Why did it take seven years for the HIPAA act to become a regulation in healthcare?

Answer 1

The major points of contention invovled the section entitled Administrative Simplification -- which includes Privacy and Security sections. Actually, HIPAA became law in 1996. However, most of HIPAA was held in abeyance until the law as crafted worked with reality, and the Covered Entities (CE's) were able to comply. Deadlines for various aspects of the law were laid down, with perhaps the most significant so far in 2003. Note that there are aspects of HIPAA that have not met their deadlines yet, and may never do so (e.g. the creation of a personal identifier for patients is on perma-hold and is likely to remain so). Simply passing a law in 1996 doesn't mean that the people who the law pertains to are instantly ready and able to comply with all aspects of that law. Additionally, while a lot of work went into drafting HIPAA, when a law first meets reality, there are usually unforeseen problems within the law that need to be corrected. And this happened with HIPAA as well. Then, as the law became know, significant expenditures of cash and manhours were required in order to comply with the law. The normal course of business, personnel training, etc. don't happen instantly; they take some time to implement. That said, it's also fair to note that HIPAA is not well understood even now, and especially by the Medical community (as opposed to the Insurance and Security communities). As such, a lot of the law was miscontrued and met with a huge amount of resistance, both at management and grass roots levels. Scientific communites exist in the free exchange of ideas, so adapting to privacy and limiting that free exchange, even for the best of reasons, is a sea change for the community. So a lot of foot-dragging -- some of it well-intentioned and some not -- were part and parcel of the implementation of HIPAA.