[{"innerBlocks":[],"name":"core\/freeform","postId":728,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"If you want some basic advice about launching a data governance program, it\u2019s easy to find: Get leadership buy-in, appoint some data stewards or champions, and make sure everyone meets regularly to talk about it.

But there\u2019s a lot more to it than that, especially in the age of data-hungry tools born from artificial intelligence. When you\u2019re dealing with data on a machine learning scale, you\u2019re dealing with \u201cgarbage in, garbage out\u201d on steroids.

\u201cThe only thing worse than not having enough data is having too much,\u201d says Colin Zick, who co-chairs the healthcare data privacy and security group at the law firm Foley Hoag. \u201cThat\u2019s the challenge as we move into a world where there are increasingly large data sets\u2014the data governance. How do you manage the data, how do you ensure its quality?\u201d With AI, he adds, \u201cyou really have to get into making sure the data and the analysis and the quality are there, because, if not, you\u2019re just going to make bigger mistakes.\u201d

Data integration, security, integrity and quality takes a lot of work, Zick says. \u201cOn the other side, if you put in the effort, you can get very valuable results. But you cannot expect that to happen without putting in a lot of time and effort.\u201d

Cary Smithson, director of digital transformation and management at Grant Thornton, an accounting and consulting firm, agrees: \u201cYou won\u2019t really get the full benefit of AI ... if you don\u2019t have your data model well defined and have the data that you need to leverage it,\u201d she says.

\u201cAI content management and information management and associated governance is foundational to getting the benefit out of AI and other technologies, even analytics. You need to really focus on defining what your master data is, sources of record, who owns the data and then get a governance model in place,\u201d she adds.

So, what specific steps can healthcare organizations take to avoid the pitfalls and reap the rewards of data governance in the age of artificial intelligence? It starts with a strong foundation.

Build the right team<\/b>

Healthcare organizations need buy-in from leaders. And yes, they need data stewards. But that\u2019s not nearly enough.

C-suite executives, for example, aren\u2019t necessarily the right people to lead data governance programs. Data stewards often lack even basic marching orders. And while communication is important, endless meetings could be counterproductive if the right people aren\u2019t in the room.

\u201cNine times out of 10, it becomes data governance by committee,\u201d says John Walton, senior solution architect for IT consulting firm CTG. \u201cDon\u2019t try data governance by committee.\u201d

Walton cites as an example a data governance program that kicked off with great intentions and a bevy of C-level titles at the table, from the CEO to the CIO.

\u201cHow long do you think that lasted?\u201d he asks. \u201cAfter two meetings with no progress, everybody\u2019s arguing about [algorithms]. They finally said, \u2018Well, this is a waste of our time,\u2019 and eventually it just died on the vine. Honestly, I can\u2019t tell you how many times I\u2019ve seen that.\u201d

And who should be at the table?

\u201cThe right people are subject matter experts or business data stewards. They\u2019re the people that have subject matter expertise in the data domain that you\u2019re trying to manage,\u201d Walton says.

But, he adds, you can\u2019t bestow the title of data steward and call it a day. \u201cFor those that don\u2019t take the governance-by-committee approach, they identify data stewards and don\u2019t really tell them how to do their job\u2014nor do they make it part of their job description, which is essential,\u201d Walton says. Data governance will fail \u201cliterally 100 percent of the time\u201d when the appointed data steward doesn\u2019t understand business processes or workflows.

One solution: Ensure governance team members have defined roles, including tactical and high-level strategy responsibilities, Smithson says.<\/b>

Split data champions into two groups: data stewards, who make recommendations about formulas or algorithms, for example, and director- or VP-level data owners who make the decisions, Walton adds. And put roles and responsibilities into job descriptions. \u201cThe job responsibilities come from the workflows and the tasks that need to be accomplished.\u201d

Those job descriptions should fall into two buckets, he says: data quality assurance and information consistency. For the former, tasks include identifying a data quality issue, remediating that issue with a workflow change, for example, and monitoring to ensure the effectiveness of the data governance initiative. For the latter, tasks include creating a business measure to support key performance indicators, to modify it when business rules change, and to sunset any items that are no longer relative.

A bonus tip: Tie data owners\u2019 bonuses to data quality. \u201cThat will get people\u2019s attention,\u201d Walton says.

Create trust<\/b>

When it comes to data governance\u2014or any project, really\u2014you hear a lot about the importance of culture and change management. But what does that mean, exactly?

\u201cOrganizational change is a key that tends to get forgotten as part of a lot these initiatives,\" Smithson says. It\u2019s about \u201cdefining who owns what data and looking across the key stakeholders in the organization. Where are they from a readiness and change perspective? Maybe you need to put a communication plan in place to \u2026 tailor the information to different levels and roles.\u201d

The American Society of Clinical Oncology\u2019s (ASCO) CancerLinQ initiative collects and analyzes massive amounts of data from patient encounters to give oncologists a quality monitoring system to ensure patients are getting the best care.

\u201cAs the representative body for oncologists we wanted to be able to build something that they can trust. Ultimately, you live and die on the trust that you have,\u201d says Alaap Shah, an attorney at Epstein Becker Green, who was the ASCO\u2019s chief privacy officer at the time.

How to build trust?

Step one was to develop a set of governing bodies to provide guidance on issues, to formalize them into policies, to govern how the organization operates and how it builds and uses technology, he says.

The data governance team delved into policy, ethical issues, and legal and regulatory requirements. Those were distilled into principal documents, then more fleshed-out policy statements.

\u201cThose became the internal bellwether by which we operationalized a lot of this program,\u201d Shah <\/b>says. \u201cThey were living and breathing documents which we revisited from time to time, partly through those committees we formed but also through the staff that was operationalizing around it. We were essentially developing a culture of compliance, a culture of privacy, a culture of data protection, a culture of responsible data stewardship. All these are the high-level principles by which we started to operate and think and live and breathe.\u201d

Step two was to \u201cthink about, internally and externally, what responsible data use and stewardship looks like and carry that out. We don\u2019t want to say to participants \u2018hey, give us all your data, we\u2019re going to do great things with it\u2019 and then go and sell it to some bad actor somewhere in the market,\u201d he says. \u201cThe point is, what do we need to be thinking about and doing to make sure that we\u2019re ... acting responsibly relative to the data we\u2019re getting from participants in our network and also using that data for downstream purposes that are responsible from a public perception perspective?\u201d

Setting boundaries means disclosing up front what the organization planned to do with the data and not deviate from that promise. \u201cEnsure you\u2019re safeguarding the data technologically and otherwise and then ultimately create something good with that,\u201d Shah says. \u201cYou\u2019ve been charged with this great responsibility because you have all this data; make sure that you don\u2019t screw it up.\u201d <\/b>

Share responsibly<\/b>

The ASCO\u2019s first and foremost goal was to serve oncologists and their patients. But it also had to work with pharma, medical device manufacturers and the government\u2014and figure out how to do so responsibly.

\u201cAll these stakeholders have roles that will benefit the ecosystem if they get the right access to the right data and [can] use it in the best way possible,\u201d Shah says. \u201cWe had to think critically about what are the boundaries within which we\u2019re comfortable doing that?\u201d

The data governance team recognized that need to share with the pharma industry, for example, but set up guardrails\u2014data would always be de-identified and they would respond only to specific requests that had clear time and scope limits and aimed to solve specific, concrete problems.

The guiding question, Shah <\/b>says: \u201cIs there a specific segment of the population that has an immediate need for innovation in the drug space that we could help support?\u201d

A research and publications committee created a process to vet requests for legitimacy, feasibility and even the character of the organizations before agreeing to share data. The team would also look at the technology an organization would use for the analysis and ensure they had appropriate security safeguards in place. Organizations that didn\u2019t might be credentialed to view limited data in the ACSO\u2019s own system.

In addition to vetting, contracts are crucial, Shah <\/b>says.

\u201cYou need to have contract vehicles that contemplate and hammer out some thorny issues [such as] the data ownership pieces, so everyone knows who owns the data, who\u2019s just licensing it and borrowing it for a short period of time so that you don\u2019t have disputes about that later. You have to hammer out issues [about] de-identified data. You have to be very careful to put in clear language about not linking it, not reidentifying it, not sharing it with other third parties without \u2026 assurances in place,\u201d Shah says.

\u201cOne of the big problems with the industry today is people don\u2019t appreciate this issue because they don\u2019t want to go through the time and expense of vetting,\u201d he adds. And organizations can contract out that function, but then they run the risk of losing sight of patients\u2019 data privacy.

\u201cWe can fight about who\u2019s going to carry the bag at the end of the day. But at the end of the day is when the patient\u2019s privacy interest is lost,\u201d he says.

Use technology<\/b>\u2014to a point<\/b>

Too often, organizations don\u2019t equip their data stewards with the technology tools they need. Data profiling tools, for example, might be expensive\u2014but will pay for themselves quickly, Walton says. <\/b>\u201cI just can\u2019t emphasize enough how important it is to have a tool that can help the data stewards do their job.\u201d

Other tools might include enterprise content management solutions or services for unstructured content, Smithson says. Look for solutions that integrate with other systems, such as customer relationship management tools or the major enterprise resource planning applications.

\u201cThese content management solutions that go enterprise-wide, they can have content services that are already built to work with some of the leading tools that are out there. So the documents that get generated or used by these other solutions \u2026 they can just manage that along the process and serve up documents in the other applications wherever the eyeballs are and where you\u2019re working along the business process,\u201d she says.

Then again, technology isn\u2019t a cure-all.

At Facebook, scientists famously deployed a generative adversarial network to get two AI systems to communicate with each other and solve a problem, but didn\u2019t stipulate that the systems should do the work in English. To earn rewards faster, the systems developed a kind of shorthand that humans couldn\u2019t easily understand.

\u201cThe AI has done something completely unforeseeable and unexpected and actually sometimes problematic,\u201d Shah says. \u201cYou can see that there could be a scenario where you give AI this power and all this data and it goes off and does something really wild with it.\u201d

To be fair, online reports of creepy computers making up their own language to the shock and dismay of researchers were overstated. In fact, getting unexpected results when deploying learning systems is a feature, not a glitch. Surprises could lead to a medical breakthrough, after all.

Then again, surprises can also cause a data breach. Zick recounts working with a client that thought they scrubbed their large data set of all personal health information, for example. But it turned out physicians were entering PHI in a field that was supposed to be PHI-free.

That\u2019s why humans have to keep an eye on AI outputs and react in near real-time to the unexpected\u2014and it\u2019s why data governance is so important.
Although there are huge benefits to AI and machine learning, when left to its own devices, \u201cthe parade of horribles is extensive,\u201d Zick says. \u201cThe moral of the story is you\u2019ve got to go slow [and] verify the data and you can\u2019t just trust the technology. \u2026 If you don\u2019t check it with something tangible you\u2019ve got a problem.\u201d

There are different facets to managing data in the age of AI, Shah says. \u201cYou can\u2019t solve it with any one thing. It\u2019s not a technology fix; it\u2019s not a policy fix. You need to have a holistic data governance plan that deals with people, processes and technologies, with all of it working together in concert.\u201d

Don\u2019t be \u201cenamored by some of these shiny tools without working [on the] foundation first,\u201d Smithson adds. \u201cIf you don\u2019t \u2026 then your information is not going to be governed.\u201d","saveContent":"If you want some basic advice about launching a data governance program, it\u2019s easy to find: Get leadership buy-in, appoint some data stewards or champions, and make sure everyone meets regularly to talk about it.

But there\u2019s a lot more to it than that, especially in the age of data-hungry tools born from artificial intelligence. When you\u2019re dealing with data on a machine learning scale, you\u2019re dealing with \u201cgarbage in, garbage out\u201d on steroids.

\u201cThe only thing worse than not having enough data is having too much,\u201d says Colin Zick, who co-chairs the healthcare data privacy and security group at the law firm Foley Hoag. \u201cThat\u2019s the challenge as we move into a world where there are increasingly large data sets\u2014the data governance. How do you manage the data, how do you ensure its quality?\u201d With AI, he adds, \u201cyou really have to get into making sure the data and the analysis and the quality are there, because, if not, you\u2019re just going to make bigger mistakes.\u201d

Data integration, security, integrity and quality takes a lot of work, Zick says. \u201cOn the other side, if you put in the effort, you can get very valuable results. But you cannot expect that to happen without putting in a lot of time and effort.\u201d

Cary Smithson, director of digital transformation and management at Grant Thornton, an accounting and consulting firm, agrees: \u201cYou won\u2019t really get the full benefit of AI ... if you don\u2019t have your data model well defined and have the data that you need to leverage it,\u201d she says.

\u201cAI content management and information management and associated governance is foundational to getting the benefit out of AI and other technologies, even analytics. You need to really focus on defining what your master data is, sources of record, who owns the data and then get a governance model in place,\u201d she adds.

So, what specific steps can healthcare organizations take to avoid the pitfalls and reap the rewards of data governance in the age of artificial intelligence? It starts with a strong foundation.

Build the right team<\/b>

Healthcare organizations need buy-in from leaders. And yes, they need data stewards. But that\u2019s not nearly enough.

C-suite executives, for example, aren\u2019t necessarily the right people to lead data governance programs. Data stewards often lack even basic marching orders. And while communication is important, endless meetings could be counterproductive if the right people aren\u2019t in the room.

\u201cNine times out of 10, it becomes data governance by committee,\u201d says John Walton, senior solution architect for IT consulting firm CTG. \u201cDon\u2019t try data governance by committee.\u201d

Walton cites as an example a data governance program that kicked off with great intentions and a bevy of C-level titles at the table, from the CEO to the CIO.

\u201cHow long do you think that lasted?\u201d he asks. \u201cAfter two meetings with no progress, everybody\u2019s arguing about [algorithms]. They finally said, \u2018Well, this is a waste of our time,\u2019 and eventually it just died on the vine. Honestly, I can\u2019t tell you how many times I\u2019ve seen that.\u201d

And who should be at the table?

\u201cThe right people are subject matter experts or business data stewards. They\u2019re the people that have subject matter expertise in the data domain that you\u2019re trying to manage,\u201d Walton says.

But, he adds, you can\u2019t bestow the title of data steward and call it a day. \u201cFor those that don\u2019t take the governance-by-committee approach, they identify data stewards and don\u2019t really tell them how to do their job\u2014nor do they make it part of their job description, which is essential,\u201d Walton says. Data governance will fail \u201cliterally 100 percent of the time\u201d when the appointed data steward doesn\u2019t understand business processes or workflows.

One solution: Ensure governance team members have defined roles, including tactical and high-level strategy responsibilities, Smithson says.<\/b>

Split data champions into two groups: data stewards, who make recommendations about formulas or algorithms, for example, and director- or VP-level data owners who make the decisions, Walton adds. And put roles and responsibilities into job descriptions. \u201cThe job responsibilities come from the workflows and the tasks that need to be accomplished.\u201d

Those job descriptions should fall into two buckets, he says: data quality assurance and information consistency. For the former, tasks include identifying a data quality issue, remediating that issue with a workflow change, for example, and monitoring to ensure the effectiveness of the data governance initiative. For the latter, tasks include creating a business measure to support key performance indicators, to modify it when business rules change, and to sunset any items that are no longer relative.

A bonus tip: Tie data owners\u2019 bonuses to data quality. \u201cThat will get people\u2019s attention,\u201d Walton says.

Create trust<\/b>

When it comes to data governance\u2014or any project, really\u2014you hear a lot about the importance of culture and change management. But what does that mean, exactly?

\u201cOrganizational change is a key that tends to get forgotten as part of a lot these initiatives,\" Smithson says. It\u2019s about \u201cdefining who owns what data and looking across the key stakeholders in the organization. Where are they from a readiness and change perspective? Maybe you need to put a communication plan in place to \u2026 tailor the information to different levels and roles.\u201d

The American Society of Clinical Oncology\u2019s (ASCO) CancerLinQ initiative collects and analyzes massive amounts of data from patient encounters to give oncologists a quality monitoring system to ensure patients are getting the best care.

\u201cAs the representative body for oncologists we wanted to be able to build something that they can trust. Ultimately, you live and die on the trust that you have,\u201d says Alaap Shah, an attorney at Epstein Becker Green, who was the ASCO\u2019s chief privacy officer at the time.

How to build trust?

Step one was to develop a set of governing bodies to provide guidance on issues, to formalize them into policies, to govern how the organization operates and how it builds and uses technology, he says.

The data governance team delved into policy, ethical issues, and legal and regulatory requirements. Those were distilled into principal documents, then more fleshed-out policy statements.

\u201cThose became the internal bellwether by which we operationalized a lot of this program,\u201d Shah <\/b>says. \u201cThey were living and breathing documents which we revisited from time to time, partly through those committees we formed but also through the staff that was operationalizing around it. We were essentially developing a culture of compliance, a culture of privacy, a culture of data protection, a culture of responsible data stewardship. All these are the high-level principles by which we started to operate and think and live and breathe.\u201d

Step two was to \u201cthink about, internally and externally, what responsible data use and stewardship looks like and carry that out. We don\u2019t want to say to participants \u2018hey, give us all your data, we\u2019re going to do great things with it\u2019 and then go and sell it to some bad actor somewhere in the market,\u201d he says. \u201cThe point is, what do we need to be thinking about and doing to make sure that we\u2019re ... acting responsibly relative to the data we\u2019re getting from participants in our network and also using that data for downstream purposes that are responsible from a public perception perspective?\u201d

Setting boundaries means disclosing up front what the organization planned to do with the data and not deviate from that promise. \u201cEnsure you\u2019re safeguarding the data technologically and otherwise and then ultimately create something good with that,\u201d Shah says. \u201cYou\u2019ve been charged with this great responsibility because you have all this data; make sure that you don\u2019t screw it up.\u201d <\/b>

Share responsibly<\/b>

The ASCO\u2019s first and foremost goal was to serve oncologists and their patients. But it also had to work with pharma, medical device manufacturers and the government\u2014and figure out how to do so responsibly.

\u201cAll these stakeholders have roles that will benefit the ecosystem if they get the right access to the right data and [can] use it in the best way possible,\u201d Shah says. \u201cWe had to think critically about what are the boundaries within which we\u2019re comfortable doing that?\u201d

The data governance team recognized that need to share with the pharma industry, for example, but set up guardrails\u2014data would always be de-identified and they would respond only to specific requests that had clear time and scope limits and aimed to solve specific, concrete problems.

The guiding question, Shah <\/b>says: \u201cIs there a specific segment of the population that has an immediate need for innovation in the drug space that we could help support?\u201d

A research and publications committee created a process to vet requests for legitimacy, feasibility and even the character of the organizations before agreeing to share data. The team would also look at the technology an organization would use for the analysis and ensure they had appropriate security safeguards in place. Organizations that didn\u2019t might be credentialed to view limited data in the ACSO\u2019s own system.

In addition to vetting, contracts are crucial, Shah <\/b>says.

\u201cYou need to have contract vehicles that contemplate and hammer out some thorny issues [such as] the data ownership pieces, so everyone knows who owns the data, who\u2019s just licensing it and borrowing it for a short period of time so that you don\u2019t have disputes about that later. You have to hammer out issues [about] de-identified data. You have to be very careful to put in clear language about not linking it, not reidentifying it, not sharing it with other third parties without \u2026 assurances in place,\u201d Shah says.

\u201cOne of the big problems with the industry today is people don\u2019t appreciate this issue because they don\u2019t want to go through the time and expense of vetting,\u201d he adds. And organizations can contract out that function, but then they run the risk of losing sight of patients\u2019 data privacy.

\u201cWe can fight about who\u2019s going to carry the bag at the end of the day. But at the end of the day is when the patient\u2019s privacy interest is lost,\u201d he says.

Use technology<\/b>\u2014to a point<\/b>

Too often, organizations don\u2019t equip their data stewards with the technology tools they need. Data profiling tools, for example, might be expensive\u2014but will pay for themselves quickly, Walton says. <\/b>\u201cI just can\u2019t emphasize enough how important it is to have a tool that can help the data stewards do their job.\u201d

Other tools might include enterprise content management solutions or services for unstructured content, Smithson says. Look for solutions that integrate with other systems, such as customer relationship management tools or the major enterprise resource planning applications.

\u201cThese content management solutions that go enterprise-wide, they can have content services that are already built to work with some of the leading tools that are out there. So the documents that get generated or used by these other solutions \u2026 they can just manage that along the process and serve up documents in the other applications wherever the eyeballs are and where you\u2019re working along the business process,\u201d she says.

Then again, technology isn\u2019t a cure-all.

At Facebook, scientists famously deployed a generative adversarial network to get two AI systems to communicate with each other and solve a problem, but didn\u2019t stipulate that the systems should do the work in English. To earn rewards faster, the systems developed a kind of shorthand that humans couldn\u2019t easily understand.

\u201cThe AI has done something completely unforeseeable and unexpected and actually sometimes problematic,\u201d Shah says. \u201cYou can see that there could be a scenario where you give AI this power and all this data and it goes off and does something really wild with it.\u201d

To be fair, online reports of creepy computers making up their own language to the shock and dismay of researchers were overstated. In fact, getting unexpected results when deploying learning systems is a feature, not a glitch. Surprises could lead to a medical breakthrough, after all.

Then again, surprises can also cause a data breach. Zick recounts working with a client that thought they scrubbed their large data set of all personal health information, for example. But it turned out physicians were entering PHI in a field that was supposed to be PHI-free.

That\u2019s why humans have to keep an eye on AI outputs and react in near real-time to the unexpected\u2014and it\u2019s why data governance is so important.
Although there are huge benefits to AI and machine learning, when left to its own devices, \u201cthe parade of horribles is extensive,\u201d Zick says. \u201cThe moral of the story is you\u2019ve got to go slow [and] verify the data and you can\u2019t just trust the technology. \u2026 If you don\u2019t check it with something tangible you\u2019ve got a problem.\u201d

There are different facets to managing data in the age of AI, Shah says. \u201cYou can\u2019t solve it with any one thing. It\u2019s not a technology fix; it\u2019s not a policy fix. You need to have a holistic data governance plan that deals with people, processes and technologies, with all of it working together in concert.\u201d

Don\u2019t be \u201cenamored by some of these shiny tools without working [on the] foundation first,\u201d Smithson adds. \u201cIf you don\u2019t \u2026 then your information is not going to be governed.\u201d","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Data governance in the age of AI: Beyond the basics

More for you