Who is responsible for configuring and governing Care Everywhere data-sharing policies?

• A. The privacy officer at a single site
• B. External auditors
• C. The patient data owner
• D. The sending and receiving organizations' Epic administrators, privacy/data governance roles, and site policies

Answer: (D)

Care Everywhere sharing is controlled through the collaboration of the sending and receiving organizations. The people who configure the sharing rules in Epic, manage privacy and data governance, and implement the policies at each site—i.e., the Epic administrators on both sides plus the designated privacy/data governance roles and the organization’s site policies—are the ones responsible for establishing and enforcing how data is shared. External auditors play a monitoring role to ensure compliance, not to set or govern the policies. The patient owns their data and can influence consent, but they do not configure cross‑organization sharing policies; that governance rests with the organizations and their designated roles.