Impact of HIPAA provisions on the stock market value of healthcare institutions, and information security and other information technology firms

Title 1 of the Health Insurance Portability and Accountability Act (HIPAA) was enacted to improve the portability of healthcare insurance coverage and Title II was intended to alleviate fraud and abuse. The development of a health information system was suggested in Title II of HIPAA as a means of promoting standardization to improve the efficiency of the healthcare system and ensure that electronic healthcare information is transferred securely and kept private. Since the legislation places the onus of providing the described improvements on healthcare institutions and part of these requirements relate to information technology (IT) and information security (IS), the process of complying with the legislation will necessitate acquiring products and services from IT/IS firms. From the viewpoint of stock market analysts, this increase in demand for IT/IS products and services has the potential to boost the profitability of public IT/IS firms, in turn positively enhancing their stock market valuation. Following the same logic, the legislation's compliance burdens shared by healthcare firms are expected to require hefty costs, thus potentially reducing the profitability of healthcare firms and reflecting negatively on their stock price. The intent of this paper is to evaluate the stock market reaction to the introduction of HIPAA legislation by evaluating the abnormal movement in the price of the stock of public healthcare institutions, IT, and IS firms. We conduct event-study analyses around the announcement dates of the various provisions of HIPAA. An event study is a standard statistical methodology used to determine whether the occurrence of a specific event or events results in a statistically significant reaction in financial markets. The advantage of the event study methodology for policy analysis is that it provides an anchor for determining value, which eliminates reliance on ad hoc judgments about the impact of specific events or policies on stock prices. While event studies have been conducted that examine the market effect of security and privacy breaches on firms, none has attempted to determine the impact, in terms of resulting market reaction, of the HIPAA legislation itself. The results of the study confirm the logic above, while also providing insight into specific stages of the legislative path of HIPAA.