For health system corporate and shared services
Nothing here touches clinical judgement, a coverage decision, medical necessity, or anything that affects a patient’s care. The system-office problem is different and entirely administrative: four sites doing one process four ways, each convinced theirs is correct, and no measurement anybody accepts as neutral.
The transactions happened. The name on the building changed, the finance function consolidated, and the organisation chart shows one company. Underneath it, four scheduling practices, four intake processes, four ways of handling a referral, and four sets of people who have done it that way for two decades.
The system office owns the mandate to standardise and has no operational authority over the sites. It can convene, publish, recommend and fund, and it cannot direct — every change is a persuasion campaign against people who have local credibility the corporate office does not.
And the local view is usually not wrong. A process that looks like variation from the system office is frequently an adaptation to a real local condition — a different payer mix, a different referral pattern, a rural catchment, a physical building that does not permit the standard flow. Corporate initiatives fail most often by standardising away an adaptation that was load-bearing.
So the argument is unresolvable without measurement everybody accepts, and the measurement does not exist. Each site reports through its own definitions, which were also inherited, so a comparison between them compares two different things and everybody knows it.
Meanwhile the patient experiences the seams. A referral between two hospitals in the same system moves like a referral between competitors, because the systems and the practices behind it still are.
A system office cannot distinguish variation that exists for a real local reason from variation that is only history, so standardisation is argued rather than decided — and the arguments are won by whoever is most persuasive rather than by what is true.
That is why so many integration programmes deliver a standard nobody follows. The standard was chosen without knowing which of the four practices was adapted to something real, and the site that was adapting quietly keeps doing what works.
So the first act is a measurement designed to be accepted rather than to win an argument: the same administrative process at each site, decomposed the same way, with the definitions agreed by the sites before anything is measured. Elapsed time by step, wait between steps, rework, handoffs, and where each site’s path actually differs.
That decomposition usually shows something more useful than "site C is slower". It shows that site C has an extra approval step that exists because of a payer relationship the others do not have, and that site A’s speed comes from a workaround that will not survive an audit. Both are actionable and neither was visible.
What can then be carried is the administrative band inside a site that agrees to it — the referral chase, the completeness check, the scheduling logistics, the reconciliation report. Site by site, granted by that site, revocable by that site, exactly as the county page describes for elected offices and for the same structural reason.
What never moves: clinical judgement, medical necessity, coverage determination, triage or acuity assignment, and anything affecting a patient’s care. Those belong to clinicians, and nothing here is near them.
Comparability between sites — measured by whether the same process is decomposed identically at each site, with definitions the sites agreed in advance.
Variation attributable to a real local condition — measured by count of differences the sites can attach to a specific payer, catchment or facility constraint, versus those they cannot.
Elapsed time on the shared administrative process — measured by time by step and wait between steps, per site, against each site’s own baseline.
Referral movement inside the system — measured by elapsed days for an internal referral to reach a scheduled appointment, per site pair.
Rework in shared services — measured by count of items returned upstream, by originating site and reason.
Workarounds that would not survive an audit — measured by count of process steps performed outside the documented path, found by the decomposition rather than by an audit.
any clinical judgement, medical necessity determination, coverage decision, triage or acuity assignment, prior authorisation outcome, or anything affecting a patient’s care. Nothing here ranks or prioritises patients by any characteristic or prediction, and nothing here decides which site’s practice is correct — that is a decision for the system office and its clinicians.
Access is granted per site and reaches only that site’s systems. Cross-site visibility exists only where every site involved has granted it, because a corporate arrangement that could see a site’s records without that site’s agreement is one no site will cooperate with — and cooperation is the whole constraint here.
It reads the electronic record, the scheduling system and the referral system through documented interfaces, and creates no second record of a patient or an encounter.
Where a proposed measurement would require clinical content that is not needed to time an administrative step, that access is not requested. The decomposition is about elapsed time and handoffs, not about what a clinician decided.
And where HIPAA obligations apply through a Business Associate Agreement, they apply. No certification is claimed and none exists to hold — HHS does not certify business associates, and a vendor implying otherwise has told you how carefully they read.
The measurement only works if the sites accept it, and they will not accept one whose definitions were set by corporate. So the definitions are agreed by the sites before anything is measured, and the sites see the same output the system office sees — an asymmetry there destroys the whole exercise on the first disagreement.
Patient information stays inside your tenancy, on your retention schedule, exportable by you, and is not used to train anything serving another organisation.
HIPAA obligations apply where a Business Associate Agreement exists; no certification is claimed, and none exists to hold. Where a state law is stricter, it governs and is agreed in writing.
And on assurance: an independent SOC 2 Type II attestation is in progress and no report exists yet.
The site executives are the actual approvers even where the system office is the buyer, and a programme that treats them as recipients will fail. Each site grants its own access and can withdraw it alone.
The privacy officer’s question is minimum necessary, and the honest answer is that clinical content beyond what is required to time an administrative step is not requested at all.
Compliance will ask what happens when the decomposition finds a workaround. It gets reported to the site and to compliance as a finding — which is a reason some sites will not want the measurement, and that is worth surfacing before it starts rather than discovering it as resistance.
And the system office should decide in advance what it will do with a finding that a site’s variation was justified, because the answer to that determines whether anybody cooperates the second time.
One shared administrative process at two sites, decomposed identically, with the definitions agreed by both sites before anything is measured and no authority to change anything.
Two sites rather than all of them, and definitions first, because the failure mode here is not measurement error — it is a measurement nobody accepts. Agreeing the decomposition in advance costs a week and is what makes the output usable.
The finding is usually that the difference is smaller than corporate believed and attached to something more specific than either side expected. Both halves of that are useful and neither requires anybody to be wrong.
If it continues, the first grant is one administrative act at one site that asked for it, revocable by that site, with everything clinical outside the scope document.
Frequently, and that is why the definitions are agreed by the sites first and the sites see the same output the system office sees. An asymmetric measurement is a weapon and it will be treated as one. The other half is what the system office commits to in advance: if the decomposition shows a site’s variation was a real adaptation, does the standard change? If the answer is no regardless of the finding, the measurement is theatre and the sites are right to resist it.
Then the scope should be built so it does not need most of it. Timing an administrative step needs the step and its timestamps, not the clinical content, and content beyond that is not requested at all. Where a Business Associate Agreement is required it applies in full; where your privacy officer concludes even the minimum is too much, that closes the scope and that is a legitimate outcome rather than something to negotiate around.
If that is true, it is the most important finding available and it costs a week to establish. Sites that cannot agree how to describe a process are not going to agree on a standard for it, and no measurement will resolve that — the constraint is governance rather than data. Discovering it before an integration programme is spent is worth considerably more than the programme.
Often true, and a consolidation is a different and much larger project than anything on this page. What the decomposition can tell you is how much of the observed variation is actually attributable to the systems versus to the practices around them — which is worth knowing before committing to a consolidation, because some of the difference usually survives it and the business case rarely accounts for that.