Healthcare Information Governance:
Dial-Moving Strategies to Accelerate
IG Adoption

Topics: Health Information Governance

Download PDF

Executive Summary

Healthcare Information Governance: What’s Driving the Need?

The volume of information in the healthcare industry continues to grow exponentially. With Meaningful Use, ICD-10, and Accountable Care all contributing to this data growth, there is a strong need to develop strategies to effectively manage this information throughout its lifecycle. As a healthcare provider, you will be required to manage this information on an enterprise basis, particularly as the landscape shifts to an Accountable Care framework, where anytime, anywhere access to information is required.

To address these challenges, you will need to establish strong Information Governance (IG) practices and policies in order to get control over your rapidly growing and increasingly distributed information. In doing so, you can support the shift to this new, electronic world and enhance your ability to obtain business intelligence and analytic information that will contribute to patient care. This information evolution — from siloed pockets of data, to enterprise-wide IG — will also help to mitigate your risks, reduce your costs, and optimize your revenue.

Taking the Pulse: Establishing a Baseline for Healthcare Information Governance

In 2013, AHIMA published a strategic plan, identifying Information Governance as a strategic imperative for the healthcare industry. To understand how providers were adopting IG practices, AHIMA and Cohasset Associates, with support from Iron Mountain, surveyed over 1,000 health information management practitioners. The results were published in the June, 2014 Information Governance in Healthcare Benchmarking White Paper.

As the first healthcare industry benchmark, the survey profiled a number of facets of information governance. In some areas, the results indicate that providers have mature IG policies and practices. In other areas, however, the results reveal significant room for improvement to enable providers get to a “best-in-class” status.

The Journey to Enterprise-wide IG

Best Practice Strategies to Accelerate IG Adoption

This brief serves as a companion to the 2014 Information Governance benchmarking report, and summarizes the key findings from the survey. Throughout this brief, best practice recommendations are provided to help accelerate your Information Governance journey, no matter where you are along the way. Whether you are just getting started, and need to help sell the concept of IG within your organization; or whether you are well underway and are looking to optimize results, this brief delivers proven tactics that will enable your health system to make progress on key IG initiatives.

By deploying these strategies, you can:

  • Reduce your costs An enterprise-wide, policy-driven approach to managing information will optimize capacity, reduce redundancy and complexity, and decrease costs.
  • Reduce your risks A well-applied IG program will improve security and compliance, and better enable discovery management.
  • Improve your patient care By having consistent policies, you can enable better access to patient information and improve care through more comprehensive, integrated patient records.

Potential Dial Movers: Strategies to Accelerate Your IG Journey

When you consider actions to improve the areas of IG where you may lag behind others in your industry, you should consider the strategies that give you the highest return or “best bang for your buck”; we call these the “dial movers.” Dial movers, when addressed, often positively impact other program metrics. This brief will outline key dial movers for each stage of the IG journey.

Getting Started: Building the Case for Enterprise-Wide IG

Big Takeaway 1

Overall, IG programs are less prevalent and less mature in healthcare organizations than is warranted, given the importance of the information.

The Need

The rapid proliferation of data in healthcare organizations is driving the need for better governance. But with so many competing priorities, health systems have limited ability to adequately resource their needed programs. The importance of establishing a comprehensive information governance framework, for both physical and electronic information, is understood. However, it has yet to make it to the top of the healthcare “to-do” list. Part of the hesitation may be the magnitude of the task itself.

The Reality

65% of organizations recognize the need to formalize Information Governance best practices to align how information is managed across functional areas.


Only 43% have actually initiated a formal IG program and report substantial or some benefits (30%) or no benefits to date (13%).

22% recognize the need, but have not initiated a formal IG program at all.

While the need is recognized, the ability to execute lags behind. This execution gap reveals the reality of the many drivers in healthcare today. Faced with shrinking reimbursements and increased expenses, healthcare organizations have limited ability to adequately resource their needed programs, including Information Governance.

Dial Movers to Build the Case for Enterprise-wide IG: Getting to Best Practice

Sell the Value of IG: For those health systems that have not yet started with an Information Governance initiative, it is important to show how IG supports your organizations’ top goals. Therefore, the value of an organized and uniformly applied IG program must be articulated in order to make forward progress. For some health systems, value centers on potential cost and risk reductions. For others, value is seen as better use of the information to deliver patient care. The value varies not only from organization to organization, but also from function to function

To help communicate the value of IG, look for stakeholders throughout your organization that have found benefit in past information improvement projects. These stakeholders can be champions for driving an IG initiative, as they can point to real-world results. The ability to share and communicate IG value builds the business case that can be used to gain further organizational buy-in.

Caution: While risk and cost reductions have traditionally been at the forefront of the value proposition for establishing enterprise-wide IG, the real value of a well-organized IG program may not easily be measured using a standard ROI model. Some early attempts at creating IG programs were met with mixed results because cost savings were overstated. In some instances, the true benefit to your health system is protecting and better leveraging the information assets it owns to support strategic initiatives such as Meaningful Use and Accountable Care. Ultimately, these initiatives will enable cost savings and risk reduction through enhanced information access.

Secure Senior Leadership Sponsorship: One common and critical requirement in the formation and sustainability of an IG Program is the sponsorship by an executive, preferably someone within or close to the C-Suite. Depending on the size of your organization or the political environment, sponsorship may come from the CEO, COO, CMIO, CFO, or CIO.

Executive sponsors provide direction, budget, and problem resolution. Their endorsement of the program provides accountability and ownership. This senior executive position provides the level of advocacy needed to ensure that the key goals are established, and the appropriate resources are assigned. This leader can also help to engage the right functions on an IG steering committee.

Caution: Surveys in other heavily-regulated industries show that the lack of a clearly-defined executive sponsorship role is one of the top reasons why IG programs are unsuccessful.

Ready to Embark: Establishing Your Strategy

Big Takeaway 2

Most organizations have not yet established a comprehensive strategy for IG.

The Need

To successfully implement enterprise wide IG, it is necessary to develop a sound strategy that addresses data and information management needs across your health system. An effective IG strategy must support the high-priority organizational goals that were identified in your IG business case, including patient care, organizational performance, and risk mitigation. The strategy should also address IG program oversight and progress against initiatives to ensure ongoing success.

The Reality

Just over one-third (35%) of healthcare survey respondents report having a comprehensive strategy to guide information governance.


Only 11% of the survey respondents reported that their cross-functional IG structure was mature, so there is a great opportunity for improvement in this area.

While these results may indicate a lack of maturity, there is significant improvement expected by 91% of the respondents over the next three years.

Dial Movers to Build the Case for Enterprise-wide IG: Getting to Best Practice

Establish a Cross-Functional Governance Structure: Once the need for enterprise-wide IG is established, it is important to understand how to get organized to make it happen. In order to maintain oversight and measure progress against your IG strategy, it’s critical to establish a multi-disciplinary steering committee. This committee provides direction and oversight, sponsorship for resources and funding, and leadership to engender organizational solidarity.

A steering committee is central to governance decision making, and requires broad representation across departments and functions, such as physician and nursing leaders, the CFO, CIO, CMIO, IT, HIM, informatics, legal, finance, compliance, and risk. This steering committee will be the go-to, cross-functional group responsible for goal setting, approving and enforcing policies, and measuring results.

Caution: The steering committee should not be too big, but it also shouldn’t exclude key players who are going to have a very large say in governance decisions. This committee can educate the extended stakeholders on the importance of an overarching IG program and advocate for increased interdisciplinary collaboration.

Establish Foundational IG Practices; Start Small and Communicate Success: Your steering committee will be instrumental in developing your organization’s IG strategy. As part of any strategy, it’s important to develop a framework or model for governance that includes information functions such as: design and capture, access and use, and life cycle management of data. Processes for managing information integrity and quality — as well as privacy, confidentiality, and security — support these functions, and are foundational to the model. Further detail on each of these critical IG components is defined in the white paper, Redefining the Role of HIM in the New World of Information Governance.

Caution: There is a truism that “It’s easier to eat an elephant one bite at a time.” The desire to move on to large-scale IG initiatives and make a splash is tempting. The most successful approach, however, is to start small, establish a foundation for a chosen process or function, then demonstrate victory. The selection of the best place to start should include considerations of risk, willingness by the process owner to change, and ease of implementation.

By starting small and meeting your objectives, you can continue to demonstrate the value of your IG program. This approach also helps to gain broader organizational support for IG and helps garner support for future IG-related projects.

Well Underway: Enhancing IG Policies and Practices

Big Takeaway 3

The Information Governance framework and its foundational components call for strengthening and expansion.

The Need

One of the critical aspects of achieving IG goals is to establish a solid framework for governance, particularly around the policies for Information Lifecycle Management (ILM). IG policies and practices are critical to the success of an enterprise-wide IG strategy, and foundational ILM policies are required to manage the processes for storage, retention, and disposition of medical and business records. These policies should also address special records management issues such as formal hold orders, eDiscovery, and any applicable legal and regulatory requirements.

The Reality

Only 17% of the survey respondents rated their IG policies and practices as mature.

61% of respondents strongly or mostly agree that the processes directing the regular deletion of electronically stored information require improvement.

Almost 50% of onsite paper records and 42% of offsite paper records use manual (non-automated) processes as the primary means by which records are deleted when eligible.


In spite of this lack of maturity, the good news is that 36% of the surveyed organizations indicated that they have improvements underway around their IG policies and practices. However, there is still a ways to go on this leg of the journey to build the infrastructure essential for effective IG.

Dial Movers to Enhance IG Policies: Getting to Best Practice

Establish Sound Retention Policies Across Physical and Electronic Records: Developing an actionable retention policy is essential to support an enterprise-wide ILM strategy, and is the foundation of a credible, consistent, and compliant IG program. For healthcare providers, retention policies should be an area of high maturity. However, the reality of today reveals that health systems have siloed retention policies and practices; particularly with respect to physical and electronic information.

To enhance maturity in the area of retention, policies must by consistently applied across all information types in your health system. These policies must be inclusive of newer information types, including social media, but also newer clinical data types, like digital pathology and genomic data. As part of this process, it’s also important to develop a comprehensive information inventory, to better understand what information may be located in hidden “pockets” that aren’t covered by existing practices.

Engage IT in this process to get a more comprehensive perspective. With electronic content, there isn’t necessarily an easy way to connect a retention rule to data sitting in an application like SharePoint or within a structured database. Look to IT and other members of the cross-functional IG steering committee for guidance and assistance with your enterprise-wide retention policy development.

Caution: The laws providing guidance on retention of electronic records have not yet caught up to the paper-based world. As a best practice, it’s important to update your retention schedule every 12–18 months to include any new retention laws or new information types. Take advantage of records and information storage partners that provide expertise to assist you in accomplishing this goal.

Make Destruction Happen: The inverse of retention is disposition. Even when a retention policy is current, many healthcare providers struggle to enforce policies and implement workflows to destroy eligible information. Without a process to actively and consistently destroy this information, health systems are paying unnecessary storage costs, decreasing the ability to easily find information for patient care, and increasing their litigation risk.

It’s critical to establish policies that define the systematic disposition of records after their retention period expires. These policies should be consistently communicated across your organization to ensure all personnel understand the importance of destruction. Whenever possible, utilize automated or partially-automated methods to delete information eligible for disposition, provided the information is not subject to legal hold.

Caution: As the survey points out, the deletion or destruction of information is essential for consistent and systematic end-of-life processes. For some health systems, it’s more practical to take a phased approach to “cleaning up” legacy information, then tackle the classification and destruction of the remaining content. By implementing enterprise-wide policies for disposition, you can demonstrate adherence to compliance requirements in the event of audit or litigation, while decreasing risk and minimizing the potential for inadvertent disclosure.

Cruising Speed: Continuous Program Improvement

Big Takeaway 4

Information Lifecycle Management Practices and Metrics Require Improvement.

The Need

You can’t improve what you can’t measure. Measurements and metrics are the key to a successful Information Governance strategy. They raise awareness of the current state of the information lifecycle, and the associated controls, risks, and vulnerabilities. Metrics can also help to build a business case and generate support for adding resources and enhancing focus on enterprise-wide IG. With the survey reporting surprisingly low rates of maturity for metrics across the various facets of governance, it will be important for you to put key performance indicators (KPIs) in place to enable the measurement process.

The Reality

Only 10% of the survey respondents indicated that their metrics to guide IG assessment and improvement are mature — impacting the ability to track program success and make adjustments.

Compliance assessments and internal audits are reported as mature by just 16% of the respondents.

Only 15% of organizations have mature policies around employee training for IG topics.

Dial Movers for Continuous Program Improvement: Getting to Best Practice

Establish and Report on Metrics: As metrics are developed, it is important to address how the health system is performing against them. KPIs and key risk indicators are required to establish a baseline that can be continually measured and improved. When considering the best way to measure your IG program, think about introducing measures of performance that examine the consistency of retention and destruction policies and processes. You can then identify areas of non-compliance across all active and inactive hardcopy and electronic records.

Key metrics to measure can also include: alignment of retention schedules with pertinent laws and regulations, destruction activities, business unit compliance, hold administration, and program training status. Metrics should have senior-level visibility and include remediation plans for when your program is not performing up to standards.

Caution: Make sure to audit your practices and results for compliance and for adherence to goals and targets. You should take a holistic approach when auditing your program so you can track program performance for key operational and compliance areas. Use an audit checklist to track the progress of your auditing procedures, enabling you to perform more comprehensive audits.

Institute a Continual Improvement Process: An IG program should be viewed as an ongoing, evolving initiative rather than a one-time event. To this end, make sure you’re continuously improving your program so it remains current. By establishing routine and comprehensive assessments that identify areas of vulnerability and highlight opportunities to refine your IG program components, you can drive continual improvement. In doing so, you can enhance compliance, improve efficiencies, and reduce costs.

Make sure to review the results regularly. Hold steering committee meetings to assess the current state of your IG program and communicate improvements to senior-level stakeholders to get approvals for corrective action. These periodic reviews should be conducted by your IG team at the same time as your other internal audits. Findings should be reviewed with senior management and responded to with a formal remediation process.

Caution: Once your program is implemented, it is also important that you consistently train the stakeholders on any program enhancements. You’ll also need to budget for any costs and resources associated with the ongoing maintenance, enhancement, and enforcement of your program.


Information Governance is a Strategic Imperative

At the heart of Information Governance is a framework of unifying policies for information management. These policies set the ground rules and intent, and reflect best practices. They serve to communicate, educate, and facilitate compliance and enforcement. A proper IG framework ensures that it is clear who is responsible for applying these policies, and what the consequences are for failing to do so.

As the inaugural Healthcare Information Governance Benchmark White Paper revealed, healthcare organizations are still relatively immature in their adoption of enterprise-wide IG. There is, however, no “silver bullet,” or all–inclusive solution that will provide you with instant governance of all of your information. In this age of “doing more with less,” it’s important to focus on the dial-moving initiatives that will optimize your return on effort.

It’s also important to reinforce that Information Governance is not a project with a defined time span, but a journey that requires ongoing focus. Most health systems will continually improve their IG program with input from their steering committee. Through focused planning, implementation, measurement, and reporting, improvements in IG policies and practices can make a real impact.

No matter where you may be on this journey to enterprise-wide Information Governance, there is help available to facilitate your effort. Healthcare organizations across the country have improved their IG maturity by leveraging a partner’s expertise to minimize risk, reduce costs, and streamline information access.

By working with an expert partner, you can accelerate your IG journey and bring significant value to your organization. Most importantly, through this process, you can enable more effective use of your information and improve patient care.