Occupations and Terms of Reference › Chief information officer (CIO)
Universal terms of reference · POS-010 · version 1.0 · status: draft · next review 2027-10-27
Chief information officer (CIO)
To make sure information and digital systems are secure, reliable and useful, so that clinical and business decisions are based on accurate information and patient data is protected.
Each part of this page links to the related trainings, competencies and policies. The links are the same for every facility, so an organisation can see at a glance what a role requires and what it is trained in.
Job description
Job summary. You lead information and digital systems. You make sure systems are secure and reliable, that patient and business data is protected, and that information helps staff deliver safe care and make good decisions.
Reports to: Chief executive officer.
Leads or supervises: IT, networks, databases, help desk, health information systems and data protection teams.
What you do on a typical day
- Review system availability, security alerts and service desk priorities.
- Approve changes to critical clinical and business systems.
- Review data protection and access requests with the data protection officer.
- Lead digital projects with clinical and operational leads.
- Review IT spending and supplier performance with the CFO.
- Report information security and system performance to the board each quarter.
Working conditions and demands
- On call for critical system outages.
- Handles confidential patient and staff data.
- Balances security, usability and cost.
What good looks like
- Critical systems are available when staff need them.
- Security incidents are found quickly and handled properly.
- Patient data access is controlled and audited.
- Staff can find the information they need to deliver care.
Place in the organogram
Reporting line, from the top: see the organogram on the Occupations page. The lines above and below this role are listed in section 3.
1. Golden rules
These rules apply in every setting.
- Every decision that affects patient safety is made on evidence and recorded.
- Patient safety and quality come before financial targets; no trade-off that puts patients at risk is accepted.
- Every staff member can raise a concern without fear of reprisal, and every concern is answered.
- Legal, licensing and accreditation duties are known, owned and reviewed.
- Finances, people and information are managed openly and within the law.
- Mandatory training and policies apply to the executive as much as to frontline staff.
2. Identification
| Item | Detail |
|---|---|
| Position code | POS-010 |
| ISCO-08 | 1330 (skill level 4) |
| ESCO | to map |
| Department | Governance |
| Facility types | Hospital, Ambulatory, Transport, Medevac, Fitness, Aesthetic |
3. Reporting line and working relationships
Reports to: POS-003. Supervises: POS-194, POS-195, POS-197, POS-196, POS-199, POS-200, POS-017.
| Works with | Nature of the relationship |
|---|---|
| Chief medical officer | Clinical systems and clinical data. |
| Chief nursing officer | Nursing documentation and systems use. |
| Chief quality and safety officer | Information security and incident reporting. |
| Chief financial officer | IT budget and contracts. |
4. Key accountabilities
| Domain | Accountability | Evidence of delivery | Checked | Linked competencies | Linked trainings | Linked policies | Standards |
|---|---|---|---|---|---|---|---|
| Systems reliability | Makes sure critical systems are reliable and recover quickly from failure. | Critical system availability target met; disaster recovery test completed annually | Monthly | C-01 | T-08 | – | 1, 2 |
| Information security | Runs the information security programme, including access control and incident response. | Security incidents responded to within policy timeframe; access reviews completed | Monthly | C-02 | T-05 · T-07 | POL-DATA · POL-SAFEG | 2 |
| Data protection | Makes sure patient and staff data is protected and used lawfully. | Data protection impact assessments completed; breaches reported on time | Quarterly | C-02 | T-07 | POL-DATA | 2 |
| Clinical information | Makes sure clinical information systems support safe, accurate care. | Clinical system incidents reviewed; documentation audits completed | Quarterly | C-03 | T-05 | POL-DATA | 2 |
5. Decision rights
| The post holder decides | Consults or escalates |
|---|---|
| Technical standards and configurations within the approved framework | Major data breaches (data protection officer, CEO and regulator where required) |
| IT service priorities and changes to non-critical systems | Major system investments or changes to critical clinical systems (CEO and CFO) |
| Access control decisions within policy | Vendor contract decisions above delegated limits |
6. Qualifications and experience
| ID | Qualification | Mandatory | Validity |
|---|---|---|---|
| Q-01 | Degree in computer science, information systems or a related field | Yes | Lifetime |
| Q-02 | Information security or IT service management qualification | Yes | Lifetime |
| Q-03 | Health informatics qualification | No | Lifetime |
| ID | Experience | Minimum years | Mandatory |
|---|---|---|---|
| E-01 | Senior IT leadership, including service management and information security | 8 | Yes |
7. Training requirements
Recommended common practice. Each facility adapts the list to its national law. Essential items apply in every setting; recommended items apply where resources allow.
| ID | Training | Tier | When | Validity | Linked policies | Linked competencies |
|---|---|---|---|---|---|---|
| T-01 | Facility induction | essential | at_entry | Once | POL-WHISTLE · POL-EQUAL · POL-DATA | – |
| T-02 | Safeguarding adults | essential | periodic | Every 3 year(s) | POL-SAFEG | – |
| T-03 | Safeguarding children | essential | periodic | Every 3 year(s) | POL-SAFEG | – |
| T-04 | Data protection and confidentiality | essential | annual | Every 1 year(s) | POL-DATA | – |
| T-05 | Incident reporting and open disclosure | essential | periodic | Every 2 year(s) | POL-INC | C-02 · C-03 |
| T-06 | Governance, accountability and assurance | recommended | periodic | Every 3 year(s) | – | – |
| T-07 | Emergency and major incident command | essential | annual | Every 1 year(s) | POL-INC | C-02 |
| T-08 | Speaking up, inclusion and equality leadership | essential | periodic | Every 2 year(s) | POL-WHISTLE · POL-EQUAL | C-01 · C-04 |
8. Health, fitness and language
| ID | Requirement | Frequency | Tier | Minimum in low-resource settings |
|---|---|---|---|---|
| H-03 | Fitness-to-work assessment at entry and after serious illness or injury | Every 12 months | recommended | Fitness check at entry |
| Language | Level | Mandatory |
|---|---|---|
| Official language of the country of practice | professional | Yes |
| English | working | Yes |
9. Competencies by level
| ID | Competency | Foundation | Practitioner | Expert | Assessed by | Revalidate | Linked trainings |
|---|---|---|---|---|---|---|---|
| C-01 | Digital systems design and management | Operates systems safely | Manages a system in a service | Designs the systems architecture for the organisation | System review | Every 12 months | T-08 |
| C-02 | Information security and data protection | Follows security procedures | Leads security incident response | Designs the security and data protection framework | Security audit | Every 12 months | T-05 · T-07 |
| C-03 | Health information and clinical systems | Uses clinical systems safely | Supports clinical system change | Designs clinical information strategy | Clinical system review | Every 12 months | T-05 |
| C-04 | Leading technical teams and suppliers | Works in a team | Leads a technical team | Leads digital change across the organisation | 360 feedback | Every 24 months | T-08 |
10. Performance evaluation
- Probation: 6 months, with a sign-off review (recommended value).
- Appraisal: every 12 months against the competencies and indicators below.
| ID | Indicator | Target | Data source | Frequency |
|---|---|---|---|---|
| PI-01 | Critical system availability | set by facility | monitoring reports | Monthly |
| PI-02 | Security incidents closed within policy timeframe | 100% | incident register | Monthly |
| PI-03 | Access reviews completed | 100% | access audit | Quarterly |
| PI-04 | Data protection breaches reported within legal timeframe | 100% | breach register | Quarterly |
11. Career ladder and promotion
| Level | Role | Minimum experience to move on | Qualifications | Competency minimums | Trainings required | Assessment |
|---|---|---|---|---|---|---|
| Executive | Chief information officer (CIO) | 8 years (recommended) | Q-01, Q-02 | C-01 expert, C-02 expert | T-07 | Executive appointment and performance review |
12. Policies the post holder follows
Each policy is a standard template that the facility adopts and adapts. Templates are maintained centrally, so every facility works from the same version.
POL-SAFEG · Safeguarding adults and children
Purpose: Protect patients from abuse, neglect and harm, and make sure every concern is recognised and acted on.
Scope: All staff, volunteers and contractors.
Key rules:
Scope: All staff, volunteers and contractors.
Key rules:
- Recognise signs of abuse and neglect and record them factually.
- Report every concern to the designated safeguarding lead the same shift.
- Do not investigate alone.
- Share information only as the safeguarding procedure allows.
POL-DATA · Data protection and confidentiality
Purpose: Keep patient and staff information private, secure and used only for care and legal purposes.
Scope: All staff who access records or systems.
Key rules:
Scope: All staff who access records or systems.
Key rules:
- Access only the records needed for your work.
- Keep records secure; do not leave screens or paper unattended.
- Do not share information without a lawful basis.
- Report any breach to the data protection officer within 24 hours.
Linked trainings: T-10 · Review every 12 months · Template 0.1 (draft)
POL-WHISTLE · Speaking up (whistleblowing)
Purpose: Let staff raise patient safety or conduct concerns without fear of reprisal.
Scope: All staff.
Key rules:
Scope: All staff.
Key rules:
- Raise a concern with your line manager or the named speaking-up officer.
- If that route fails, escalate to the board or the national regulator.
- Retaliation against anyone who speaks up is a disciplinary offence.
- Concerns are recorded, investigated and the outcome given to the person raising them.
Linked trainings: T-01 · Review every 12 months · Template 0.1 (draft)
POL-EQUAL · Equality, diversity and inclusion
Purpose: Give every patient and colleague fair access, respectful treatment and reasonable adjustments.
Scope: All staff and patients.
Key rules:
Scope: All staff and patients.
Key rules:
- Treat every person with dignity regardless of background.
- Make reasonable adjustments, including interpreters, for language and disability.
- Report discrimination through the speaking-up route.
- Monitor access and outcomes by group.
Linked trainings: T-01 · Review every 24 months · Template 0.1 (draft)
POL-INC · Incident reporting and open disclosure
Purpose: Report and learn from incidents and near misses, and tell patients honestly when things go wrong.
Scope: All staff.
Key rules:
Scope: All staff.
Key rules:
- Report every incident and near miss the same shift.
- Give the patient and family an honest account and an apology where appropriate (open disclosure).
- Take immediate action to protect others.
- Learn: contribute to the review and follow the agreed actions.
13. Standards that name this role
14. Record history
| Date | Change | Approved by |
|---|---|---|
| 2026-10-27 | Draft record, batch 1 of the position build | Awaiting approval |