations govern data, protect access, exchange information, and keep operations running during technology failure. Items often present conflicting dashboards or a privacy lapse and ask for the governance fix rather than a software purchase.
Core rules and concepts
- Data governance assigns accountability: data owners approve definitions and access; data stewards maintain quality and metadata. IT operates systems but does not alone own clinical or business data definitions.
- Data quality dimensions include accuracy, completeness, timeliness, consistency, and validity. A data dictionary and standardized measure specifications prevent conflicting reports.
- Interoperability uses standards such as HL7 and FHIR for exchange. Access should follow role-based least privilege, with audit trails and periodic access review.
- The HIPAA Security Rule requires administrative, physical, and technical safeguards. Downtime and business-continuity plans must be tested, including read-only access and paper fallback.
Worked example
Two dashboards report different 30-day readmission rates. One counts all-cause readmissions to any hospital; the other counts same-hospital readmissions only. The governance council confirms the approved definition, updates the data dictionary, documents the measure specification, and retires the non-approved dashboard. Reasoning: the discrepancy is a definition and stewardship failure, not a database performance problem; reconciling definitions restores trust before any technical rebuild.
Traps that cost marks
Assuming IT owns data governance; sharing PHI broadly because the user has an EHR login; skipping audit-log review; testing downtime procedures only once; treating more data as automatically better; adopting a dashboard without an approved measure definition.