Communications Data Governance Policy Paper

1 What’s a Policy, What’s a Procedure? Policy and procedure writing is about clear
communication. It’s making sure that people have the information they need to do what they’re
supposed to be doing. With the right information and enough of it, both organization and reader
function properly. Why You Need Policies and Procedures You need policies and procedures for
the simple reason that you can’t do much without them. If a company didn’t have any, daily
operations would become chaotic and users frustrated. Policies and procedures are nothing more,
and nothing less, than the way an organization operates. They tell the reader what the
organization wants done, why it wants it done, and how to do it. The policies deal with the
”what” and “why.” The procedures deal with the “how.” And while we often talk about them in
the same breath, there are important differences between the two. For a discussion of those
differences, see the Summary Comparison of Policies and Procedures (1 1) at the end of this
chapter. Policies Policies are guidelines that regulate organizational action. They control the
conduct of people and the activities of systems. A policy is actually a type of position statement.
It explains the organization’s stand on a subject and why there’s a rule about it. It tells the reader
how the organization intends to operate.
Your organization is free to operate any way it chooses as long as it.
Procedures If policies are the organization’s guidelines, procedures are its workhorses. A
procedure is the normal method of handling things. It’s a protocol for implementation, the “how
to.” Procedures supplement the policy guidelines with specifics and complete the information
users need. It’s not sufficient to say, “It is our policy to provide the best customer service in the
industry” and stop there. Users need to know what that means. How do I provide the best
service? Do I give customers whatever they want? Am I supposed to give them nothing but make
them feel good about it? Is there a dollar limit on action I can take? Is there a certain amount of
time I should spend on a problem and no more? Procedures are action oriented. They outline the
steps you expect people to take and the sequence in which to perform those steps. They also
frequently point out the consequences of failure to comply, such as damage, loss, injury, or
discipline. Clearly stated consequences help users understand (1) the seriousness of the matter
and (2) their responsibility for it.
.
Assignment Scenario 13A
As a healthcare professional, you may be consulted to help with writing a policy and procedure
that addresses information security issues such as the one in Scenario 13-A, A Curious Human
Resource Employee. The policy and procedure will require adherence by all departments and
employees impacted. Review the security situation in Scenario 13-A, A Curious Human
Resource Employee.
Assignment Template
Company Name: Click here to enter the name of the fictitious company.
Author: Click here to enter your name. Position: Click here to enter the title of your
position.
Policy Name/Title: Click here to enter the name/title of your proposed policy.
Policy Number: Click here to enter a policy
number to your proposed policy [e.g.: ABC
123].
Date: Click here or tap to enter a date.
1. Background Information
Click here to enter the summary of the background information.
2. Purpose
Click here to enter your description of the purpose behind creating your policy.
3. Policy Description
Click here to enter the description of your policy.
4. Definitions
Click here to enter the definitions of any unique terms here [Format: 1. Term – definition]
5. Departments/Employees
Click here to enter any departments/employees impacted by or who will be responsible for
following this new policy.
6. Procedure(s)
Click here to enter your proposed procedure(s)
Assignment instructions
Develop a policy and procedure addressing the information security situation in Scenario 13-A,
A Curious Human Resource Employee.
•
•
•
•
•
Summarize the background information (summary of the Scenario as an example) of a
potential security issue(s).
Describe the purpose of creating the policy.
Define any unique terms that will be included in the policy
List the employees, individuals, entities, departments, etc. who would have access to the
electronic health record (EHR) system.
Propose a procedure for how the information will be accessed using the controls put in
place for protecting patient information in the electronic health record.
o Include in the proposal how one can request access to the health record, and the
approval process for granting access.