I actually work for one of the institutions cited in the article; yes, we have recently received the largest HIPAA related fine to date. It seems to me, as indi

I actually work for one of the institutions cited in the article; yes, we have recently received the largest HIPAA related fine to date. It seems to me, as indicated in the article, that the governments agenda is to enforce compliance/increase security by way of increasing penalties. If you look at penalties levied to date there is little correlation to the amount of people effected, but rather the ability for the institution to pay. I actually think this is a reasonable solution for the government to implement. Too often we have seen various industries scoff at low fine amounts. A sliding scale is more likely to get executives attention. In truth, the institution is taking this very, very seriously. There have been and will be many policy changes coming down from management. Outside consultants/auditors have been brought in (KPMG). Mandatory reporting and audit for three years by HHS. No solo (re. rogue) IT/developer personnel will be allowed to deploy changes to production without oversight, ie. change management oversight by a central board of peers. Complete endpoint encryption campaign. Employee education. Re-evaluation of business associate agreements. And on and on. All this will, of course, drive costs up but hopefully necessarily so - if implemented properly. The idea is that on the other side of this the institution will be a lot tighter ship with less leaks and possibilities for information leaks throughout. It will also act as an opportunity to educate executives as to the importance of security. The down side is that process can be implemented with a heavy hand grinding all progress to a screeching halt. If they can implement process while maintaining progress it should work itself out. My personal hope is that the institution invests not only in process but people. As others have pointed out, there has been a complete underinvestment in technical resources, re. people, to run the enterprise in healthcare and that has to change.