These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- GRC for Healthcare and Hospitals
- Data model and import order
The tables behind GRC for Healthcare and Hospitals
GRC for Healthcare and Hospitals ships with 15 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 15
- Features
- 6, plus shared settings
- Change it
- Add fields and tables in Proto
How the model is organised
Assessment planning:
Organizations, business units, team members and Assessments define the scope, period and accountable owner.
Risks and controls:
Risks and Controls connect the business-unit exposure to a named control owner.
Control testing:
Assessment tests connect one control to one assessment and record sample results.
Findings and remediation:
Findings, corrective actions and Retests keep the exception, response and independent outcome separate.
Care compliance reviews:
Care compliance reviews and review decisions record facility context and revision-specific judgement.
Evidence and operations:
Record attachments and operation receipts preserve files and operation outcomes against the assessment.
Every table, by feature
- Assessment planning5
- Risks and controls4
- Control testing4
- Findings and remediation5
- Care compliance reviews4
- Evidence and operations4
- Shared and settings1
- Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Organizations
Legal and operating organizations governed by this workspace.
- Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls
- Risks
Risks held against a business unit on an explicit likelihood and impact scale.
Linked to Business units, Team members - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users
- Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members
- Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Corrective actions
Remediation actions assigned to a finding owner with due dates and evidence.
Linked to Findings, Team members - Retests
Independent retests that decide whether a finding may be closed.
Linked to Findings, Team members - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members
- Care compliance reviews
Care and facility compliance reviews covering privacy and access exceptions.
Linked to Assessments, Organizations - Review decisions
Independent reviewer decisions recorded against an assessment revision.
Linked to Assessments, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Organizations
Legal and operating organizations governed by this workspace.
- Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members - Operation receipts
Idempotent execution receipts for guarded operations on assessments.
Linked to Assessments - Review decisions
Independent reviewer decisions recorded against an assessment revision.
Linked to Assessments, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units
Keys and references
Keep the assessment parent on each test, review, attachment, decision and operation receipt. A finding points back to its assessment and tested control; its action and retest point to the finding. Team member references establish ownership and reviewer attribution. Preserve stable identifiers and revision values during migration so earlier decisions remain explainable.
Migration order
- Load Organizations, Users and team members with their organization links.
- Load business units, then Risks and Controls with their owners.
- Load Assessments and their period, owner and business-unit references.
- Load assessment tests, care compliance reviews and record attachments against the correct parent.
- Load Findings, corrective actions, Retests, review decisions and operation receipts, then reconcile links and status history.
Set up GRC for Healthcare and Hospitals your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.