Side note to that, a lot of the orgs that actually have medical PII (schools, especially) will be significantly less compliant themseles with things like HIPAA

Side note to that, a lot of the orgs that actually have medical PII (schools, especially) will be significantly less compliant themseles with things like HIPAA than the vendors they use.