Despite the ambiguities of healthcare security costs and benefits, market mechanisms can nudge healthcare organizations toward effective proactive and voluntary security actions. However, the effectiveness of market mechanisms suffers from the economic forces of the imperfect US healthcare market. Thus, market-driven investments must be supplemented with regulator intervention across all types of healthcare organizations. However, such regulatory intervention should focus on reinforcing the economic impact of information security rather than simply trying to force specific behavior. © 2003-2012 IEEE.