Ask the Expert

Is it worthwhile for an organization to invest in HIPAA compliance?

There's been speculation that HIPAA can't and isn't being enforced, meaning organizations that fail to meet its requirements are unlikely to be caught and even more unlikely to face penalties. Is it still worthwhile for an organization to invest in HIPAA compliance?

    Requires Free Membership to View

I don't think it's useful for an organization to invest in compliance. Organizations should invest in security and sometimes justify those investments via a compliance requirement.

HIPAA is an interesting case in point. HIPAA, or the Health Insurance Portability and Accountability Act, was enacted 12 years ago, primarily to provide guidelines for the use of electronic medical information. A lot of organizations took many steps to protect patient data in the early part of this decade because they feared the consequences of HIPAA non-compliance. But HIPAA turned out to be a toothless tiger, with very few enforcement actions and less audit scrutiny than expected, so organizations stopped worrying about it.

Then when PCI DSS hit a few years ago, many healthcare groups were behind the curve because they hadn't kept up with their security efforts.

I have no idea what the next big regulatory hurdle will be, but I believe there will be one. That means it's a lot more effective to protect sensitive data regardless of regulatory oversight.

Also, protecting patient data is the right thing to do. A healthcare company's customers trust them with their personal health information; they will be upset and hurt if that data is not protected effectively. The fact that future controls will ensure the audits are passed is beside the point.

More information:

This was first published in June 2008

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: