Monday, March 19, 2012

Nobody Cares About HIPAA

Note: Does this describe your organization?  With all the fines, penalties, cost of breaches, I had thought this would change, but that does not appear to be the case. This short article makes the point very well.

http://www.informationweek.com/news/security/government/232602741

Compliance is seen mainly as a costly inconvenience in many organizations.

I mentioned how some organizations with obvious Health Insurance Portability and Accountability Act (HIPAA) compliance issues seem uninterested in putting forth the effort to resolve them. Some won't even acknowledge they have issues. Ben shrugs and matter-of-factly says, "Nobody cares about HIPAA."

That took a minute to soak in, but I got his point. Knowing Ben, I knew his comment was not literal, it was for effect. But generally speaking, he has a strong point. In the greater scheme of many businesses, HIPAA (and other regulations) are commonly seen by management and staff as annoyances and as another meaningless expense.

Some organizations make only token efforts toward compliance, and those efforts are typically the least that can be done for the least cost. There is often an incomplete, one-time effort to "get compliant," but after that, nothing much more.........

A common course of action by this type of leadership is usually one of three approaches: postpone, ignore, or delegate.  The Full article can be found here as the writer explores these three approaches: 
http://www.darkreading.com/blog/232602668/nobody-cares-about-hipaa.html?itc=edit_stub

1 comment:

Ed Monteiro said...

I must say I disagree with "Nobody cares about HIPAA" and this person must not deal with anyone in the health care field.

I work with small health care providers and helping them get compliant and trust and believe me, they care.

The response I receive most often when I mention HIPAA is: "I'm not compliant?"

The problem isn't that they don't care, they just aren't aware of what they need to do and where they stand as far as compliance.