Institutionalizing HIPAA Compliance

Abstract

Health care in the United States is highly regulated, yet compliance with regulations is variable. For example, compliance with two rules for securing electronic health information in the 1996 Health Insurance Portability and Accountability Act took longer than expected and was highly uneven across U.S. hospitals. We analyzed 3,321 medium and large hospitals using data from the 2003 Health Information and Management Systems Society Analytics Database. We find that organizational strategies and institutional environments influence hospital compliance, and further that institutional logics moderate the effect of some strategies, indicating the interplay of regulation, institutions, and organizations that contribute to the extensive variation that characterizes the U.S. health care system. Understanding whether and how health care organizations like hospitals respond to new regulation has important implications both for creating desired health care reform and for medical sociologists interested in the changing organizational structure of health care.