Organizational change surrounding the security of identifiable health information has become imperative. This is a significant challenge for managers who are held responsible for loss of privacy through faulty security procedures. Management cannot completely secure the organization and still provide employees and customers with the information and services they need. Organizations must decide how much and what type of security they need, how to assign priorities, and how to manage security as the organization evolves in a competitive environment