In the scramble to prepare their organizations for HIPAA compliance, healthcare financial managers may believe they must commit significant funds to overhauling information systems and hiring consulting firms. But security and confidentiality policies required by HIPAA cannot be implemented solely by upgrading computer systems. HIPAA compliance requires a wholesale change in staff attitudes and behavior regarding patient security and confidentiality. Healthcare organizations can prepare to comply with HIPAA regulations practically and affordably by combining in-house expertise with limited assistance from outside consulting firms. An added benefit of emphasizing the use of in-house resources to prepare the organization for HIPAA compliance is that the organization can develop and retain its own experts on HIPAA.