Why coordinated information governance matters as healthcare organizations prepare for proposed HIPAA Security Rule changes
An orchestra can have the finest musicians, the best quality instruments, and an impressive conductor; but, without coordination, even the most talented performers struggle to create a harmonious sound.
Healthcare organizations face a similar challenge when protecting sensitive patient information—even after investing in advanced cybersecurity tools, establishing compliance policies, and implementing records management procedures. When these efforts operate independently, gaps emerge that put information security, accessibility, and compliance at risk.
As the U.S. Department of Health and Human Services (HHS) considers proposed updates to the HIPAA Security Rule, healthcare organizations have an opportunity to evaluate how well their information governance practices work together. Protecting patient information requires more than isolated solutions. The real opportunity lies in coordinating the people, processes, and technology responsible for managing it.
In an orchestra, every section plays a distinct but essential role. The strings provide the melodic and harmonic foundation, the woodwinds bring color and contrast, and the percussion adds rhythm and dramatic impact. Each contributes something unique, but they must all follow the same score to create a cohesive performance. Healthcare information governance works much the same way.
IT teams manage systems and cybersecurity controls. Compliance professionals interpret regulatory obligations and oversee policies. Legal teams help navigate retention requirements and defensible disposition. Clinical and administrative teams create, access, and use patient information every day. Records management professionals help ensure that information is organized, protected, retrievable, and retained appropriately throughout its lifecycle.
When these responsibilities are disconnected, important questions go unanswered. Does the organization know where sensitive information resides? Are access permissions appropriate? Can records be located when needed? Are retention policies consistently applied across physical and digital archives?
Effective information governance brings these responsibilities together under a coordinated strategy, with clear ownership and consistent processes.
Join ARMA and Access for a live panel featuring Records and Information Management practitioners who understand that reality firsthand. During a moderated conversation, panelists will share stories from their own programs, lessons they have learned, and advice for peers facing…
In January 2025, HHS published a proposed update to the HIPAA Security Rule intended to strengthen cybersecurity protections for electronic protected health information (ePHI). Among other measures, the proposal would establish more specific expectations for risk analysis, technology asset inventories, written documentation, access controls, contingency planning, and security testing.
These provisions remain proposed rather than final requirements. However, they highlight the importance of understanding how information is managed across an organization, instead of focusing on individual systems or safeguards in isolation.
Consider a healthcare organization that has invested in strong cybersecurity controls but lacks a comprehensive inventory of its information assets. Without knowing where ePHI resides and which systems handle it, the organization may struggle to assess risks or determine whether appropriate protections are in place.
Or imagine that a disaster disrupts access to a critical system. Technology teams may be responsible for restoring the system, but recovery also depends on knowing which information is essential, where protected copies exist, and how to prioritize access to critical records.
These scenarios illustrate why information governance must connect security, records management, and operational continuity. A strong individual component cannot compensate for a breakdown elsewhere in the process.
A coordinated approach to information governance starts with a few practical steps.
Understand what records your organization maintains, where they reside, who is responsible for them, and how they’re used. Accurate inventory and effective indexing can improve visibility and help teams identify information management gaps.
Security is not simply about restricting access. Authorized personnel must be able to retrieve the information they need, while access is limited appropriately. Retention schedules should reflect applicable legal, regulatory, and business requirements, and disposition should follow documented, defensible procedures.
Bring relevant teams together to review policies, responsibilities, and potential risks. Ensure that records management practices support broader security objectives and that decisions are documented consistently.
Coordinate records management and IT recovery planning. Identify critical information, understand where records are maintained, and establish procedures for restoring access after an incident. Plans should be tested and refined, not simply filed away.
Information governance is an ongoing responsibility. Periodic reviews can help organizations identify outdated procedures, changing risks, and opportunities to improve coordination as technology, operations, and regulatory expectations evolve.
Healthcare organizations cannot rely on a single policy, platform, or department to address every information management challenge. Effective governance depends on how well the pieces work together.
As organizations evaluate the proposed HIPAA Security Rule changes, this is an opportunity to look beyond individual safeguards and assess the broader information management program. Are responsibilities clearly defined? Can teams account for their information assets? Do records management, security, and recovery procedures reinforce one another?
When these elements are aligned, organizations are better positioned to manage information consistently, support operational resilience, and demonstrate how their practices address applicable requirements.
Compliance is not a solo performance. It’s a coordinated effort to ensure every part of the information lifecycle works in harmony.
At Access, we help healthcare organizations put that coordination into practice. Our records and information management services support the secure storage, organization, digitization, retention, and retrieval of information across physical and digital environments. Through solutions such as Access Unify | Health, we also help organizations retire legacy EHR systems while keeping historical patient records accessible when needed.
As healthcare organizations evaluate the proposed HIPAA Security Rule changes, having a trusted information management partner can help strengthen existing processes, improve visibility into records, and reduce gaps between departments.
Every orchestra needs its musicians working from the same score. Access helps healthcare organizations bring their information management practices into better alignment so teams can protect, manage, and access the information they depend on.
Learn how Access supports healthcare information management.
Share