Heavily Regulated Industry

In my opinion this is not a topic that has a simple solution. Different environments have different variables to contend with. In our situation, Healthcare, we are under a great deal of outside regulation with significant monetary and civil penalties including possible jail time. I imagine a few of you have similar concerns.

While I like to consider myself someone that truly tries to understand the user's needs and provide them with the best technology solution available and affordable I often find myself at odds with these regulatory agencies. A patient's data is absolutely sacrosanct. This is not just an opinion of the organization but a directive handed down from the government. So, therefore, I am required to take every reasonable measure to ensure it's protection. The difficulty is less what technology to throw at the problem of protecting it but how to determine how a potential government auditor might define "reasonable". The regulations are not always very clear and the organization is left to determine what it thinks is best. This tends to create a situation where we feel compelled to lock everything up very tightly.

Personally, I try to explore new technologies and discuss them with users. I make an effort to stay "connected" with our users and see if things we deployed are actually working. I also seek their input into what new technologies to consider deploying in the future. Unfortunately, all too often, I find that even though I agree some new technology is really something that would streamline a particular process I cannot implement it because it comes to close to not meeting the regulations of some outside agency.

I'm not sure how to solve this situation of "shadow IT" but I do know that there is more involved then some draconian IT department and it's policies.