A brief introduction to health data governance policy development

This introductory article provides a short overview of some of the key issues when developing a draft health data governance policy.  We will revisit and expand on policy issues as we progress through the health data governance framework. 

Establishing health data governance policies for ethical and responsible data management practices

Many organisations start with collecting and using data and find that as they do so, they have no overarching context or clear set of guidelines on how data governance should be implemented. We suggest creating an interim health data governance policy that collates all organisational knowledge in one area and that can help highlight what areas must be further defined as you continue to build out your framework.

Ideally, this policy is written by a data governance team made up of organisational leaders, program leads, and data owners. Often, this role is delegated to one person to draft and is then signed off by an oversight body. An effective data policy has input from different parts of your organisation, including leadership, finance, IT, program managers, and other data owners. How your data policy is developed will depend on your organisational context and role. 

The policy should be used by the executive team, managers, and everyone in your organisation who collects or uses data. Policies should then inform the processes that are created. Sometimes, a policy includes both the overarching policy context and guidelines, and defines the process that should be followed. 

Your data governance policy formally outlines how you ensure that health data is accurate, accessible, consistent, and protected. The policy also establishes who is responsible for information under various circumstances and specifies what procedures should be used. In addition, it can incorporate risk management and data ethics principles to reduce potential business problems from the use of data.

A data policy is a living document, which means it is flexible, and can be quickly updated to respond to changing needs. Each policy you develop should have a clear date it was approved (and by whom), and when it will be reviewed. It is worth setting up a policy review calendar or automation to make sure you are regularly checking your policy is up to date. While building out the health data governance framework described in these articles, we suggest a regular cadence, perhaps every month to quickly incorporate your most recent thinking.

Importance Of A Data Governance Policy

Data has become one of the most valuable assets held by organisations. Data is now used to plan and monitor strategy, design products and services, prioritise research, improve service delivery, and collaborate with others.

However, data is only a valuable asset if it is relevant to your organisation's needs and objectives, is accurate, and available consistently over time and throughout the organisation. Health data policies describe how you collect and manage data so that it maintains its utility.

Ongoing access to the data your organisation needs is driven by trust. Your data policies define how you will ensure trust is maintained at a high level.

Developing Your Data Governance Policy

Your health data governance policy should be developed drawing on the following:

• Your organisational mission statement and goals
• Your data justice principles
• Consultation with staff and ecosystem stakeholders
• Participatory mechanisms with your community and patients/users, again drawing on your data justice principles. 

A well-crafted policy creates a governance framework that empowers the following:

Data Governance Policy Structure

To start, your health data governance policy should include the following, or sign post to other policies or assets where this information is available:

We recommend when starting out, first collect any organisational knowledge or existing policies that cover these areas. For example, job descriptions may describe the expectations around roles and data responsibilities that is not held anywhere else. Perhaps your annual reports have explicitly mentioned how you respect community data but this hasn't been written down anywhere else.

Compliance and regulations will be discussed briefly in a follow-up article.

Making Your Own Data Policy

There are two main ways to make your data governance policy: