Developing a comprehensive IT governance framework for Iranian hospitals: a fuzzy Delphi approach

Purpose This study proposes a comprehensive IT governance framework aimed at effectively managing hospital IT departments, ensuring alignment with healthcare objectives, implementing risk management strategies, measuring performance and fostering continuous service improvement to enhance operational efficiency. Design/methodology/approach The research utilizes the fuzzy Delphi method, selecting eleven experts in health IT governance and management based on their expertise within the Iranian healthcare context. Participants evaluated the relevance and effectiveness of various frameworks on a scale from 1 to 10, enabling a nuanced understanding of their applicability in real-world settings. Findings The fuzzy Delphi method revealed that COBIT scored the highest at 9.57, indicating its strong alignment with evaluated criteria in IT governance for healthcare, followed by frameworks like ITIL, ISO 27 K, ISO 22301 and ISO 9001. In contrast, frameworks such as TOGAF, CMMI and PRINCE2 showed relative weaknesses. This study highlights the necessity of integrating established IT governance frameworks to improve healthcare delivery in Iranian hospitals. By adopting a tailored approach that includes COBIT, ITIL, ISO 27 K, ISO 20 K, ISO 9001 and ISO 22301, healthcare organizations can enhance IT service delivery, ensure compliance and optimize resource allocation, ultimately leading to better patient outcomes and organizational efficiency, guiding healthcare managers and policymakers in developing ICT strategies. Research limitations/implications From a theoretical standpoint, the findings emphasize the need for hybrid IT governance frameworks in healthcare, combining domain-agnostic standards (e.g. COBIT, ISO 27001, ITIL) with healthcare-specific priorities like continuity (ISO 22301) and quality management (ISO 9001). This approach addresses a gap in the literature by advocating contextual adaptability over rigid models, challenging assumptions that healthcare requires entirely novel frameworks. Practical implications For healthcare leaders, this translates to adopting a multi-framework strategy – integrating COBIT for compliance, ISO 22301 for resilience, ISO 27001 for security, ITIL for service management and ISO 9001 for process standardization. Originality/value This article appears to be original and significant as it provides detailed insights into health IT governance and management from the perspective of professional experts.