IMO part of the solution should be obvious: if a company loads JavaScript from a third party, and they have not vetted that third party for HIPAA compliance, th

IMO part of the solution should be obvious: if a company loads JavaScript from a third party, and they have not vetted that third party for HIPAA compliance, then the company including the JavaScript should be deemed to have violated patient probably even if no patient data was transmitted.