Follow ethical codes protecting confidentiality

I have a memorandum outlining a new confidentiality protocol that must go to the ethics committee and then HR by Monday for sign‑off. Send the memo to Dr. Singh in ethics and then to Karen in HR, in that order, with a Monday deadline. Before sending, confirm the memo names who has access to each data class, lists retention periods, and includes the reporting channel for breaches; return it only if those three elements are explicit.

Before I present this confidentiality protocol to HR, make it easier to accept: surface who can access identifiable data and why, put the breach reporting steps as a bulleted flow with names and phone numbers, show retention periods in a single table, and flag any areas that require legal review so a busy reviewer can approve quickly.

I sent the draft protocol to legal and they replied asking whether incident reports will be anonymized before storage. I worry saying yes could block investigations; saying no risks exposing staff. What is the defensible practice here that balances investigations and confidentiality, and what concise wording should I give counsel to close this point today?

Across several policies we keep losing time because legal adds control requirements late, forcing rework and stakeholder frustration. I usually draft then hand off. Which upstream habit change reduces legal rework most: involve counsel earlier on scope, add a legal checklist to each draft, or run a short legal pre‑review for high‑risk items? Recommend one clear change and why it will stick.