HIPAA is an interesting case in point. HIPAA, or the Health Insurance Portability and Accountability Act, was enacted...
12 years ago, primarily to provide guidelines for the use of electronic medical information. A lot of organizations took many steps to protect patient data in the early part of this decade because they feared the consequences of HIPAA non-compliance. But HIPAA turned out to be a toothless tiger, with very few enforcement actions and less audit scrutiny than expected, so organizations stopped worrying about it.
Then when PCI DSS hit a few years ago, many healthcare groups were behind the curve because they hadn't kept up with their security efforts.
I have no idea what the next big regulatory hurdle will be, but I believe there will be one. That means it's a lot more effective to protect sensitive data regardless of regulatory oversight.
Also, protecting patient data is the right thing to do. A healthcare company's customers trust them with their personal health information; they will be upset and hurt if that data is not protected effectively. The fact that future controls will ensure the audits are passed is beside the point.
Related Q&A from Mike Rothman, Contributor
In the world of security certifications, what is the GISP and how alike is it to the CISSP? In this security management expert response, learn about ...continue reading
Depending on your enterprise, it may or may not be necessary to utilize a QSA. In this security management expert response, learn how to determine ...continue reading
When developing software securely, what role does gap analysis play? In this security management expert response, learn how to implement gap analysis...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.