Data Privacy, Security, and Compliance through Data Governance - Data Governance: Creating Value from Information Assets - page 133

In this scenario, IT/Compliance will ensure that privacy and security
receive institutional support and would champion the policies and proce-
dures around compliance. The CEO/CFO also would hold a high level of
responsibility, followed by the CMO/CMIO/COO; research will have only
an advisory role within this scenario. The final scenario would involve the
responsibility for the medical data, such as that created within an EMR
(electronic medical record). The CMO/CMIO/COO would be the execu-
tive sponsors for this type of data followed by IT/Compliance. The role of
IT/Compliance is elevated due to the strict regulations governing medical
data. Regulations, such as HIPAA and the Health Information Technology
for Economic and Clinical Health (HITECH) Act, require access and
audit controls of the clinical systems. These requirements elevate the role
of IT within scenario 4. The CEO/CFO would have an important con-
sultant role within the clinical data scenario, but primary responsibilities
reside with the CMO/CMIO/COO and IT/Compliance. In this scenario,
research would serve only the advisory role with no responsibilities for
the data. This is not to say that the research representative is not interested
in the data because, most often, clinical organizations with a research role
often create a mirrored data warehouse for research purposes. Therefore,
the research representative's presence on the committee is valuable and
should not be taken lightly.
In the model depicted in Table 6.2, each member of the data compliance
committee at one time or another will be responsible for or sponsoring the

TABLE 6.2
Four-Scenario Model

Scenario 4

Scenario 3 IT/compliance

PI
CMO/COO
CEO/CFO

Scenario 2

Scenario 1

0 0.5 1 1.5 2 2.5 3 3.5 4