Managing Compliance and Risk Management in Health Care Settings

Abstract

This dissertation investigates how organizations operating in highly regulated environments manage the concurrent demands of regulatory compliance and information security risk management. Drawing on Oliver’s (1991) theory of strategic responses to institutional pressures, the study examines how organizations respond to overlapping external and internal pressures—particularly under resource constraints. Guided by two central research questions—(1) How do organizations manage compliance and risk management concurrently? and (2) How do they allocate resources to maximize compliance while minimizing security risks?—the study adopts an integrative approach that bridges the traditionally siloed domains of compliance, risk management, and information security. The research employs a two-part empirical design: a content analysis of compliance policies from 30 healthcare organizations and a case study of a children's hospital implementing a DEA-mandated Electronic Prescription for Controlled Substances (EPCS) system. The findings contribute to theory by identifying a previously undocumented tactic—prioritization—that organizations use to reconcile competing institutional demands. Another theoretical contribution is the development of a process model and a set of propositions that illustrate how organizations operating in highly regulated environments navigate the dual imperatives of compliance and risk management. By linking policy artifacts with real-world organizational behavior, this dissertation offers both scholarly and practical insights into how organizations navigate institutional complexity, enhance compliance maturity, and align security and regulatory needs.