Abstract
The Health Insurance Portability and Accountability Act will take effect in 2003. The regulations present institutions with the flexibility to select and implement a compliance approach. George Washington University undertook a structured approach to assess, plan, and implement a compliance program across privacy and security requirements.