Constructing Risk and Legitimizing Place: Privacy Professionals’ Interpretation and Implementation of HIPAA in Hospitals

• In Event: 194 - Section on Sociology of Law Paper Session. Law and Health

Abstract

The 1996 Health Insurance Portability and Accountability Act (HIPAA) established national standards on maintaining and securing the privacy of patient information. Consistent with neoinstitutional scholarship on weak state, HIPAA serves as a case study that shows how healthcare organizations respond to ambiguous regulations by designating a new set of professionals as responsible for interpreting and implementing a compliance program. While previous weak state scholarship has focused on equal opportunity law that spans six decades, HIPAA is a relatively young law and therefore provides an opportunity to examine the internal processes by which privacy professionals legitimize their compliance program and place within the healthcare organization. Through semi-structured interviews with eleven privacy professionals at eight New England hospitals, this qualitative analysis shows how privacy professionals construct and balance the perception of risk of federal enforcement and penalties. The data suggest that privacy professionals both amplify the risk in order to justify requests for resources, while also attenuating risk to reassure the organization that their compliance program is working.

Author

• Elizabeth Jayne Brennan, Brown University