The Role of Data Protection and Data Governance in Digital Health Transformation. Evidence from a stakeholder questionnaire on trust, data quality, privacy and governance.
Abstract
Digital transformation in healthcare is increasingly dependent on electronic medical records (EMRs), interoperable information systems, analytics and other data-driven technologies. However, digitisation does not automatically create trust. Trust depends on whether health information is accurate, appropriately accessed, securely processed, transparently governed and protected throughout its lifecycle. This article analyses responses from a stakeholder questionnaire on "From EMRs to Trusted Healthcare: Data Protection and Data Governance in Digital Health Transformation." The questionnaire received 30 responses from participants spanning healthcare leadership, clinical care, information technology, data protection, research and other healthcare-related roles. The findings show a strong awareness of data governance, but also reveal important institutional gaps. Data quality and accuracy was the most frequently identified governance area requiring improvement (40%), followed by staff training and awareness (36%), access controls and permissions (33.3%), and privacy and consent practices (33.3%). Unauthorised access to patient records and inaccurate or incomplete patient information were the leading data protection concerns, each reported by 71% of respondents. Nearly half of respondents (46%) selected stronger privacy and security controls as the first priority for trusted digital transformation, while 40% prioritized data quality and accuracy. The findings support a governance model in which privacy, security, data quality, workforce capability, accountability and interoperability are treated as mutually reinforcing components of digital health maturity. The article concludes with a practical framework for healthcare organisations seeking to move from EMR adoption to trusted, responsible and sustainable digital health.
Keywords: electronic medical records; digital health; data protection; data governance; healthcare data quality; privacy; interoperability; Nigeria; trust.
1. Introduction
Healthcare systems are becoming increasingly data-driven. EMRs and related digital platforms can improve continuity of care, support clinical decision-making, strengthen reporting, enable population health management and create opportunities for research and innovation. Yet the value of digital health depends not only on technology. It depends on the quality of the information captured, the legitimacy and transparency of its use, the competence of the people who handle it, and the governance mechanisms that determine who may access, change, share and retain it.
The World Health Organization (WHO) has emphasised that an interoperable digital health ecosystem should enable secure exchange of health information while protecting privacy and preventing inappropriate use. WHO's current Global Strategy on Digital Health has been extended through 2027, reinforcing the continuing international emphasis on people-centred, equitable and trustworthy digital transformation. In Nigeria, the Nigeria Data Protection Act (NDP Act) 2023 provides the legal foundation for protecting personal data and promoting fair, lawful and accountable processing. The Act also places obligations on organisations to implement appropriate technical and organisational measures for security, integrity and confidentiality.
The questionnaire analysed in this article was designed to explore how healthcare and digital health stakeholders perceive trust in EMRs, data protection risks, governance responsibilities, workforce capability and priorities for improvement. Rather than treating data protection as a purely technical issue, the findings provide evidence for a broader organisational perspective: trusted healthcare data requires the alignment of people, processes, technology, policy and accountability.
2. Methodology
A descriptive cross-sectional analysis was undertaken using the responses exported from the questionnaire platform. The dataset contained 30 respondents. The questionnaire included multiple-choice questions, rating items and open-ended questions. Descriptive frequencies and percentages were used for categorical responses. For the EMR trust question, the questionnaire platform reported an average score of 3.54 on a five-point scale.
Several questions allowed respondents to select more than one option. Consequently, percentages for those questions represent the proportion of respondents selecting each option and may sum to more than 100%. Open-ended responses were reviewed thematically and consolidated into recurring themes such as accountability, staff capability, transparency, policy enforcement, data quality, privacy and security.
Because the sample was small and appears to be a stakeholder convenience sample, the results should not be interpreted as statistically representative of all healthcare organisations in Nigeria. Instead, they should be viewed as an exploratory stakeholder evidence base that identifies practical governance issues worthy of further investigation.
3. Respondent Profile and Governance Familiarity
Figure 1. Distribution of questionnaire respondents by professional role.
The respondent group was multidisciplinary. Data, privacy, security and compliance professionals represented the largest group (36%), followed by IT/digital/information systems professionals (21%). Healthcare leadership and clinical/care delivery each represented 14%, while research/education/public health and other healthcare-related roles each represented 7%. This mix is important because trusted digital health cannot be achieved by one professional group alone; clinical, technical, governance and managerial perspectives need to be integrated.
Familiarity with data governance was relatively high: 60% described themselves as very familiar and 17% as extremely familiar, while 23% were moderately familiar. No respondent selected 'not at all familiar' or 'slightly familiar'. This suggests that the findings largely reflect respondents who already have meaningful exposure to digital health or healthcare data governance.
Table 1. Familiarity with healthcare data governance (n=30).
| Familiarity level | Respondents | Percentage |
|---|---|---|
| Moderately familiar | 7 | 23% |
| Very familiar | 18 | 60% |
| Extremely familiar | 5 | 17% |
4. Trust in EMRs: A Moderate Foundation That Requires Strengthening
Respondents rated their trust in their organisation's protection of information in EMRs at an average of 3.54 out of 5. Most respondents selected a mid-to-high rating: 46% gave a score of 3, 23% gave 4, and 23% gave 5, while 8% gave the lowest score of 1. The pattern indicates that trust exists but is not uniformly strong. A mean of 3.54 should therefore be interpreted as a signal of moderate confidence rather than evidence of mature assurance.
Table 2. Trust in organisational protection of EMR information (n=30 responses recorded for this item).
| EMR protection trust score | Respondents | Percentage |
|---|---|---|
| 1 | 3 | 10% |
| 3 | 15 | 50% |
| 4 | 6 | 20% |
| 5 | 6 | 20% |
The above results showed, in practical terms, that stakeholders may accept the benefits of EMRs while remaining uncertain about whether access controls, data quality processes, incident management and accountability are sufficiently robust.
5. What Threatens Trust Most? Privacy and Data Quality
Figure 2. Most frequently selected data protection risks. Multiple responses were permitted.
Two concerns dominated the responses: unauthorised access to patient records (71%) and inaccurate or incomplete patient information (71%). This pairing is particularly significant. It demonstrates that stakeholders do not view trust solely through the lens of cybersecurity. Trust is also a data quality issue. A secure record that contains inaccurate, incomplete or poorly coded information can still lead to unsafe decisions, administrative errors, inappropriate analytics and loss of confidence.
Accidental disclosure or data loss and lack of staff awareness/training were each selected by 36% of respondents. Excessive access by authorised users was identified by 29%, sharing with third parties by 21%, and unclear consent by 14%. These findings point to the need for a defence-in-depth approach that combines identity and access management, least-privilege principles, workforce education, privacy-by-design, data quality controls, audit trails and incident response.
6. Data Governance Priorities: Quality, People, Access and Privacy
Figure 3. Governance areas identified as needing the most improvement. Multiple responses were permitted.
Data quality and accuracy was selected by 40% of respondents, making it the strongest governance concern in the survey. Staff training and awareness followed at 36%. Access controls and permissions and privacy and consent practices were each selected by 33.3%. Policies and standards and interoperability/data sharing were each selected by 30%, while monitoring, auditing and oversight was selected by 27%.
Table 3. Areas of data governance requiring improvement (n=30; multiple responses permitted).
| Governance area | Respondents | Percentage |
|---|---|---|
| Data quality and accuracy | 12 | 40% |
| Staff training and awareness | 11 | 36% |
| Access controls and permissions | 10 | 33.3% |
| Privacy and consent practices | 10 | 33.3% |
| Policies and standards | 9 | 30% |
| Interoperability and data sharing | 9 | 30% |
| Monitoring, auditing and oversight | 8 | 27% |
| Clear ownership and accountability | 6 | 20% |
| Incident response and reporting | 6 | 20% |
The result challenges a common assumption that the main obstacle to trusted digital health is simply the availability of technology. Respondents placed human capability and information quality at the centre of the governance challenge. This aligns with WHO's emphasis that effective digital health requires integrated organisational, financial, human and technological resources, and that strong governance is necessary for interoperability, data quality and evidence-informed decision-making.
7. Organisational Barriers: Resources and Capability Matter
Table 4. Perceived barriers to stronger data protection and governance (n=30).
| Barrier | Respondents | Percentage |
|---|---|---|
| Limited funding/resources | 10 | 33.3% |
| Lack of skilled staff | 10 | 33.3% |
| Unclear policies/regulations | 4 | 13.3% |
| Resistance to established practices | 4 | 13.3% |
| Limited leadership support | 1 | 3.3% |
| Other barrier | 1 | 3.3% |
Limited funding/resources and lack of skilled staff were joint leading barriers, each selected by 33.3% of respondents. Unclear policies/regulations and resistance to established practices each accounted for 26.6%. These findings reinforce the argument that compliance and governance programmes need sustainable investment and institutional ownership.
Healthcare organisations should therefore avoid treating data protection as an unfunded add-on to digital projects. Governance requirements should be included in project budgets, procurement specifications, workforce plans, vendor contracts, training programmes, risk registers and performance indicators from the outset.
8. Workforce Confidence: The Human Factor in Data Protection
Table 5. Confidence that staff know how to handle health data safely (n=30).
| Confidence level | Respondents | Percentage |
|---|---|---|
| Slightly confident | 3 | 10% |
| Moderately confident | 10 | 33.3% |
| Very confident | 8 | 26.6% |
| Extremely confident | 8 | 26.6% |
| Insufficient information to judge | 1 | 3.3% |
Only 53.2% of respondents were very or extremely confident that staff know how to handle health data safely, while 33.3% were slightly or moderately confident. This is one of the most actionable findings. Technology can enforce controls, but staff behaviour remains central to privacy and security. Training should therefore move beyond one-off awareness sessions to role-based, recurring education supported by policies, simulations, clear escalation channels and monitoring.
9. What Should Organisations Do First?
Figure 4. Respondents' first priority for trusted digital health transformation.
Stronger privacy and security controls emerged as the leading first priority (46%), followed by improved data quality and accuracy (31%), improved staff training and awareness (15%), and clearer accountability and governance (8%). No respondent selected public/patient trust, safer interoperability, legacy modernisation or oversight/transparency as the first priority.
The result should not be interpreted to mean that other priorities are unimportant. Rather, it suggests that stakeholders see privacy and security as the immediate foundation upon which wider digital health transformation should be built. Once appropriate safeguards are in place, organisations can expand data sharing and interoperability with greater confidence.
10. What Stakeholders Said in Their Own Words
The open-ended responses reinforce five recurring themes:
- Accountability and transparency: respondents called for clear responsibility, transparent data access and consequences for misuse.
- Competence and professional capacity: several responses emphasised training, regular reorientation and ensuring that appropriately skilled professionals lead digital health processes.
- Data quality: standardised clinical coding, accurate documentation and regular audits were identified as practical mechanisms for improving trust.
- Policy enforcement: respondents highlighted the need for enabling laws, clear policies, standards and enforcement rather than relying on policies that exist only on paper.
- Organisational ownership: respondents stressed that data protection is not merely an IT responsibility; it is an organisational responsibility requiring leadership, clinical, administrative, technical and governance participation.
One particularly important message from the responses is that digital health governance should be multidisciplinary. The clinical voice is essential, but it should operate alongside health information management, data protection, cybersecurity, IT, legal, records management, quality improvement and leadership functions. Trusted transformation is more likely when responsibilities are explicit and decisions are based on competence, evidence and defined governance structures.
11. Discussion: From Digitisation to Trust
The survey suggests that the transition from EMRs to trusted healthcare requires a shift in mindset. The objective should not be simply to replace paper with software. Instead, organisations should build a trusted information environment in which data is fit for purpose, protected throughout its lifecycle, available to authorised users, and governed in a way that respects patients' rights.
First, data protection and data quality are inseparable. If records are inaccurate, incomplete or inconsistent, interoperability may simply transmit poor information more efficiently.
Second, security must be matched with usability. Excessively broad access increases privacy risk, but poorly designed restrictions can disrupt clinical workflows. Role-based access, least privilege, segregation of duties and periodic access reviews provide a more balanced approach.
Third, accountability must be operational. Organisations need named owners, documented responsibilities, audit trails, breach response procedures, vendor oversight and measurable compliance indicators. The NDP Act 2023 reinforces this organisational responsibility by requiring appropriate technical and organisational measures for security, integrity and confidentiality of personal data. For health organisations, this should be embedded into governance rather than treated as a separate compliance exercise.
Fourth, interoperability should be pursued responsibly. WHO recognises that secure health-data exchange can contribute to continuity and quality of care, but such sharing should operate within appropriate legal, privacy, security and accountability safeguards. The goal is therefore not maximum data sharing; it is appropriate, secure and purposeful data sharing.
12. A Practical Trusted Digital Health Governance Framework
Table 6. Recommended governance framework for moving from EMRs to trusted healthcare.
| Domain | Priority actions |
|---|---|
| 1. Leadership & accountability | Assign executive ownership; define controller/processor roles; establish governance committees and accountability metrics. |
| 2. Privacy & legal compliance | Maintain privacy notices, lawful processing bases, data subject rights processes, DPIAs where required, retention rules and vendor safeguards. |
| 3. Cybersecurity & access | Apply RBAC/least privilege, MFA where appropriate, encryption, logging, backups, incident response and periodic access reviews. |
| 4. Data quality | Standardise data definitions and coding; validate completeness/accuracy; establish data quality indicators and routine audits. |
| 5. Workforce capability | Provide induction and recurring role-based training; test awareness; establish escalation and reporting channels. |
| 6. Interoperability & sharing | Use standards-based interfaces; document data-sharing agreements; verify purpose, legal basis, security and recipient controls. |
| 7. Monitoring & assurance | Conduct internal audits, risk assessments, DPIAs, breach exercises and management reviews; track corrective actions. |
13. Recommendations for Healthcare Decision-Makers
- Make privacy and security a design requirement. Every new EMR, telemedicine, analytics, AI or interoperability initiative should incorporate privacy and security requirements before procurement and deployment.
- Establish a formal data governance structure. Define who owns data, who may access it, who approves sharing, who manages quality and who is accountable when something goes wrong.
- Prioritise data quality as a patient-safety and governance issue. Introduce data quality standards, validation rules, clinical coding standards, routine audits and corrective-action processes.
- Implement continuous workforce development. Training should be role-specific for clinicians, health information managers, administrators, IT personnel, researchers, vendors and executives.
- Strengthen access management. Apply least privilege, role-based access, periodic access reviews, strong authentication and audit logging, with special attention to privileged users.
- Operationalise privacy and consent. Ensure that patients receive understandable information about how their data is collected, used and shared, and that rights and complaints mechanisms are accessible.
- Govern third-party and cloud processing. Contracts should address confidentiality, security controls, sub-processors, incident notification, data location/transfer, retention, deletion and audit rights as applicable.
- Measure trust and governance maturity. Establish a dashboard covering data quality, access-control exceptions, training completion, incidents, response times, DPIA completion, audit findings and remediation.
- Build interoperability progressively. Share data when there is a clear purpose, appropriate legal and governance basis, adequate security and a defined responsibility structure.
- Keep the patient at the centre. Digital health transformation should ultimately improve care and public value while protecting dignity, privacy, autonomy and trust.
14. Conclusion
The questionnaire provides a concise but important picture of the trust challenge surrounding digital health. Respondents are generally familiar with data governance, yet they identify significant weaknesses in data quality, workforce capability, access control, privacy practices and policy implementation. The leading risks of unauthorised access and inaccurate or incomplete information show that trustworthy digital health requires both protection and reliability.
Trusted healthcare will not be achieved by deploying more EMRs alone. It requires a deliberate governance architecture in which technology, people, policy, security, privacy, data quality and accountability reinforce one another. For healthcare organisations in Nigeria and similar settings, the immediate opportunity is to move from compliance as a paperwork exercise to governance as a measurable organisational capability.
The central message is simple: digital health creates value when people can trust the data, the systems and the institutions responsible for them. Trust should therefore be treated not as the final outcome of digital transformation, but as a foundational design principle.
15. Limitations
- The sample size was small (n=30), limiting statistical generalizability.
- The questionnaire appears to use a stakeholder/convenience sample; sampling bias may therefore be present.
- Several questions permitted multiple responses, so percentages cannot be summed to estimate a single distribution.
- Open-ended responses were thematically synthesised for this article; qualitative coding was descriptive rather than independently validated.
- The findings reflect respondent perceptions and should be complemented by objective audits, technical assessments, DPIAs, incident data and data-quality measurements.
Appendix A. Key Questionnaire Results at a Glance
Table 7. Selected headline findings.
| Indicator | Result |
|---|---|
| Respondents | 30 |
| Very/extremely familiar with data governance | 71% |
| Mean EMR protection trust | 3.54 |
| Unauthorized access concern | 71% |
| Inaccurate/incomplete data concern | 71% |
| Data quality needs improvement | 86% |
| Staff training needs improvement | 79% |
| Access controls need improvement | 71% |
| Privacy/consent needs improvement | 71% |
| First priority: privacy/security | 46% |
References
- Federal Republic of Nigeria. (2023). Nigeria Data Protection Act, 2023. Nigeria Data Protection Commission. ndpc.gov.ng
- Nigeria Data Protection Commission. (2023). NDP Act 2023. ndpc.gov.ng/ndp-act-2023
- Nigeria Data Protection Commission. (n.d.). Frequently Asked Questions. ndpc.gov.ng/faqs
- World Health Organization. (2025). Global strategy on digital health 2020–2027. WHO. who.int
- World Health Organization. (2025). Strategy for optimizing national routine health information systems: strengthening routine health information systems to deliver primary health care and universal health coverage. WHO. who.int
- World Health Organization. (2021). Ethics and governance of artificial intelligence for health: WHO guidance. WHO. who.int
- World Health Organization. (2025). Health data governance in the age of artificial intelligence: policy imperatives for the WHO European Region. WHO Regional Office for Europe. who.int
