Hospital Medical Equipment Data Security Governance: A Grounded Theory Informed Data Lifecycle and Governance Matrix Protocol

This article describes a reproducible governance protocol for hospital medical equipment data security grounded in qualitative evidence. From August to October 2024, we conducted semi-structured interviews with 48 stakeholders across 14 tertiary public hospitals in S City. Transcripts were analyzed using grounded theory procedures (Strauss and Corbin: open, axial, and selective coding), yielding 360 reference points, 149 initial concepts, 39 categories, 27 main categories, and 7 core categories. Building on the National Health Commission of the People's Republic of China's safety and quality management agenda and adopting the SQ (I SPORT) matrix logic as an organizing scaffold, we developed a Medical equipment data security audit and tracking protocol based on grounded theory (M-ATSSPD). The protocol operationalizes a matrix that maps six data lifecycle stages (Acquisition, Transmission, Storage, Sharing, Processing, and Disposal) to six governance domains (Organization and Personnel, Metadata, Compliance and Policies, Monitoring and Audit, Incident Response, and Technical Tooling). It specifies scoring anchors (0-3), evidence mapping rules, and heat map visualization to identify high-risk cells, prioritize corrective actions, and support iterative improvement without vendor dependence. The protocol further defines cell-level ownership and documentation requirements to strengthen cross-departmental coordination, compliance readiness, and incident preparedness, and provides guidance for transferability across public hospital settings.