Why do Healthcare Organizations Choose to Violate Information Technology Privacy Regulations? Proposing the Selective Information Privacy Violations in Healthcare Organizations Model (SIPVHOM)

Privacy and security concerns are rampant because of the ease of access to information. Continual negative cases in the popular press attest to the fact that current privacy regulations are failing to keep consumer and protected health information sufficiently secure in the climate of increased IT use. To address these issues, this paper proposes a theoretical model to explain and predict organizational privacy and security violations of externally governed laws and standards. Our proposed theoretical model, the Selective Organizational Information Privacy and Security Violations Model (SOIPSVM), explains how organizational structures and processes, along with characteristics of regulatory standards and rules, alter perceptions of risk and thereby the likelihood of rule violations. Finally, based on SOIPSVM, we offer recommendations for the structuring of organizations and external regulations to decrease abuse of consumer and health information.