There's an old joke with the punch line: "I'm from the federal government, and I'm here to help you." But business-technology executives at health-care and financial-services companies aren't laughing as they study new and pending laws and regulations that require them to handle data in different ways-namely, storing more data longer and keeping it accessible to those who need it, while protecting it from unauthorized eyes. They're bracing to make big investments in new technologies and business processes to support those requirements.

Novant Health Corp., a nonprofit that operates seven hospitals and other health-care facilities in North Carolina, expects to spend as much as $20 million in the next 18 months to digitize X-rays, MRIs, and other patient information it currently keeps on film. It's doing so to comply with the Health Insurance Portability and Accountability Act, which requires that medical data be secure and easily accessible by patients. Though the act doesn't mandate that health-care companies digitize every last bit of patient information, Robert Dick, Novant's manager of imaging informatics, believes that's the best approach to comply with the law. The film hospitals now use isn't very secure or reliable, he says. It's often "misplaced or checked out by patients, lawyers, and doctors," he adds.

Novant Health expects to spend up to $20 million in the next 18 months to digitize patient information for security and HIPAA compliance, says Dick, manager of imaging informatics.

Novant is buying mirrored hard disks and tape storage from Storage Technology Corp. and a picture-archiving and communications system from Siemens Corp. to collect and store about 59 terabytes of data a year, Dick says.

CareGroup Healthcare System, which operates five Boston-area hospitals, is setting aside funds for a similar HIPAA-focused effort. The group already uses a combination of EMC Corp. Symmetrix hard-disk storage for recent data and StorageTek tape libraries for long-term archiving, but now it's beefing up its centralized storage to hold records that previously were stored on film. "This year, we're spending nearly $500,000 to centralize, manage, and archive all our X-rays, ultrasounds, and scans," CIO John Halamka says.

The prospect of selling storage, servers, and archiving, document-imaging, and records-management products to thousands of businesses is putting the bounce back into the step of some vendors. "Over the years, we'll see billions of dollars in revenue" because of regulations, says Chris Wood, director of field technical sales support at Sun Microsystems.

IBM isn't letting the opportunity pass. Last week, it bought Tarian Software, which makes software to manage electronic records. Features to help companies determine how long records should be retained or who can access them will be important as the government tightens electronic records-keeping requirements, says Brett MacIntyre, VP of content management at IBM. Documentum Inc. last week also bought a records-management software vendor, TrueArc Inc., whose system works with its content-management software.

Health-care and financial companies aren't enthusiastic about having to spend precious dollars on these initiatives, says Bob Abraham, founder of storage-technology consulting firm Freeman Associates. "In some cases, it could slow [other projects] down," he says.

On the other hand, financial-services companies may be buying themselves protection from legal problems if they can better manage and archive electronic communications related to customer transactions. "The impact from Enron and WorldCom hasn't ended," Abraham says. "The government wants to make sure records aren't destroyed." Securities and Exchange Commission amendments that take effect in May clarify what documents and communications, including E-mail and instant messages, must be kept and for how long. Key communications must be kept in an easily accessible location for two years. For many companies, that will mean modifying software and adding tape or optical-disk systems for long-term storage. Quite a few businesses still have a ways to go-some in the industry estimate that only about half of all investment banks have begun to deploy systems that will let them log and archive instant messages.