Compliance is seen mainly as a costly inconvenience in many organizations.
I mentioned how some organizations with obvious Health Insurance Portability and Accountability Act (HIPAA) compliance issues seem uninterested in putting forth the effort to resolve them. Some won't even acknowledge they have issues. Ben shrugs and matter-of-factly says, "Nobody cares about HIPAA."
That took a minute to soak in, but I got his point. Knowing Ben, I knew his comment was not literal, it was for effect. But generally speaking, he has a strong point. In the greater scheme of many businesses, HIPAA (and other regulations) are commonly seen by management and staff as annoyances and as another meaningless expense.
Some organizations make only token efforts toward compliance, and those efforts are typically the least that can be done for the least cost. There is often an incomplete, one-time effort to "get compliant," but after that, nothing much more.........
A common course of action by this type of leadership is usually one of three approaches: postpone, ignore, or delegate. The Full article can be found here as the writer explores these three approaches:http://www.darkreading.com/blog/232602668/nobody-cares-about-hipaa.html?itc=edit_stub