Building a data governance operating model

The CFO's finance system answers these one way. The clinical quality system answers them another. Neither is wrong. They are measuring different things and calling both "LOS."

A data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → operating model exists to make those choices explicit, documented, and enforced so one number means one thing everywhere.

The three components you actually stand up

A working governance model in a hospital has three moving parts. You do not need a 40-page framework. You need these three to function.

1. The data stewardshipdata stewardshipA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → council

A data stewarddata stewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → is a named person accountable for the meaning and quality of a specific data domain, not the IT plumbing, the meaning. Stewards are usually senior operational staff, not engineers.

Structure it in two layers:

• Executive sponsor layer: typically the CMIO (Chief Medical Information Officer) and CFO or their delegates. They resolve disputes and fund fixes.
• Domain steward layer: one steward per domain. Common hospital domains: patient encounters, providers, diagnoses/procedures (coding), scheduling, revenue cycle, and clinical quality measures.

The council meets on a fixed cadence (monthly is typical) and owns one job: approving definitions and resolving conflicts when two departments disagree on what a metric means.

Keep it small. A council of 8 to 10 stewards works. A council of 40 people is a mailing list, not a decision body.

2. The definition catalog

This is your source of truth for what every metric means. Also called a business glossary or data dictionary. Modern tools that do this include open-source OpenMetadata and commercial platforms, but a well-maintained spreadsheet beats an unused expensive tool.

Each entry needs, at minimum:

| Field | Example for "Inpatient LOS" |

|---|---|

| Definition | Discharge datetime minus admission-order datetime, in midnights crossed |

| Inclusions | Formal inpatient admissions only |

| Exclusions | Observation stays, ED-only visits, newborns (see Newborn LOS) |

| Source system | Epic Clarity, ADT tables |

| Owner (steward) | Director of Patient Flow |

| Certified date | 2026-01-15 |

| Version | 2.1 |

The exclusions row is where the real work lives. Most definition fights are about what you leave out.

3. The metric certification workflow

A certified metric is one the council has reviewed, approved, and locked. Certification is a status, like a stamp, that tells everyone "this number is safe to put in a board deck."

A simple workflow:

1. Proposed: a team drafts a definition and its calculation logic.

2. Reviewed: the domain steward and one downstream consumer (for example, the finance analyst who uses LOS) confirm it fits their use.

3. Certified: the council approves. The definition is versioned and published in the catalog.

4. Monitored: automated quality checks run against it.

5. Deprecated: when a definition changes, the old version is retired with a date, never silently overwritten.

The rule that makes this stick: only certified metrics appear in executive reporting. If it is not certified, it carries a visible "draft" label. This one policy does more than any tool.

Governance metrics: measuring the governance itself

Governance without measurement drifts into theater. Track a handful of concrete metrics.

• Definition coverage: what percent of metrics used in board and regulatory reports are certified? A reasonable maturity target is 90 percent or higher for regulatory reports.
• Time to certify: median days from "proposed" to "certified." If this exceeds a few weeks, teams route around governance.
• Steward assignment rate: percent of critical data domains with a named, active steward. Aim for 100 percent of critical domains.
• Data quality pass rate: percent of automated checks passing (see below).

These are the metrics your Data lens module cares about: not profit, but the health of the data supply chain feeding every other number.

A worked example: closing the LOS gap

Suppose finance reports LOS at 4.2 and quality reports 4.9. The steward runs the numbers side by side.

The gap resolves instantly: finance includes observation stays (which are short and pull the average down); quality counts inpatients only. Neither number was "wrong." They answered different questions.

The governance fix is not to pick a winner. It is to certify two distinct metrics with two distinct names: LOS_All_Encounters and LOS_Inpatient. Each deck must state which one it uses. The confusion never returns because the ambiguity has a name.

Regulatory pressure that makes this non-optional

Governance is not just hygiene. In the US, hospitals report quality measures to CMS (the Centers for Medicare and Medicaid Services) through programs like the Hospital Inpatient Quality Reporting program. Misstated measures affect reimbursement and public Care Compare ratings. Patient data itself is governed by HIPAA (the Health Insurance Portability and Accountability Act).

In Europe, the GDPR (General Data Protection Regulation) governs personal health data, and the European Health Data Space regulation, which entered into force in 2025 with phased application, pushes standardized health data definitions and reuse across member states. Both regimes assume you can say precisely what your data means and where it came from. A definition catalog is how you prove it.

Making it survive contact with reality

Councils die from three predictable causes. Design against each.

Cause 1: too many metrics. Do not try to certify everything. Start with the 20 to 30 metrics that appear in board decks and regulatory submissions. Those are where disagreement costs the most.

Cause 2: no teeth. If uncertified numbers still reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → the board unlabeled, no one respects certification. The reporting policy must be enforced by whoever owns the deck template.

Cause 3: catalog rot. A definition catalog that is not maintained becomes a graveyard. Tie each definition to a steward and a review date. Definitions with no review in 12 months auto-flag for the council.

Automated quality checks

Certification defines what a metric means. Quality checks confirm the underlying data supports it. Simple, high-value checks for hospital data:

• Completeness: percent of encounters with a non-null discharge datetime.
• Validity: discharge datetime is never earlier than admission datetime.
• Timeliness: admission records land in the warehouse within an agreed window (for example, 24 hours).
• Uniqueness: no duplicate encounter IDs from ADT (Admission, Discharge, Transfer) feeds.

Run these nightly. Route failures to the domain steward, not a generic inbox. The pass rate becomes one of your governance metrics above.

Key Takeaways

• One metric, one meaning. The core deliverable is certified definitions where inclusions and exclusions are written down, so LOS means the same thing in every room.
• Three parts, not forty. A small stewardship council, a maintained definition catalog, and a certification workflow are enough to fix most disagreement.
• Enforce with one rule. Only certified metrics appear unlabeled in executive and regulatory reporting. This single policy gives governance its teeth.
• When two numbers disagree, name both. Often neither is wrong. Certify them as distinct, clearly named metrics rather than forcing a false winner.
• Measure the governance itself. Track definition coverage, time to certify, steward assignment, and data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → pass rate. Regulators (CMS, HIPAA, GDPR, EHDS) increasingly assume you can prove what your numbers mean.