Hospitals, doctors, and other health care professionals-along with employers, insurance companies, and all others who handle individuals' health care information in electronic form-should begin preparing now to meet the high security and privacy standards required by the Health Insurance Portability and Accountability Act of 19961. Compliance requires implementing the technology and operational practices of security systems, which are the framework for enforcing HIPAA's new privacy rules. Initial planning and budgeting for HIPAA projects is best begun now, because statutory compliance deadlines create great time pressure, given the business process reengineering and new systems that are necessary.
