I think you've hit on the most important question. The definitions and compliance guidelines sound like thorny issues. Companies, individuals, and the governm

I think you've hit on the most important question. The definitions and compliance guidelines sound like thorny issues. Companies, individuals, and the government will all twist any reasonable, "gray" interpretations of the bill to their favor. Maybe a bill with definitions and protections similar to HIPAA, but less strict? However, the strict compliance and penalties of a bill like HIPAA might be one of the main reasons companies work so hard to comply with it.