Creating a health care organization that is fully committed to safeguarding personal health information is difficult. It requires managers and employees, both individually and collectively, to engage in an ongoing process of learning, evaluation, and improvement to create an environment—and an organizational culture 3 —that values and respects patients' rights to privacy..