FHIR data governance separates deployments that scale from ones that drown in data quality debt. Five practices predict which path a deployment follows.
1. Terminology binding governance. ValueSets pinned to specific SNOMED/LOINC versions. Update cadence documented. Automated regeneration on terminology release.
2. $validate in the write path. Every POST/PUT triggers `$validate`. Failures rejected with OperationOutcome. Upstream systems fix at source.
3. Duplicate detection cadence. MPI systems run duplicate detection nightly. Manual review queue processed within days, not weeks.
4. Reference integrity monitoring. Nightly SQL checks that Observation.subject, Encounter.subject etc. resolve to real Patient resources.
**5. Audit trail via AuditEvent.** Data access, modification, and export tracked. HIPAA compliance depends on this.
Data quality metrics that predict outcomes
| Metric | Healthy | Warning | Critical |
|---|---|---|---|
$validate pass rate |
>97% | 95-97% | <95% |
| Reference integrity | >99% | 97-99% | <97% |
| Duplicate detection queue depth | <100 | 100-500 | >500 |
| Terminology binding compliance | >98% | 95-98% | <95% |
| Audit trail completeness | >99.5% | 98-99.5% | <98% |
Governance investment scale
Sites underinvesting in governance see data quality degrade by ~5% per year. Sites investing (dedicated data governance team, automated monitoring, standard SLAs) maintain quality indefinitely.
Common governance failures
1. No dedicated governance team — quality drifts. 2. Manual $validate review — regressions slip through. 3. Unversioned terminology — code drift. 4. Reference integrity ignored — analytics broken. 5. Audit trail incomplete — compliance risk.
FHIR data governance is not glamorous but pays back for years. The five practices above cover most of the difference between clean and dirty deployments.