"There are no prescriptive standards to protect your data?" How about the 18 standards labelled A) through R) in page 97 of: https://www.hhs.gov/sites/default/

"There are no prescriptive standards to protect your data?" How about the 18 standards labelled A) through R) in page 97 of: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-201303.pdf https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad... I am no expert but HIPPA seems far more prescriptive than say GDPR or PII regulations. I do agree that self-certification leads to perverse incentives and lowers the bar