Business Associate Contracts will require significant oversight. Others - such as print shops and banks, offshore processing, etc. Generally, CIOs have knowledge of information systems. Chief Legal Officers understand privacy. Compliance Officers know requirements, privacy, and reporting.
COOs have knowledge of e-business and other areas for added value.
For providers, Privacy has enormous impact and is just as complex as you think it is. Simply overlaying policies and procedures will not suffice. Claims will not get paid if covered transactions are not compliant. Several factors will compound complexity and drive up cost of compliance. They include multiple legacy systems, interfaces, and feeder systems.