HIPAA security compliance challenges: The case for small healthcare providers
Abstract
More than 60% of physicians in the U.S. practice as small healthcare providers. The realm of small healthcare providers includes dental offices, orthodontists, chiropractors, massage therapists, optometrists, long-term care facilities and other small, independent clinics that typically have 1 –30 employees. While studies have reported variable levels of Health Insurance Portability and Accountability Act (HIPAA) information security (InfoSec) compliance among hospitals and large medical facilities (Anthony DL, Appari A, Johnson ME. Institutionalizing HIPAA compliance: Organizations and competing logics in U.S. health care. J Health Soc Behav 2014;55(1):108–24; Brady, JW. Securing health care: Assessing factors that affect HIPAA security compliance in academic medical centers. Proceedings of the 2011 44th Hawaii International Conference on System Sciences, Manoa, Hawaii; 2011.), small healthcare providers face even more challenges in their effort to be HIPAA compliant. This paper will use a case study to examine factors that affect the small healthcare providers’ effort in meeting HIPAA InfoSec compliance. The paper also discusses services and technologies available to them to become compliant and how they can maintain continued compliance once they become compliant. Both a process model and an action compass are proposed to guide small healthcare providers. This case study provides support to existing compliance theories. The proposed guidance is useful for not only small healthcare providers but also mid-sized and large businesses in general.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
HIPAA and GDPR do not directly mention AI, but several of their clauses have relevance to AI applications and can be challenged by new ways that AI processes personal data.
“Moreover, HIPAA and GDPR do not directly mention AI, several of its clauses have relevance to AI applications and can be challenged by new ways that AI processes personal data [165], [166].”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [166]
Cites
Protection motivation and deterrence: a framework for security policy compliance in organisations
Herath, T. C., & Rao, H. R. (2009) · European Journal of Information Systems · doi:10.1057/ejis.2009.6 · Cited by 1,251 · see citing works
Coping With Systems Risk: Security Planning Models for Management Decision Making1
Straub, D. W., & Welke, R. J. (1998) · MIS Quarterly · doi:10.2307/249551 · Cited by 1,120 · see citing works
(1997) · Cited by 910 · see citing works
National Ambulatory Medical Care Survey: 2001 summary.
Cherry, D. K., Burt, C. W., & Woodwell, D. A. (2003) · PubMed · Cited by 686 · see citing works
An integrative study of information systems security effectiveness
Kankanhalli, A., Teo, H., Tan, B. C. Y., et al. (2003) · International Journal of Information Management · doi:10.1016/s0268-4012(02)00105-6 · Cited by 501 · see citing works
Essentials of Management Information Systems
(2012) · Advances in business strategy and competitive advantage book series · doi:10.4018/978-1-4666-0164-2.ch001 · Cited by 378 · see citing works
Organizations' Information Security Policy Compliance: Stick or Carrot Approach?
Chen, Y., Ramamurthy, K., & Wen, K. (2012) · Journal of Management Information Systems · doi:10.2753/mis0742-1222290305 · Cited by 286 · see citing works
Educational Psychology: Developing Learners 5th.ed
Ormrod, J. E. (2006) · Cited by 285 · see citing works
Variables influencing information security policy compliance
Sommestad, T., Hallberg, J., Lundholm, K., & Bengtsson, J. (2014) · Information Management & Computer Security · doi:10.1108/imcs-08-2012-0045 · Cited by 197 · see citing works
Small Primary Care Physician Practices Have Low Rates Of Preventable Hospital Admissions
Casalino, L. P., Pesko, M. F., Ryan, A. M., Mendelsohn, J. L., Copeland, K. R., Ramsay, P. P., Sun, X., Rittenhouse, D. R., & Shortell, S. M. (2014) · Health Affairs · doi:10.1377/hlthaff.2014.0434 · Cited by 108 · see citing works
Information systems security issues and decisions for small businesses
Gupta, A., & Hammond, R. (2005) · Information Management & Computer Security · doi:10.1108/09685220510614425 · Cited by 101 · see citing works
Dojkovski, S., Lichtenstein, S., & Warren, M. J. (2007) · Journal of the Association for Information Systems · Cited by 55 · see citing works
Approaches to IT Security in Small and Medium Enterprises.
Dimopoulos, V., Furnell, S., Jennex, M. E., et al. (2004) · Australian Information Security Management Conference · Cited by 38 · see citing works
Information Security & Insider Threats in Small Medical Practices
Martin, N., & Imboden, T. (2014) · Cited by 3 · see citing works
Defend your practice against HIPAA violations.
Sterling, R. (2015) · PubMed · Cited by 2 · see citing works
Analyst: HIPAA compliance proves costly for health care providers.
Worrell, B. (2002) · PubMed · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond
Nasir, S., Khan, R. A., & Bai, S. (2024) · IEEE Access · doi:10.1109/access.2024.3369912 · Cited by 152 · see citing works
- Authors
- Chen, J. Q., & Benusa, A.
- Affiliations
- St. Cloud State University (US)
- Corresponding author
- Chen, Jim Q.
- Venue
- International Journal of Healthcare Management
- Publisher
- Informa UK Limited
- Published
- 2017-01-12
- Volume
- 10
- Issue
- 2
- Pages
- 135-146
- ISSN
- 2047-9700 (ISSN-L)
- 2047-9719
- OpenAlex
- W2575448578
- Cited by
- 36
- References
- 16
- Citations by year
- 2026: 1 · 2025: 5 · 2024: 8 · 2023: 3 · 2022: 6 · 2021: 5 · 2020: 4 · 2019: 1 · 2018: 3
- FWCI
- 4.07
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- International Journal of Healthcare Management (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Thoreau and American Literature
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Health Sciences › Health Professions › Health Information Management › Healthcare Regulation
- Keywords
- HIPAA compliance, information security, health information privacy, compliance challenges, compliance guidance, process model, dental practice, chiropractic clinics, long-term care facilities
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
