Directors' duty of care to monitor information systems in HMOs: some lessons from the Oxford Health Plan

This paper examines the legal and strategic issues raised by the use of information systems in health maintenance organizations (HMOs) and other managed care organizations. Given the critical nature of information systems to an HMO's business success and regulatory compliance, the large financial investment HMOs make in their systems, and the widely publicized concerns over the year 2000 "millennium bug" problem, information systems are appropriately a matter of concern to an HMO's board of directors. The recent experience of Oxford Health Plans, Inc. offers a case study in the apparent failure of the directors to monitor adequately the in-house development of an information system. The systems disaster which this corporation suffered in 1997 led to a dramatic drop in stock price, from which the company has yet to recover, as well as intense scrutiny by state and federal regulators and countless shareholder derivative actions against the directors. Corporate directors are subject to the fiduciary duty of care. Despite statutes in some states requiring directors to act prudently, state courts almost always apply the standard of gross negligence. As a result, even when directors act without due deliberation in their decision, it is rare that a court will find them to have failed in their duty of care. The business and regulatory community may find otherwise, however, when directors fail to evaluate information systems options carefully and the business suffers as a result.