A domestic healthcare provider has informed IT governance that it is updating its strategy to...

From an EGIT perspective, expanding telemedicine internationally changes the enterprise’s compliance, accountability, and oversight obligations. The primary governance concern is conflicting (or non-aligned) legal and regulatory requirements across countries—covering patient privacy, health data residency/cross-border transfers, medical licensure, clinical accountability, record retention, consent, and security expectations. Telehealth regulation is widely recognized as non-uniform across jurisdictions, meaning what is permitted in one country may be restricted or require different controls in another.

While infrastructure scalability (B) and data sensitivity classification (D) are important management concerns, they are secondary to ensuring the strategy is legally viable and compliant in every target jurisdiction. Similarly, updating risk tolerance (C) may be needed after assessing the regulatory and operational impacts, but governance must first address whether the enterprise can operate lawfully and demonstrate compliance across borders. In COBIT/EGIT terms, this is tightly linked to governance’s duty to monitor compliance and progress against plans and to set direction considering stakeholder needs and external obligations—especially acute in healthcare where privacy and safety requirements are strict.