Policy Paper

Information_Governance_for_Healthcare_Professional..._----_6_Getting_Started_Where_to_Launch_an_IG_Program.pdf

Home >Business & Finance homework help >Management homework help >Policy Paper

Chapter 6

Getting Started: Where to Launch an iG Program

7 Key iG Accelerators to Launch an iG Program

One of biggest problems with kicking off new IG programs is that, on average, they take a year or more to form, according to industry research. Beyond that, many IG programs lose steam

and fail to meet the organization’s objectives. This can occur for a variety of reasons, adhering to the Anna Karenina principle, which derives from the opening to Tolstoy’s book:

“Happy families are all alike; every unhappy family is unhappy in its own way.”

That is to say, every IG program failure is unique and due to a varying mix of shortcomings. One IG industry leader confided, “I have designed perfect IG programs and nothing hap-

pened.” In this case, there likely were significant weaknesses in the approach, including lack of strong executive sponsorship and developing a clear business case.

Other failed IG programs may not have had the right combination of players named to the IG steering committee, or it was overstaffed and not tiered so it got bogged down. Others may not have properly planned roles and a clear Responsibility Assignment Matrix, or RACI matrix (which identifies those Responsible, Accountable, Consulted, and Informed) early on, which doomed the program to failure. Still others may have lost focus on the organizational change management and communications aspects that are required to keep an IG program on track.

Responsible IG Lead

Consulted Key Stakeholders

and SMEs

Informed Board of Directors,

Broader Stakeholder Group

Accountable Executive Sponsor

Information Governance for Healthcare Professionals Getting Started: Where to Launch an IG Program

F., Smallwood, Robert. Information Governance for Healthcare Professionals : A Practical Approach, Productivity Press, 2018. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/franklin-ebooks/detail.action?docID=5515223. Created from franklin-ebooks on 2022-09-01 01:33:14.

C op

yr ig

ht ©

2 01

8. P

ro du

ct iv

ity P

re ss

. A ll

rig ht

s re

se rv

ed .

52 ◾ Information Governance for Healthcare Professionals

But there have been some lessons learned from these failures, and the approaches to creating and maintaining successful IG programs are starting to coalesce.

Here are seven key accelerators which can help launch or expand a successful IG program:

1. Recruit a strong executive sponsor. As noted in previous sections of this book, recruit- ing a strong executive sponsor is paramount. If there are multiple executive sponsors on board then nominate the most senior one (and consider making one or more of the others deputy sponsors). If that is not logical, select the executive with the most engagement and commitment, and the most to lose or gain. When evaluating executive sponsors, find that manager who has the highest information risk levels, the one who has the most to lose from a data breach, from non-compliance fines, or from soaring legal costs. Or that has a depart- ment full of knowledge workers who cannot find the information they need on a timely basis, consistently. Or even a department with rapidly increasing information storage costs. Think CFO, General Counsel, CIO, COO, Chief Risk Officer, Chief Information Security Officer, Chief Privacy Officer, and similar titles. (Ideally, the CEO or Administrator would be a solid choice due to their seniority.) C-level executives have clear budget and decision authority. These senior executives likely have been considering various piecemeal measures and it is the IG program lead’s job to educate them on the benefits of taking a holistic IG approach and aligning the effort with strategic business objectives.1

2. Find common ground. It is recommended that the IG Lead form alliances to help bolster the IG program effort. There are several groups that can be natural allies, but, of course, the scenario depends on business objectives, office politics, budget availability, and other orga- nizational factors. Data governance is one of the first places to look. Most larger healthcare organizations have some form of a data governance program or at least data quality program that operates on an ongoing basis. Some healthcare organizations have a chief data officer (CDO) dedicated to this function. The goals of a data governance program align with higher level IG program goals, especially the noble pursuit of improving patient outcomes and saving lives. There are a plethora of benefits that flow from a rigid data governance program related to improving patient outcomes, such as improving patient trust, satisfaction, and loyalty; reduc- ing litigation rates and costs; improving operational efficiency; and, increasing organizational value. Remember, IG programs must be driven from the top down, but implemented from the bottom up for best results. So an alliance with the CDO or data governance program manager should be a good alliance. Find these types of natural business allies to gain momentum in the IG effort. If the IG program lead comes from the HIM area, their skills can be helpful in working with the CDO to improve the accuracy of clinical data that is generated form lab and diagnostic equipment that is stored in the EHR. The HIM manager can also work with General Counsel to improve litigation readiness, reduce legal e-discovery costs, and reduce attorney document review costs. If the IG program lead comes from IT, they may need to team with the HIM lead and approach business unit leaders who have the biggest informa- tion management problems or the most litigation and help them improve their approach to records and e-document management. If the Business Office is planning to implement real- time e-mail archiving, and the e-mail policy is going to have to be reviewed and revised, this is a good time to dovetail off that project to launch or expand the IG effort.

3. Leverage assessment or audit findings. An internal assessment or audit of procedures and practices may reveal weaknesses that are putting organizational information at risk. One assess- ment tool with strengths in assessing healthcare organizations is AHIMA’s IGHealthRate™, a purpose-built assessment and measurement platform for IG which has the Information

C op

yr ig

ht ©

2 01

8. P

ro du

ct iv

ity P

re ss

. A ll

rig ht

s re

se rv

ed .

Getting Started: Where to Launch an IG Program ◾ 53

Governance Adoption Model™ embedded in it. Another more comprehensive and mature IG assessment tool to use is the Information Governance Process Maturity Model from CGOC.org, which measures maturity on 22 key IG processes.2 If evaluating specific aspects of an IG program, such as cyber-security, the ISO 27001/2 standards can be used as guide- lines. Findings from an internal assessment can provide the mandate for moving forward with an IG program.3

4. Piggyback on existing IT projects, especially those that are approved and funded, or those that are likely to be. For instance, if the organization is planning on migrating installed EHR software to a new vendor, this is a good time to focus on getting good, clean, quality data into that new system, by working closely with the data governance team. If there is a Chief Data Officer and robust data governance program, IG is a natural fit. If, in another instance, the business side of the organization is due for a refresh in enterprise content man- agement (ECM) software, or it is cleaning up shared drives and/or migrating to SharePoint, this would be an ideal time to go a step further and implement a more comprehensive IG program that can work in lockstep with the ECM implementation. If legal hold notification (LHN) has been implemented and now additional efficiencies in the e-discovery process are being pursued, a broader IG approach may be well-timed.4

5. Emphasize hard cost savings. Where can hard dollar savings be found? When looking for a hard dollar benefit, an easy target is data storage and shrinking the storage footprint. Typically, 40% or more of information that healthcare organizations store has no business value. With a current and complete data map and leveraging file analysis tools using file analysis software, it can be graphically demonstrated to executives which information is worthless—redundant, outdated, or trivial (ROT)—and how much storage costs could be cut or at least the rate of growth can be slowed. Then layer on the benefits of improved clini- cal analysis and patient care capabilities, information risk reduction, reputational risk reduc- tion, improved compliance capabilities, improved productivity, and improved efficiency in implementing legal holds and other litigation-related tasks. Other cost impact areas may be reductions in cyber-insurance costs and e-discovery costs due to an ongoing IG program.5

6. Cite the impact of poor IG. In launching an IG program, often citing the “worst case” scenario will help make the case. One approach is to provide some well-known examples of breaches of ePHI or ePII that have heavily damaged companies like Premera BlueCross, Excellus BlueCross BlueShield,6 Anthem Health,7 and 21st Century Oncology. Be sure to delineate the fallout from these breaches to make the case for the IG program. When con- sidering the impact of a ransomware attack, bear in mind that over two-thirds of U.S. con- sumers would consider changing providers if their provider were attacked by ransomware, according to a recent survey.8 Another approach could be to list major HIPAA fines that peer organizations have paid when making the case for moving forward with an IG program.

7. Establishing a legal defense. If executives still are not convinced, then communicate to them that in cases like Excellus and Anthem, where patients or employees have had their personal data compromised, there will be lawsuits. Lots of lawsuits. And if an organization has an IG program in place and has taken reasonable “best effort” steps—basic measures such as information security awareness training—to secure private information including ePII and ePHI, and sensitive information like race or religion, then the foundation for a legal defense is in place. Although culpability may possibly be found, the awards will be smaller which lowers the cost of legal claims.9

These are some of the accelerators that can help get an IG program launched or expanded.

C op

yr ig

ht ©

2 01

8. P

ro du

ct iv

ity P

re ss

. A ll

rig ht

s re

se rv

ed .

http://CGOC.org

54 ◾ Information Governance for Healthcare Professionals

Chapter Summary: Key Points ◾ IG programs fail for a variety of reasons. ◾ Piggyback on existing, funded IT projects such as a move to a new electronic health record

(EHR) system or an existing data governance program to help launch the IG program. ◾ IG programs must be driven from the top down, and implemented from the bottom up. ◾ A strong executive sponsor is crucial. ◾ Find natural internal allies to launch an IG effort—those who have the most to gain from IG. ◾ Findings from an internal audit can provide the mandate for moving forward with an IG

program. ◾ Show hard dollar savings, and then add the benefits of information risk reduction to justify IG. ◾ Cite the “worst case” impact of poor IG (e.g. major breaches, fines) when making the busi-

ness case to move forward. ◾ An IG program in place means management has taken reasonable “best effort” steps to

secure PHI and PII, which can help a future legal defense.

notes 1. Barclay T. Blair, “Information Governance: 10 Things You Can Do To Get Started,” online webinar,

Zylab, July 23, 2014, http://www.zylab.com/ediscovery-resources/recorded-webcasts. 2. “2017 CGOC Information Governance Process Maturity Model,” CGOC, https://www.cgoc.com/

resource/information-governance-process-maturity-model. 3. Craig Callé, “Why Data Needs a Seat at the Corporate Table,” CFO, December 9, 2015, http://ww2.

cfo.com/big-data-tecnology/2015/12/why-data-needs-a-seat-at-the-corporate-table-information- governance.

4. Barclay T. Blair, “Information Governance: 10 Things You Can Do To Get Started,” online webinar, Zylab, July 23, 2014, http://www.zylab.com/ediscovery-resources/recorded-webcasts.

5. Ibid. 6. Jessica Davis, “7 Largest Data Breaches of 2015,” Healthcare IT News, December 11, 2015, http://

www.healthcareitnews.com/news/7-largest-data-breaches-2015. 7. Cameron F. Kerry, “Lessons from the New Threat Environment from Sony, Anthem and ISIS.”

Brookings Institution, March 26, 2015, http://www.brookings.edu/blogs/techtank/posts/2015/03/ 26-anthem-sony-isis-hack-cybersecurity.

8. Rebecca Wynn, CISSP, CRISC, CASP, CCISO, LinkedIn post, May 31, 2017. 9. “The Principles,” ARMA International, 2009, http://w2.arma.org/r2/generally-accepted-br-

recordkeeping-principles.

C op

yr ig

ht ©

2 01

8. P

ro du

ct iv

ity P

re ss

. A ll

rig ht

s re

se rv

ed .