Information governance is described as which of the following?

• A. An organization-wide framework for managing information throughout its lifecycle and supporting strategy, operations, regulatory, legal, risk, and environmental requirements
• B. A set of encryption standards
• C. A patient consent procedure
• D. A hardware management protocol

Answer: (A)

Information governance is an organization-wide framework that governs information across its entire lifecycle—from creation and use to retention and disposal—and aligns how information is managed with the organization's strategy and operations while meeting regulatory, legal, risk, and environmental requirements. This means establishing policies, standards, roles, and accountability; ensuring data quality, privacy, and security; managing metadata and data classification; setting retention and disposal rules; and enabling audits and oversight. Because it covers the full scope of information management and ties it to compliance and risk management across the whole organization, it best captures how information should be governed, not just a single control or procedure.

The other options describe specific elements rather than the overarching framework. A set of encryption standards is a security control, not governance. A patient consent procedure addresses privacy practices, but not how information is governed across the organization. A hardware management protocol focuses on devices, not the governance of information itself.