Developing And Implementing Data Policies And Standards To Manage Data .

The Components of the Enterprise Data Governance ProgramEstablish and develop theorganizational hierarchy of businessand technology representativesPeopleEstablish Data Governancepolicies for data management(e.g., outbound data sharing)Establish processes fordata management (e.g.,data issuetracking/resolution, dataquality monitoring, datasharing, etc.)StandardsPoliciesProcessIdentify and establish technology bestpractices and methods for improvingdata management 2016 Walgreens Boots Alliance. All rights reserved.Componentsof theEnterprise ablish standards for master &reference data, metadata,classification, accessibility, etc.Establish businessmetrics for monitoringand measuring overallbusiness impact .Provide the communication,collaboration, socialization,and training for supportingprogram across the enterprise.20

Customized Enterprise Information ManagementFramework for WalgreensData GovernanceUnstructuredDataManagementMaster Data &Reference DataManagementDataWarehousingData QualityManagementData SecurityManagementData IntegrationManagementData DeliveryManagement 2016 Walgreens Boots Alliance. All rights reserved.Data Structure and FrameworkStructured DataManagementData Model/ClassificationMetadata ManagementData ContextPolicies, Processes, Standards; Organization, andStewardship21

Developed Enterprise PartnershipsHIPAA AssetRisk &CostPatientHealth 2016 Walgreens Boots Alliance. All rights reserved.Stewardship Compliance Policy Data Monetization Data Security Data Privacy (HIPAA) Data Quality MDM, RDM Education and tion Business andTechnicalStewards22

Enterprise Information Management FrameworkDefined Formal Role DescriptionsData Governance Steward RolesExecutive Stewards Member of the Data Governance Executive Committee. Provides strategic data management direction to the Data Governance programbased on knowledge of business strategy and business areas priorities.Enterprise Stewards Member of the Data Governance Committee. Provides broad operational data management support for enterprise data management issuesand policy requests across all business areas. Ensures data management approaches and methods are done consistently across the Provides approval authority for adoption of Enterprise Data Governanceenterprise.policies, standards, and processes. Provides primary development, update, & enforcement support for DG policies, standards, & Provides input and approval of targeted projects for the fiscal year. Provides input and approval for targeted data domain priorities.processes as either a member of the DGC or a sub-committee. Provides insight, knowledge, and endorsement for adoption of international, national andindustry data standards in a timely manner. Provides guidance, direction, and support for funding of Data Governance Provides or recommends canonical data structures that can be leveraged by the enterprise.initiatives. Provides endorsement of proposed Enterprise Data Governance policies, standards, and Communicates and promotes the Data Governance program throughout theprocesses that will be presented to EDGEC for approval. Identifies and presents potential data issues, from their department/business unit, to the DGCorganization.for review and resolution. Typically at a Divisional Vice President level or above. Communicates and promotes the Data Governance policies, standards, and processesthroughout their business area. Typically at a manager level or above or a subject matter expert.Operational Stewards Member of the Data Governance Stewardship Organization. Provides data insights from both a business operations perspective andapplicability to relevant data governance issues. Identifies and presents potential data issues and requests from theirDomain Stewards Member of a specific Data Domain Team. Provides operational data management support for a specific enterprise data domain (e.g.,Customer, Location).department/business unit, to the Data Governance Office for review andresolution. Aligns with enterprise data management approaches and methods. Provides insight and endorses the adoption of international, national, and Provides expertise and insight into the operational data management challenges specific toindustry data standards within the business area in a timely manner.the data domain, as a subject matter expert. Communicates and promotes Data Governance policies, standards, and processes Provides insights and endorses the adoption of international, national, and industry datathroughout the business area.standards for the specific data domain (e.g., logical master data record) in a timely manner. Provides guidance for aligning business area data usage with Enterprise Data Provides or recommends canonical data structures that can be leveraged by the enterpriseGovernance policies, standards, and processes.for the specific data domain. Provides service account management on critical systems or those containing Communicates and promotes the Data Governance policies, standards, and processesconfidential Information.throughout their business area. A business data expert representing a business area. Identifies and presents potential data issues, from their department/business unit, to theDomain Team and the DGO for review and resolution. A subject matter expert for the specific subject area. 2016 Walgreens Boots Alliance. All rights reserved.23

Governance Structures and Partnerships24 2016 Walgreens Boots Alliance. All rights reserved.

Data Governance OrganizationStrategy and Prioritiesfor policies andstandards set at theexecutive or DGCCommittees.Standards workcompleted byData DomainTeams, or SMEs& Advisors. 2016 Walgreens Boots Alliance. All rights reserved.Policy workcompleted atthe subcommitteelevel.25

Enterprise Partnerships: Who Should You Include in Policy andStandard Work?CommitteeChairHIPAA /PrivacyDataGovernanceData,Metadata, DataQualityStandardsPersonalBusiness andTechnicalStewardsMonetizationLegalDataAssetRisk &CostVendorCollaboration 2016 Walgreens Boots Alliance. All rights reserved.PatientHealthLegalData Classification orSensitivity; Legal,Privacy, Security,Risk ConcernsRiskManagementInformationSecurity26

Recommended: Data Governance Policy Sub-Committee(s) Functional Maturity: Committee may start bymaking recommendations for policies andenforcement. As the function matures, it may beappropriate for enforcement to be authoritative. Escalation / Exceptions: Depending on the policy,escalation and exceptions may be to the DataGovernance Executive Committee, to an ExecutivePolicy Committee, or to another Cross FunctionalExecutive Committee. Metrics: Tracking metrics on policy enforcementassists with maturation of function. Range of Authority and Responsibility: Whatdata? Test? Production? Vendor? Data at Rest? Inmotion? Structured? Unstructured? E-mail? Wikis,blogs? Verbal? 2016 Walgreens Boots Alliance. All rights reserved.DataGovernanceData GovernancePolicy SubcommitteePolicy EscalationCommitteeData GovernanceInformationSecurityInformationSecurityIT Risk &ComplianceCustomer Loyaltyand InsightsHuman ResourcesIT Risk &ComplianceCompliance andPrivacyCompliance andPrivacyRisk ManagementFinanceData Governance27

Set Clear Boundaries on PartnershipsData Governance does not own, but may be involved in conversations on: Interpreting compliance, privacy, HIPAA, and other laws and regulations. Establishing protection methods for data assets. Interpreting legal and contractual issues. Monetizing data. Performing a formal data risk assessment. Determining data retention. Setting practices for test data. Deciding if data can be shared and with whom. 2016 Walgreens Boots Alliance. All rights reserved.28

Data Governance Models: Structure to Synergize with Your OrganizationIncreasing ability to enforce policies and FunctionalFunctionalFunctionalFunctional areas operate withcomplete autonomy. Can choose toimplement selected policies andstandards to meet specific enterpriserequirements, but are not required to.Governance by influence is the norm.DGEnterpriseResponsibility and ownership are sharedbetween functional areas and theenterprise. Data Governance has theauthority to enforce certain policies andstandards enterprise-wide, but not all.Governance by influence still needed.FunctionalDGFunctionalFunctionalData Governance provides a single pointof control and decision making, withfunctional areas having little or noauthority and responsibility. Most datapolicies and standards are fully enforcedat an enterprise level. Governance isauthoritative.It is fine to fully enforceon some things, butonly do limitedenforcement on others. 2016 Walgreens Boots Alliance. All rights reserved.2929

Data Governance Models: Aligning Policies with Your ModelIncreasing ability to enforce policies and Governance by Influence: Recommend adherence of projects,systems, and processes tostandards. Roles, responsibilities areguidelines. Determine what data is enterprise,and influence as much as possible. If legal or regulatory, alFunctionalShared Responsibility and Ownership: Some recommendation, someenforcement of policies, standards,processes. Roles, responsibilities can be partiallyenforced, or guidelines. Increased governance of enterprisedata. Can set up departmental governanceefforts. If legal or regulatory, enforce 2016 Walgreens Boots Alliance. All rights onalSingle Point of Control (Governanceis Authoritative): Enforced policies and standards forenterprise data. Enforced Data Governanceprocesses, roles, and authority. Role in information managementlifecycle can be authoritative. Compliance with legal and regulatoryenforced consistently.3030

Data Governance Policies31 2016 Walgreens Boots Alliance. All rights reserved.

Data Policies – Some Ideas and PossibilitiesDepending on the culture and the need, Data Governance / Data ManagementPolicies may define: Data classification and sensitivity. Data Sharing Rules (Inbound, Outbound, Internal) Adherence of projects, systems, and processes to data governance andinformation management standards. Differentiation between what is enterprise versus departmentally governed. Rules of engagement for Data Governance, including definition of the eligibility,training required, roles, and responsibilities of data owners and stewards. Application Software Package Acquisition as a Components of the InformationResource Lifecycle Defined Quality Standards for Acquired External Information Others.Always considercorporate cultural andpolitical realities 2016 Walgreens Boots Alliance. All rights reserved.32

Data Classification Policy Provides guidelines for business decision-making regarding theclassification or sensitivity of information. Works together with applicable Information Security Policies, HIPAA /Privacy Policies, Risk, and Legal Policies and Practices to govern andprotect customer, patient and business information.Data Governance:Information Security:Guidelines for DataClassificationTechnological andAdministrative Implications“What”“How” Confidentiality Technical or Business Sensitivity Regulatory - HIPAA / Privacy Global considerations by country and region 2016 Walgreens Boots Alliance. All rights reserved. Guidelines for controls and processes basedon classification Compliance with Information Security Policy33

Data Classification Policy – Sample LevelsMoreRestrictedAccessLessRestrictedAccess 2016 Walgreens Boots Alliance. All rights 4

Data Classification Policy : Additional Considerations Pyramid Levels: Higher levels of pyramid determined byregulatory and privacy concerns; and by businesssensitivity. Consistent Enforcement: Pyramid should be enforcedconsistently for the entire enterprise, as much aspossible. This may need to be phased in. Global Considerations: Levels may vary when appliedoutside of the U. S. due to legal and regulatoryconcerns, such as E.U. Privacy laws. Do not assume thatlevels determined for domestic use will apply globally.Work with attorneys to determine. Integrated Effort: Development and enforcement of thispolicy will be heavily integrated with other areas of thefirm: Privacy, Risk, IT Risk Management, IT Security. Synergies: Policy can have synergies with non-datagovernance policies and practices: IT Risk Management,IT Security, Privacy, Regulatory, Legal. Functional Alignment : Other functions align andleverage policy enforcement, such as data monetizationand records retention. 2016 Walgreens Boots Alliance. All rights reserved.35

Data Classification Policy : HIPAA Privacy Rule Deidentification MethodsUnder HIPAA, protected health information canbe de-identified two ways: Safe Harbor: Remove 18 identifiers from thedata. This option can render the data largelyuseless for business purpose but will protectprivacy. Expert Determination: Certification from anexpert that there is a low probability the datacan be used to re-identify an individual. Theexpert determination method does notrequire all 18 identifiers to be removed fromthe data. Data is looked at holistically by thestatistician to determine whether it can be deidentified based on all factors.Work with your Privacy Office to determine best practice. Method chosen may affectclassification level and thus security protocols. . 2016 Walgreens Boots Alliance. All rights reserved.36

Data Classification Policy : De-Identification Standards –HIPAA Statistical MethodA person with appropriate knowledge of and experience withgenerally accepted statistical and scientific principles andmethods for rendering information not individuallyidentifiable: Applying such principles and methods; determines that therisk is “very small” that the information could be used, aloneor in combination with other reasonably availableinformation by an anticipated recipient to identify anindividual who is a subject of the information; and Documents the methods and results of the analysis thatjustify such determination 2016 Walgreens Boots Alliance. All rights reserved.37

Data Classification Policy : De-Identification Standards HIPAA Safe HarborSafe Harbor Direct Identifiers and Quasi-identifiers1. Names2. All geographicsubdivisions smaller thana state, except for thefirst 3digit of zip code3. All elements of dates(except year)4. Telephone numbers5. Fax numbers6. Electronic mail addresses7. Social security numbers8. Medical record numbers9. Health plan beneficiarynumbers10. Account numbers11. Certificate/licensenumbers 2016 Walgreens Boots Alliance. All rights reserved.12. Vehicle identifiers andserial numbers,including license platenumbers13. Device identifiers andserial numbers14. Web UniversalResource Locators(URLs)15. Internet Protocol (IP)address numbers16. Biometric identifiers,including finger andvoice prints17. Full face photographicimages and anycomparable images;18. 18. Any other uniqueidentifying number,characteristic, or code38

Data Sharing Policies: Outbound, Inbound, InternalProvides guidelines for business decision-making regarding the sharing orexchanging of customer, patient, and business information.Comply withApplicable Policiesand Procedures Data Classification Policy Information Security Policies HIPAA / Privacy and Legal Policies Business Area Policies and Procedures Contractual ConsiderationsConsider the Needto Share Is there a business need to share the data? What is the minimum necessary?Consider the Risk 2016 Walgreens Boots Alliance. All rights reserved. Comply with Risk Management procedures Consider the party with whom the data will be shared (e.g. vendorcapabilities, offshore location) Compliance with retention and purge policies39

Data and Information Management Policies – GuidingPrinciples What you develop should be tuned to yourprogram’s focus areas and goals Develop only what you need to make yourprogram successful Not everything is a policy - Considerleaving some policies as guidelines,charters, or education and trainingBusinessObjectivesEIM GoalsEIM ProgramFrameworkCorporateStructure andCulture Consider what will have the most impact If it is legal or regulatory, you must enforceuniformly. But that is the only case weknow of where that is true. 2016 Walgreens Boots Alliance. All rights reserved.Avoid the politicalnightmare of beingseen as a restrictiveburden rather than auseful program. Sellfirst, then police if youhave to.40

Policy Development & Enforcement41 2016 Walgreens Boots Alliance. All rights reserved.

Structuring Policies: Align with Enterprise Policy Standards Introduction Purpose Scope Governing Bodies Compliance Main Section Policy Details Appendices Supporting Policies andStandards Glossary Appendix 2016 Walgreens Boots Alliance. All rights reserved.For standard policy sections, alignand integrate with: Established, related policyconventions, format,language, implementationmethods Related policy content Policies can specifically referto each other, therebystrengthening acceptance andenforcement by the enterprise(e.g. Info Security, Privacy,Data Governance, EIM,Business, IT)42

Data Governance Policy - More Details, a TemplatePolicy NamePurpose:State Purpose of policy: For Example, from a Data Exchange Policy: This policy provides guidance on theminimal qualitative characteristics and information specifications of information acquired from external sourceseither through purchase (e.g., vendor) or exchange to meet business or technical requirements.ScopeState Scope: Data and People policy applies to: For example: This policy applies to all customer and businessinformation in all formats (both paper and electronic). This standard applies to all employees, contractors, andagents.Governing BodiesSpecify group(s) for policy management: develop, approve, application, escalation, variance / exception.ComplianceSpecify how to comply, and ramifications if not complied with . For example : Discipline, up to and includingdismissal.Policy DetailsSpecific policy details and requirements.Supporting Policiesand StandardsList all supporting and related policies and standard

Walgreens Boots Alliance Walgreens Boots Alliance is the first global pharmacy-led, health and wellbeing enterprise in the world. Our purpose is to help people across the world lead healthier and happier lives. Walgreens Boots Alliance was created through the combination of Walgreens and Alliance Boots on 31 December 2014. This transaction