By: Alison J. Murray CIPP/C, CIPM, FIP , Chief Privacy Information Officer and Director, Digital Health, Quality and Performance, Research and Project Management Office at Hôtel Dieu Grace Healthcare; TransForm Shared Service Organization Governance Model - Regional Privacy and Data Governance Committee Chair
As health care systems become increasingly interconnected, organizations face growing pressure to balance secure information sharing, digital innovation, and regulatory compliance. While regional collaboration can improve efficiency and support integrated care, it also creates new challenges related to privacy, data governance, cybersecurity, and accountability.
Recognizing these challenges, five Ontario hospitals - Hôtel-Dieu Grace Healthcare in Windsor, Windsor Regional Hospital, Erie Shores HealthCare in Leamington, Chatham-Kent Health Alliance, and Blue Water Health in Sarnia – in partnership with a regional shared information technology service organization and other health system partners, embarked on the development of a regional privacy and data governance model designed to strengthen information stewardship while enabling innovation.
Historically, participating organizations maintained independent privacy programs, governance structures, policies, and monitoring practices. Although this approach supported local autonomy, it often resulted in inconsistencies in risk management, duplication of effort, and varying approaches to privacy and data-related decision-making. As regional digital health initiatives expanded and information-sharing requirements increased, the need for a more coordinated approach became evident.
To address these challenges, the organizations implemented a collaborative regional model that connects privacy and data governance through shared leadership, standardized practices, and coordinated oversight while maintaining each organization's accountability for its legislative and regulatory obligations. The initiative was designed to create a sustainable framework that supports secure information sharing, strengthens compliance, and improves governance maturity across participating organizations.
A foundational element of the model was the establishment of a multidisciplinary regional governance structure. Privacy leaders, data governance representatives, legal counsel, cybersecurity professionals, clinical stakeholders, operational leaders, and shared service technology experts came together to provide strategic oversight and coordinated decision-making. This governance forum supports the review of regional initiatives, addresses emerging risks, aligns organizational priorities, and promotes consistent approaches to managing personal health information and data assets.
Standardization played a significant role in advancing regional alignment. Participating organizations collaboratively developed common policies, procedures, templates, and guidance documents related to privacy impact assessments, information-sharing agreements, breach management, data access, information management, and technology reviews. While organizations retained flexibility to address unique local requirements, the adoption of shared tools and frameworks reduced unnecessary variation and streamlined the evaluation of regional projects and digital health initiatives.
Education and awareness were also identified as critical enablers of success. Through a coordinated regional approach, partners developed shared training resources, awareness campaigns, communities of practice, and knowledge exchange opportunities. These initiatives enhanced privacy and data governance literacy across clinical, operational, technical, and leadership groups. Importantly, the collaborative model enabled organizations to access expertise that may not have existed within every organization individually, strengthening capacity across the region and fostering a culture of shared learning and accountability.
To ensure sustainability and continuous improvement, the model incorporated coordinated monitoring and oversight activities. Common performance indicators, privacy and data governance maturity assessments, compliance reviews, risk reporting mechanisms, and governance reporting structures were established. These measures improved visibility into regional trends, enhanced proactive risk management, and provided executive leadership with meaningful insights into organizational performance and areas requiring attention.
The results have been significant. Participating organizations experienced improved consistency in governance and compliance practices, reduced duplication through shared resources, enhanced access to specialized expertise, and stronger collaboration among hospitals, shared service providers, and regional partners. The model also improved organizational readiness to support increasingly complex digital health initiatives, including regional information-sharing projects, advanced analytics, and emerging technologies such as artificial intelligence.
Perhaps most importantly, the initiative demonstrated that privacy and data governance are most effective when viewed as interconnected disciplines rather than separate organizational functions.
By aligning privacy, data governance, cybersecurity, and digital transformation strategies, participating organizations established a stronger foundation for responsible innovation and trusted information sharing.
As health care organizations continue to pursue integrated models of care and digital transformation, regional collaboration offers a practical and scalable approach to strengthening information stewardship. Organizations seeking to advance their privacy and data governance programs should consider establishing formal governance structures, investing in shared education and monitoring programs, standardizing key processes, and leveraging expertise across partner organizations. Strong executive sponsorship, clear accountability, and a commitment to continuous improvement remain essential for long-term success.
The experience of these five Ontario hospitals demonstrates that regional privacy and data governance are not only achievable but can create substantial value. By working together, organizations can enhance compliance, build trust, support innovation, and ultimately enable safer, more effective care for the patients and communities they serve.