Australia National Pathology Standards (First Edition 2027) 1.08: Information governance: implement interoperable health information systems conformant with national digital health standards and legislation, monitor data quality, keep laboratory information systems lawful, secure and privacy-compliant, run an information security management system with role-based access, protection in transit and at rest, regular vulnerability assessment, reporting to the governing body and data breach response, orient and monitor the workforce, and mitigate patient safety risk from delayed adoption of new digital standards

What does 1.08 require?

Information governance covers systems, security and people. Systems must talk to others and follow the national digital health standards and the law; their output is checked for accuracy, completeness and quality; laboratory information systems stay lawful, secure, privacy-compliant and consistent with other NPAAC requirements. A security management system restricts each user to what their role needs, encrypts data moving and at rest, is tested regularly for weaknesses, tells the governing body about vulnerabilities and failures, and runs the response when data is breached. Staff are inducted into the rules for using the systems and their security duties and are checked for compliance. Where a new or revised digital health standard is slow to be adopted, the patient safety risk of the delay is assessed and reduced. Software that itself interprets or produces diagnostic output may count as IVD software and is handled under Standard 8.