One of HIPAA's weaknesses is that the data protection requirements only apply to certain kinds of entities - basically just health care providers. That means t

One of HIPAA's weaknesses is that the data protection requirements only apply to certain kinds of entities - basically just health care providers. That means that data may not be covered, depending on who collects it. Worse, data that was protected can legally fall out of protection if it's shared with entities that aren't bound by HIPAA. (Which, intentionally or otherwise, is something that health care providers often request the right to do as part of those HIPAA consent forms that we all sign without reading.)