/policies/,/policies/administrative/,/policies/administrative/uwmf/,/policies/administrative/uwmf/uwmf-wide/,/policies/administrative/uwmf/uwmf-wide/information-services/,

/policies/administrative/uwmf/uwmf-wide/information-services/ad-pol-002.policy

20180131

page

100

UWHC,UWMF,

Policies,Administrative,UWMF,UWMF-wide,Information Services

Change Review and Management (AD-POL-002)

Change Review and Management (AD-POL-002) - Policies, Administrative, UWMF, UWMF-wide, Information Services

AD-POL-002




Administrative Departmental Policy
This department-specific policy applies to the operations and staff of the Information Services
Department of the University of Wisconsin Hospitals and Clinics Authority as integrated effective July 1,
2015.
Policy Title: IS Change Review and Management
Policy Number: AD-POL-002
Effective Date: 11/15/17
Chapter: N/A
Version: Revision
I. PURPOSE
The intent of the IS Change Review and Management policy is for the authorization,
prioritization, tracking, and reporting of changes to UW Health Information Services (IS)
systems, and their environments, to ensure that changes are made in a controlled and
authorized manner.

Following this policy should maintain the stability and availability of the systems supported by
UW Health Information Services, and allow for improved data analysis, tracking, auditing, and
problem resolution.

Violators of this policy and supporting procedure are subject to disciplinary action.

II. SCOPE
This policy applies to all production computing systems and platforms that are supported by UW
Health Information Services and all those making any production changes. This policy may apply
to non-production systems at the direction of IS Management.

Out of Scope: This policy does not apply to some tasks performed by UW Health Information
Services. These include:
• Changes to non-production systems (unless otherwise directed by IS Management)
• Changes made within daily administrative processes, including:
o Password resets
o User record modifications
o Provider record modifications
o Routine fixes of system errors that does not result in underlying system change

III. DEFINITIONS

Change: Any addition, deletion, modification, installation, or removal of a component,
application, or configuration that may ultimately alter or affect any UW Health IS supported
system.




Change Database: The application used to track change requests, the change request approval
process, the change review process, and the application of changes to systems.

Change Type: Classification that determines the requirements for approving and implementing
a change.

Standard:
• Changes of this type occur regularly, are repeatable, and are low risk
• Requires an approved Standard Change Template

Normal:
• Non-trivial changes to services, applications, and infrastructure
• Additional approvals may be required as dictated by IS management
• Represents some risk to business operations
• Must have peer approval complete prior to the agenda creation time for the
CAB meeting
• Must receive CAB approval prior to implementation

Emergency:
• Change necessary to address imminent risk to patient safety, data integrity, or
security
• Change necessary in response to loss of critical business or patient services
• Requires at least verbal approval from IS Management prior to implementation
• Change documentation may be completed post implementation
• Requires same approvals as Normal change

Informational:
• Used to document changes performed by vendors on their systems, which may
impact UW Health services

Impact: The potential effect that a Change may have on the business.

StakeStakeholder Communications: Communication to appropriate stakeholders about any
change implementation is a requirement of the change process. Management may dictate
defined processes per group or system as deemed necessary.

Standard Change Template: An approved template documenting the process used to
implement a specific change.

Recurring Change: A change that is scheduled to occur at specific times with regular frequency,
such as weekly server reboots.

Impact Definition
High Affects major portion of the organization
Medium Affects an entire team / department
Low Will have little or no harmful consequence on the business or clinical operations



Risk: The potential for a change to have adverse effects on UW Health systems, business,
patients, and/or the user population.

Low Risk:
• Little to no chance of failure
• Successfully repeated on a regular basis in the past
• A reversal or removal of the change is easily accomplished

Medium Risk:
• Requires coordination with other departments and/or teams
• New functionality
• May have been repeated in the past, but on an irregular basis
• A reversal, removal, or failure of the change could be corrected in less than 2
hours, and does not compromise patient safety, business critical functions, or
regulatory compliance

High Risk:
• Requires coordination with several other departments and/or teams
• Complex build concepts
• Rarely repeated
• A reversal, removal, or failure of the change could result in more than 2 hours of
corrections, and/or compromise patient safety, business critical functions, or
regulatory compliance

IV. POLICY ELEMENTS

Roles and Responsibilities

Change Advisory Board (CAB): Change management decision making authority for UW Health
IS.

Membership:
• Regular members
o Change Manager
o Change Advisor for each area impacted by changes addressed in the
CAB meeting
• Ad hoc members
o Change Owner and/or Change Implementer for change requests on the
meeting agenda
o Non-IS department representatives as solicited

Responsibilities:
• Evaluate change requests for business need, priority, and potential impacts to
other systems or processes
• Review changes for the proper classifications
• Authorize changes for implementation, or require further analysis, deferment,
or cancellation



• Arbitrate any conflicts in implementation schedules
• Approve standard change templates
• Review unplanned and failed changes to assess their impact, and initiate a Post
Implementation Review when deemed necessary

Change Manager: The person that has overall management responsibility for the Change
Management process, and chairs the IS CAB meetings.

Change Advisor: A person who is able to assess the potential impact of changes on their area of
responsibility, and advise the Change Manager if the change should proceed.

Change Owner: The primary contact for the change, who knows the technical and business
requirements, completes all necessary documentation and communication regarding the
change, and is responsible for ensuring the change is executed, rescheduled, or cancelled in
accordance with the IS CAB review.

Change Implementer: The person responsible for executing the change during the approved
change schedule. Segregation of duties is employed when operationally feasible. The Change
Owner and Change Implementer may be the same person. When they are not the same, the
Change Implementer is responsible for updating the Change Owner on the change status.

V. PROCEDURE
The following procedure supports this policy:

Change Advisory Boards (CAB) and Agenda Information: KB0015109
Change Management Training: KB0014863

VI. FORMS (optional)
N/A

VII. REFERENCES (optional)
N/A

VIII. COORDINATION
Sr. Management Sponsor: UW Health IS CTO
Author: UW Health IS Project Management Director
Reviewer(s): UW Health Internal Auditor
Approval Committee: UW Health IS Directors

SIGNED BY:
UW Health CIO

Revision Detail:




Effective Date Next Review Summary of Changes Change Authors
11/15/2017 11/15/2019 Complete redesign. Change Process Owner Team
8/17/2016 8/17/2017
Replaced procedure
with ServiceNow
training manual.
E. Gerke, S. Juedes
6/11/2015 6/11/2016 Minor updates. E. Gerke, J. Leonard, S. Schroeder
3/18/2015 3/18/2016 Minor updates E. Gerke, J. Leonard
8/12/2013 8/12/2014 Original release. S. Schroeder