Who Owns the Data When Nobody Owns the Data?

Ask who is responsible for patient data at your practice and listen to the answers.

The front desk says the office manager. The office manager says IT. IT says the software vendor. The vendor says it’s the covered entity, which is you.

Everyone is partly right. Which is how nobody ends up being responsible.

This is the second piece of data governance, after knowing where the data lives: knowing who is accountable for it. Here are four things every owner-doctor should understand about ownership.

Ownership isn’t a job title

Data ownership doesn’t mean the person who does the technical work. It means the person who decides.

Who decides which staff get access to the imaging system? Who decides how long old records are kept? Who decides whether a new AI tool is allowed to touch patient information? Who decides what happens when a laptop goes missing?

If those decisions are being made by whoever happens to be in the room, or by a vendor’s default settings, the practice has no owner. It has a series of accidents that haven’t caused a problem yet.

The owner-doctor is the default owner, whether you like it or not

Here’s the uncomfortable part.

Under HIPAA, the practice is the covered entity. The practice is you. When a breach is investigated, when an insurer questions a claim, when a patient files a complaint, the accountability doesn’t stop at the office manager or the IT provider. It lands on the owner.

Your IT provider is a business associate. Your software vendor is a business associate. They have obligations, and a good one takes them seriously. But they don’t become the owner of your patients’ data by touching it.

You can delegate the work. You can’t delegate the accountability. So the question isn’t whether you own the data. It’s whether you’ve organized the practice so that ownership actually means something.

Three roles that need a name next to them

You don’t need a governance committee. You need three roles, and they can be held by three people or by two.

Write down who holds each:

• The owner: makes the decisions about access, retention, and new tools. Usually the owner-doctor, sometimes shared with a practice administrator.
• The custodian: does the technical work of protecting the data. Encryption, backups, monitoring, patching. Usually your IT provider, sometimes an internal person.
• The access approver: the one person who says yes or no when someone needs access to a system, and who removes it when they leave. Often the office manager.

When these three names exist, questions have somewhere to go. When they don’t, questions go to whoever answers the phone.

Ownership shows up in audits and in breaches

An auditor, an insurance adjuster, or an incident investigator will ask a version of the same question: who was responsible for this?

“Our IT company” is not a satisfying answer if there’s no agreement describing what they’re responsible for. “The office manager” is not satisfying if she was never told that was part of her job. “We assumed the software handled it” is the answer that ends up in the findings.

Named roles, written down and communicated, turn that question into a lookup. They also make the day-to-day better: access requests get answered consistently, offboarding actually removes accounts, and vendor decisions stop being made by whoever got the sales call.

Decide it once. Then it’s decided.

The reason most practices never assign ownership is that it feels like adding a burden to people who are already busy.

In practice it removes one. The office manager stops being asked to make decisions she was never given authority to make. The IT provider stops guessing what the practice wants. And you stop finding out about important choices after they’ve been made.

An hour to name the roles, write them down, and tell the team is enough to start. Keeping it current is the part that needs a habit.

We help practices define who owns what, put it in writing alongside their vendor agreements, and make sure the technical side matches the decisions. It starts with a 10-minute discovery call.

Call us at 405-253-5101 or schedule a discovery call to get on the calendar.