HIS Governance, Ethics, Regulation and Risk

Introduction

Hospital Information Systems (HIS) are no longer merely administrative infrastructures for registration, billing, and reporting. They are clinical, managerial, research, and public-health infrastructures through which decisions are made, responsibilities are allocated, and evidence is created. An electronic health record may influence diagnosis; an interoperability platform may transmit medication information across institutions; an analytics model may determine which patients receive outreach; and a downtime or cybersecurity event may directly threaten patient safety.

For this reason, HIS governance must be treated as an enterprise management function rather than an information-technology activity. Governance establishes who has authority, who is accountable, how decisions are justified, how risks are controlled, and how affected people can seek remedy. It connects institutional strategy with ethical duties, legal obligations, clinical safety, information security, and operational resilience.

This chapter examines governance structures for accountability, data stewardship, consent, confidentiality, secondary data use, algorithmic fairness, medico-legal compliance, safety assurance, and enterprise information risk management. It adopts a principles-based approach because specific laws differ across jurisdictions. Managers must always consult the law applicable to their institution, patients, workforce, and data flows.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the meaning and strategic importance of HIS governance.
2. Design roles and decision rights for information accountability and stewardship.
3. Apply ethical principles to consent, confidentiality, data sharing, and secondary use.
4. Distinguish privacy, security, safety, quality, and legal compliance risks.
5. Evaluate algorithmic systems for fairness, transparency, validity, and accountability.
6. Develop an enterprise information-risk management and assurance framework.
7. Recommend governance responses to a complex hospital information incident.

1. Governance as an enterprise capability

Governance is the system by which an organization is directed, overseen, and held accountable. Management performs and coordinates activities; governance determines authority, priorities, controls, and oversight. In HIS, governance covers data, applications, infrastructure, digital services, clinical decision support, analytics, vendors, and information-related conduct.

A useful distinction is:

Governance is effective when it creates traceable decisions. A policy stating that “data must be protected” is insufficient unless the organization specifies the asset, threat, owner, control, evidence, escalation route, and review date.

The three lines of responsibility

A practical model is the three-lines approach:

• First line—operational ownership: clinical departments, registration teams, laboratory services, and application owners manage risks in daily work.
• Second line—specialist oversight: privacy, information security, compliance, quality, risk, and safety functions establish standards and challenge operational decisions.
• Third line—independent assurance: internal audit or an equivalent independent function evaluates whether governance and controls operate effectively.

The board and executive committee sit above these lines as the ultimate holders of institutional accountability. They cannot delegate accountability merely by delegating tasks.

2. Accountability, stewardship, and decision rights

Accountability means being answerable for decisions and outcomes. Responsibility means performing an assigned activity. Authority means having legitimate power to decide. These concepts should be separated. A data steward may be responsible for maintaining a data dictionary, while the clinical service director remains accountable for the quality and appropriate use of the service’s data.

Core HIS roles

• Board: approves risk appetite, receives assurance, and oversees major information risks.
• Chief executive: integrates HIS governance with organizational strategy and resources.
• Chief information officer: leads information and technology capability.
• Chief medical or nursing information officer: connects digital systems with clinical practice and safety.
• Chief information security officer: directs cyber-risk management and security operations.
• Privacy or data-protection officer: advises on privacy obligations, rights, impact assessments, and incidents.
• Information asset owner: remains accountable for a defined system, dataset, or process.
• Data steward: maintains definitions, quality rules, access decisions, metadata, and lifecycle controls.
• Clinical safety officer: coordinates hazard identification, safety cases, incident learning, and change assurance.
• Records manager: controls retention, disposition, authenticity, and evidential integrity.
• Users and professionals: access information only for legitimate purposes and report errors or hazards.
• Vendors and processors: meet contractual, security, privacy, continuity, and audit obligations.

A responsibility assignment matrix can prevent gaps. For each major decision, the organization should identify who is accountable, who is responsible, who must be consulted, and who must be informed. For example, a new clinical prediction model may require the clinical service director to be accountable, the data-science team to be responsible for development, the privacy and safety officers to be consulted, and affected clinicians to be informed and trained.

Data stewardship

Data stewardship extends beyond confidentiality. It includes:

• Definition: consistent meaning of fields, codes, measures, and clinical concepts.
• Quality: accuracy, completeness, timeliness, consistency, validity, and uniqueness.
• Provenance: knowledge of where data originated, how it changed, and who used it.
• Access: permissions based on role, purpose, necessity, and professional legitimacy.
• Lifecycle: collection, use, sharing, retention, archival, and secure disposal.
• Interoperability: reliable exchange without loss or distortion of meaning.
• Equity: recognition of populations that may be missing, misclassified, or disadvantaged.

Data quality should be governed as a clinical and operational issue. A missing allergy field is not simply a database defect; it may be a patient-safety hazard. Quality indicators should therefore be linked to service owners, thresholds, corrective action, and escalation.

3. Ethical foundations of HIS governance

HIS decisions should be evaluated through several complementary ethical principles:

• Respect for autonomy: people should receive understandable information and exercise meaningful choices where choice is legally and ethically required.
• Beneficence: information use should produce or reasonably seek benefit.
• Non-maleficence: foreseeable harms should be prevented or minimized.
• Justice: benefits, burdens, access, and errors should not be distributed unfairly.
• Respect for persons and dignity: patients should not be reduced to data points or exposed to unnecessary surveillance.
• Proportionality: the intrusiveness of collection or use should be proportionate to the legitimate objective.
• Accountability: institutions must explain decisions, maintain evidence, and provide remedy.

Ethical review is not limited to research. Routine operational analytics, patient-identification systems, remote monitoring, and automated prioritization can also affect rights and opportunities. A lawful use may still be ethically unacceptable if it is excessive, opaque, discriminatory, or inconsistent with reasonable patient expectations.

4. Consent, confidentiality, and secondary data use

Consent is contextual

Consent is commonly described as informed, voluntary, specific, and revocable, although legal requirements vary. In clinical care, information processing may sometimes rely on a legal basis other than explicit consent, such as treatment, public interest, statutory duty, or legitimate institutional functions. This does not remove the duties of transparency, minimization, confidentiality, and respect for patient preferences.

Valid consent requires more than a signature. The person should understand, to a reasonable degree:

1. what information will be collected;
2. why it is needed;
3. who may receive it;
4. whether refusal affects care;
5. how long it will be retained;
6. whether it may be reused for research, quality improvement, or commercial purposes; and
7. how consent can be withdrawn, subject to lawful and practical limitations.

Consent models include broad consent, dynamic consent, opt-in consent, opt-out notification, and waiver by an authorized ethics body. Each involves trade-offs between autonomy, feasibility, representativeness, and administrative burden. Broad consent can support future research but may be less specific. Dynamic consent offers continuing communication but may exclude people with limited digital access.

Confidentiality and access control

Confidentiality is a professional and ethical duty to protect information entrusted by a patient. Privacy concerns the person’s control and legitimate expectations regarding information; security concerns the technical and organizational measures used to protect it. These concepts overlap but are not identical.

A defensible access model combines:

• Role-based access: permissions reflect job functions.
• Attribute-based restrictions: context such as location, relationship to the patient, time, or purpose also matters.
• Least privilege: users receive only the access necessary for authorized work.
• Break-glass access: emergency access is possible but justified, logged, and reviewed.
• Segmentation: particularly sensitive services or datasets receive additional safeguards.
• Auditability: access logs support detection, investigation, and accountability.
• Patient-facing transparency: where appropriate, individuals can inspect access history or request correction.

Access control cannot compensate for poor culture. Staff must understand that curiosity, convenience, personal interest, or celebrity status never creates a legitimate care relationship.

Secondary use of health data

Secondary use means using information for a purpose different from the original direct-care or administrative purpose. Examples include research, service planning, quality measurement, public-health surveillance, education, artificial-intelligence development, and commercial analysis.

A secondary-use review should address:

De-identification reduces risk but does not guarantee anonymity. Rare diseases, dates, geographic information, and combinations of indirect identifiers may permit re-identification. Governance should therefore consider the data environment, available external information, and the motivation and capability of an adversary.

5. Regulation and medico-legal compliance

Health information regulation typically combines privacy and data-protection law, professional confidentiality, health-record law, cybersecurity requirements, medical-device rules, public-health legislation, research regulation, disability and equality law, consumer protection, employment law, and contractual obligations. The applicable framework depends on jurisdiction, institutional status, patient location, and the nature of the service.

Examples of influential frameworks include the European Union General Data Protection Regulation, the United States Health Insurance Portability and Accountability Act, national health-record statutes, professional codes, and medical-device or software regulations. These examples should not be treated as interchangeable or universally applicable.

Compliance should be operationalized

A compliance program should translate legal requirements into controls and evidence. Important control areas include:

• lawful basis and purpose documentation;
• privacy notices and rights-handling procedures;
• records of processing and data-flow maps;
• retention and lawful disposal schedules;
• processor and vendor due diligence;
• breach detection, notification, and response;
• access logging and periodic review;
• record correction, amendment, and dispute procedures;
• clinical documentation standards;
• electronic-signature and authentication controls;
• discovery and litigation-hold procedures;
• staff training and disciplinary processes.

The electronic record is both a care instrument and a legal record. Altering a record without preserving the original, copying forward inaccurate information, sharing credentials, or documenting a decision outside the approved system can compromise patient care and evidential integrity. Audit trails must therefore be protected from unauthorized alteration and retained according to applicable requirements.

6. Algorithmic fairness and responsible analytics

Algorithms can improve risk prediction, scheduling, diagnosis, and resource allocation, but they can also reproduce structural inequities. Fairness cannot be inferred from technical sophistication. It must be investigated in relation to the clinical purpose, affected population, decision threshold, and consequences of error.

Sources of algorithmic harm

• historical data reflect unequal access or biased clinical practice;
• outcome labels measure utilization rather than true need;
• under-represented groups have poorer data quality;
• proxy variables encode protected characteristics;
• deployment conditions differ from development conditions;
• automation bias causes clinicians to over-trust outputs;
• performance declines after workflow, population, or treatment changes.

A governance review should ask:

1. What decision does the model support, and who may be harmed?
2. Is the target variable clinically meaningful and ethically appropriate?
3. Does performance differ across relevant groups?
4. Are calibration, sensitivity, specificity, and predictive values acceptable for the use case?
5. Is there a human review pathway and a way to challenge the output?
6. Are uncertainty, limitations, version, and intended use visible to users?
7. Is post-deployment monitoring linked to corrective action?

For a binary classifier, sensitivity and specificity are commonly defined as:

Here, TP denotes true positives, FN false negatives, TN true negatives, and FP false positives. These measures depend on the selected threshold and the reference standard. They do not by themselves establish fairness or clinical usefulness. Predictive values also depend on prevalence, so a model can have similar sensitivity and specificity across groups yet produce different positive predictive values when disease prevalence differs.

Fairness criteria can conflict. Equal error rates, equal calibration, and equal predictive values are not generally simultaneously achievable when groups differ in prevalence or data-generating processes. Therefore, governance must select fairness objectives in relation to clinical consequences, law, and institutional values rather than treating one metric as universally correct.

A model should pass through staged assurance: problem definition, data assessment, development, internal validation, external validation, clinical evaluation, implementation testing, monitoring, change control, and retirement. Documentation should include a model card or equivalent statement of intended population, exclusions, inputs, training context, limitations, and known subgroup performance.

7. Clinical safety and information assurance

Clinical safety assurance asks whether an HIS can introduce or fail to prevent harm. Relevant hazards include incorrect patient matching, delayed results, alert fatigue, unavailable systems, interface errors, wrong units, stale medication lists, unsafe defaults, and misleading decision support.

Safety engineering emphasizes prospective hazard analysis as well as incident investigation. Methods may include hazard registers, failure-mode analysis, safety cases, simulation, usability testing, clinical validation, structured change approval, and post-implementation surveillance.

A safety case is a reasoned argument, supported by evidence, that a system is acceptably safe for a defined context. It should identify claims, assumptions, hazards, controls, residual risks, and evidence. Safety approval is not a one-time certification: software updates, new interfaces, workflow changes, and population changes may alter risk.

Information security has three classical objectives:

• Confidentiality: information is available only to authorized parties.
• Integrity: information remains accurate, complete, and protected from unauthorized alteration.
• Availability: information is accessible when needed by authorized users.

In healthcare, availability can be an immediate safety requirement. A highly confidential system that is unavailable during emergency treatment is not an acceptable system. Security controls must therefore be balanced with clinical continuity, usability, and emergency access.

8. Enterprise information-risk management

Risk management is a continuous process of identifying threats and vulnerabilities, estimating potential effects, selecting controls, accepting or transferring residual risk, and monitoring change. It should include intentional threats such as ransomware and insider misuse, accidental events such as misdirected disclosure, systemic failures such as poor interfaces, and strategic risks such as dependence on a single vendor.

A commonly used risk expression is:

This is a prioritization model, not a physical law. Probability and consequence must be defined consistently, and the model may be inadequate for low-probability catastrophic events, correlated failures, or uncertainty that cannot be represented by a single score. A risk register should record assumptions and confidence, not just a numerical rating.

A hospital risk cycle includes:

1. Establish context: define assets, services, stakeholders, legal duties, and risk appetite.
2. Identify: map data flows, dependencies, threats, vulnerabilities, and hazards.
3. Analyze: assess likelihood, impact, detectability, exposure, and existing controls.
4. Evaluate: compare residual risk with approved tolerance.
5. Treat: avoid, reduce, share, or accept risk with named authority.
6. Monitor: track indicators, incidents, audit findings, and environmental change.
7. Communicate: escalate material risks and maintain transparent records.

Treatment should be layered. Preventive controls include strong authentication, secure configuration, staff training, and data minimization. Detective controls include logging, anomaly monitoring, reconciliation, and audit. Corrective controls include incident response, recovery, patient notification, remediation, and learning.

Resilience and incident response

A mature hospital maintains tested continuity plans for downtime, cyberattack, infrastructure failure, supplier outage, and data corruption. Plans should specify clinical prioritization, paper or offline procedures, communication, alternate systems, data reconciliation after recovery, and decision authority. Backups must be protected from the same compromise as production systems and restoration must be tested rather than assumed.

Incident response normally includes preparation; detection and triage; containment; eradication; recovery; notification; and post-incident learning. The response should preserve evidence while restoring safe care. Blaming an individual too early can obscure design failures such as excessive privileges, inadequate staffing, or unsafe workflows.

9. Governance of vendors, interoperability, and cloud services

Hospitals often depend on suppliers for electronic records, imaging, laboratory systems, cloud hosting, analytics, identity services, and connectivity. Outsourcing processing does not outsource accountability. Before procurement, the hospital should assess:

• data location and cross-border transfer;
• subcontractors and fourth-party dependencies;
• security architecture and independent assurance;
• breach and vulnerability notification;
• service continuity and recovery objectives;
• data portability and exit assistance;
• retention, deletion, and verification of deletion;
• intellectual-property and model-training rights;
• audit access and regulatory cooperation;
• accessibility, interoperability, and clinical safety.

Interoperability creates value but expands the attack surface and may propagate errors. Governance should define authoritative sources, matching rules, terminology management, reconciliation responsibilities, and procedures for correcting data exchanged across organizations.

10. Illustrative case: an automated deterioration-alert system

Background

A regional hospital introduces an algorithm that identifies inpatients at risk of clinical deterioration. The system uses vital signs, laboratory results, nursing observations, and utilization history. It produces a risk score displayed in the electronic record and sends alerts to a clinical escalation team.

Problem

After deployment, the hospital observes fewer alerts for patients who have limited English proficiency and for patients transferred from smaller affiliated hospitals. A retrospective review finds that these groups have more missing observations and different documentation patterns. Clinicians also report alert fatigue, while some staff treat the score as a definitive diagnosis.

Analysis

The issue is not only a model-performance problem. It involves data quality, workflow design, fairness, clinical safety, transparency, and accountability. Missingness is not random: it reflects documentation practices and access conditions. If the model interprets missing data as low risk, it may systematically under-prioritize patients who are already underserved.

The governance committee should examine subgroup sensitivity, false-negative rates, calibration, and the clinical consequences of missed alerts. It should review the reference outcome, retrain or redesign inputs where justified, and test the model on data from each participating site. It should also examine whether alerts are reaching the right team and whether users understand that the model supports rather than replaces professional judgment.

Approach and solution

The hospital pauses automatic escalation for the affected workflow while maintaining manual clinical observation. It establishes a multidisciplinary review involving clinicians, data scientists, privacy and safety officers, patient representatives, and the vendor. Corrective measures include improved documentation support, explicit missingness indicators, external validation, subgroup monitoring, alert-threshold revision, user training, and a visible explanation of the score’s limitations. A human override and escalation route are documented. The contract is amended to require version disclosure, incident cooperation, performance reporting, and approval before material model changes.

Outcome

In a subsequent controlled evaluation, detection improves for the previously under-represented groups, while alert volume becomes manageable. The hospital continues monitoring rather than declaring the model permanently safe. A quarterly report covers performance, subgroup differences, overrides, adverse events, data drift, and user feedback.

Learning points

1. A technically accurate average score can still be unsafe or inequitable.
2. Data quality is inseparable from clinical safety and fairness.
3. Human oversight must be meaningful, not merely nominal.
4. Vendors require governance throughout the lifecycle, not only at procurement.
5. Deployment approval should include monitoring, review thresholds, and retirement criteria.

11. Building a mature HIS governance program

A hospital seeking maturity should proceed in stages. First, identify critical information assets, services, legal obligations, and accountable owners. Second, establish a cross-functional governance council with authority to approve standards and escalate unresolved risks. Third, create policy instruments: data classification, access, retention, consent, secondary use, algorithmic assurance, incident response, vendor management, and clinical safety. Fourth, implement measurable controls and evidence repositories. Fifth, audit performance and learn from incidents, near misses, complaints, and patient experience.

Useful indicators include the proportion of critical assets with named owners; overdue access reviews; high-risk vendor assessments completed; time to detect and contain incidents; backup restoration success; record-matching error rates; unresolved data-quality defects; staff training completion; algorithm performance by subgroup; and safety incidents linked to information systems. Metrics should support decisions rather than reward superficial compliance.

A mature culture has several characteristics: leaders discuss information risk in clinical and strategic forums; staff can report concerns without retaliation; patients receive understandable explanations; technical and clinical teams share responsibility; controls are tested; exceptions are documented; and governance adapts as technology and social expectations change.

Challenges and limitations

Governance frameworks have limitations. Legal compliance can become a checklist that misses ethical harms. Excessive access restrictions can obstruct care. De-identification can create false confidence. Risk scores can conceal uncertainty behind precise numbers. Independent committees may lack technical expertise, while technical teams may lack community representation. Global cloud and research collaborations create conflicting laws and expectations. Finally, no control system eliminates risk: the objective is informed, proportionate, and accountable risk management.

The most difficult decisions often involve competing goods—privacy versus rapid information sharing, innovation versus precaution, standardization versus local flexibility, and transparency versus security. These conflicts should be made explicit, supported by evidence, reviewed by appropriate authority, and accompanied by mechanisms for appeal and correction.

Contemporary developments

Current governance agendas increasingly include generative AI, synthetic data, federated analytics, digital identity, patient-access applications, remote monitoring, and cross-border data spaces. Generative systems introduce risks of fabricated content, leakage of confidential information, automation bias, and unclear authorship. Synthetic data may reduce direct disclosure risk but can preserve or distort population biases. Federated approaches may limit data movement but do not remove governance obligations at participating sites. Patient-facing applications can improve access while creating new risks through insecure devices, third-party tracking, and misunderstanding of results.

The strategic response is not to prohibit innovation categorically or to accept it uncritically. Hospitals should require use-case justification, proportionality, technical and clinical validation, impact assessment, transparency, monitoring, human accountability, and a practical route to suspend unsafe systems.

Chapter Summary

HIS governance is an enterprise system for directing information assets, assigning decision rights, managing risk, and demonstrating accountability. It integrates board oversight, operational ownership, specialist privacy and security functions, clinical safety, independent assurance, and meaningful patient interests. Data stewardship includes quality, provenance, access, lifecycle, interoperability, and equity—not confidentiality alone.

Ethical HIS governance applies autonomy, beneficence, non-maleficence, justice, dignity, proportionality, and accountability to consent, confidentiality, secondary use, analytics, and automation. Regulation must be translated into operational controls covering lawful processing, rights, retention, vendors, security, breach response, and the evidential integrity of clinical records. Algorithmic systems require purpose definition, representative data, subgroup validation, explainability, human oversight, monitoring, and controlled change.

Enterprise information-risk management identifies hazards, evaluates residual risk, applies layered controls, and maintains resilience through tested continuity and recovery. Outsourcing does not remove accountability. The mature hospital treats information governance as a continuing cycle of assurance, learning, transparency, and improvement.

Key Terms

Governance: The system by which an organization is directed, overseen, and held accountable.

Accountability: The obligation to answer for decisions, actions, and outcomes.

Data stewardship: Responsible management of data quality, access, meaning, use, and lifecycle.

Information asset owner: The person accountable for a defined information asset or service.

Privacy: Appropriate control and protection of information about identifiable people.

Confidentiality: The duty to prevent unauthorized disclosure of entrusted information.

Information security: Protection of confidentiality, integrity, and availability.

Consent: A voluntary and informed agreement to a specified activity or use.

Secondary use: Use of information for a purpose different from its original direct purpose.

De-identification: Reduction or removal of identifiers to lower the risk of linking data to a person.

Clinical safety: Prevention or reduction of harm arising from health technologies and workflows.

Safety case: A structured argument, supported by evidence, that a system is acceptably safe.

Algorithmic fairness: The requirement that algorithmic decisions do not create unjustified or discriminatory disadvantage.

Model drift: Change in data or relationships that reduces model performance after deployment.

Least privilege: Granting only the access necessary for an authorized task.

Break-glass access: Exceptional emergency access subject to logging and review.

Residual risk: Risk remaining after controls are implemented.

Risk appetite: The level and type of risk an organization is prepared to accept.

Data provenance: A record of data origin, transformation, ownership, and use.

Assurance: Systematic evidence that governance, controls, and outcomes are effective.

Review Questions

5 Short Answer Questions

1. Distinguish governance from management in the context of an HIS.
2. What are the three classical objectives of information security?
3. Define secondary use of health data and provide two examples.
4. Why is de-identification not equivalent to guaranteed anonymity?
5. What is the purpose of break-glass access?

5 Long Answer Questions

1. Explain how a hospital can allocate accountability and stewardship for a major electronic health-record system.
2. Discuss the ethical principles that should guide consent, confidentiality, and secondary data use.
3. Describe how clinical safety assurance differs from information-security assurance, and explain why both are necessary.
4. Develop an enterprise information-risk management framework for a hospital dependent on cloud-based systems.
5. Evaluate the governance requirements for deploying an algorithm that prioritizes patients for clinical review.

3 Analytical / Application Questions

1. A staff member accesses the record of a public figure without a care relationship. Analyze the ethical, legal, technical, and managerial responses required.
2. A hospital experiences ransomware that disrupts medication administration systems. Construct an incident-response and clinical-continuity plan, including post-incident learning.
3. An analytics model performs well overall but has substantially more false negatives for a minority population. Recommend whether deployment should continue and justify the controls, evidence, and decision criteria required.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes accountability from responsibility in HIS governance?

A. Accountability concerns technical expertise, while responsibility concerns legal compliance.

B. Accountability is answerability for outcomes, while responsibility concerns performing assigned activities.

C. Accountability belongs only to the IT department, while responsibility belongs to clinicians.

D. Accountability and responsibility are identical in all governance arrangements.

Correct Answer: B. Accountability is answerability for outcomes, while responsibility concerns performing assigned activities.

Question 2

Which control most directly applies the principle of least privilege?

A. Giving every employee access to the full patient database

B. Allowing users to share one departmental password

C. Granting access only to information necessary for an authorized role

D. Removing all audit logs after access is granted

Correct Answer: C. Granting access only to information necessary for an authorized role

Question 3

Which statement about secondary use of health data is most accurate?

A. It is always prohibited unless every patient gives new written consent.

B. It requires no review if the data are held by a hospital.

C. It should be assessed for purpose, necessity, proportionality, legal basis, and potential harm.

D. It is automatically anonymous whenever names are removed.

Correct Answer: C. It should be assessed for purpose, necessity, proportionality, legal basis, and potential harm.

Question 4

In the formula Sensitivity = TP ÷ (TP + FN), what does FN represent?

A. False negatives

B. False notifications

C. Final numbers

D. False non-users

Correct Answer: A. False negatives

Question 5

Why may a model with acceptable average accuracy still be unsafe?

A. Accuracy is never relevant to clinical systems.

B. It may perform poorly for important subgroups or be used outside its validated context.

C. All accurate models eliminate the need for clinicians.

D. Average accuracy proves that data quality is irrelevant.

Correct Answer: B. It may perform poorly for important subgroups or be used outside its validated context.

Question 6

Which of the following is primarily a clinical safety hazard?

A. A delayed laboratory result caused by an interface failure

B. A password-expiration reminder

C. A completed staff-training certificate

D. A documented retention schedule

Correct Answer: A. A delayed laboratory result caused by an interface failure

Question 7

What is the main purpose of a safety case?

A. To market a software product to hospitals

B. To provide an evidence-supported argument that a system is acceptably safe in a defined context

C. To replace all clinical judgment with automation

D. To guarantee that no future incident can occur

Correct Answer: B. To provide an evidence-supported argument that a system is acceptably safe in a defined context

Question 8

Which statement best describes residual risk?

A. Risk before any controls are applied

B. Risk transferred to a patient without disclosure

C. Risk remaining after controls have been implemented

D. Risk that has been eliminated completely

Correct Answer: C. Risk remaining after controls have been implemented

Question 9

A vendor hosts a hospital’s patient data in the cloud. Which governance principle applies?

A. Outsourcing processing removes the hospital’s accountability.

B. The vendor alone determines all retention and deletion requirements.

C. The hospital remains accountable and must govern security, continuity, access, and data use contractually.

D. Cloud hosting automatically makes the data public.

Correct Answer: C. The hospital remains accountable and must govern security, continuity, access, and data use contractually.

Question 10

Which response is most appropriate when an algorithm has substantially more false negatives for a minority group?

A. Ignore the difference because overall performance is acceptable.

B. Remove all human oversight to improve consistency.

C. Investigate data and workflow causes, validate subgroup performance, and apply corrective controls before or during controlled deployment.

D. Publish the model without documenting its limitations.

Correct Answer: C. Investigate data and workflow causes, validate subgroup performance, and apply corrective controls before or during controlled deployment.