In the US, medical privacy laws serve exactly two purposes: 1) Prevent the patients from suing after a data breach or intentional sale of their medical records

In the US, medical privacy laws serve exactly two purposes: 1) Prevent the patients from suing after a data breach or intentional sale of their medical records, regardless of negligence. 2) Transfer as much money as possible from health care to privately owned businesses in the compliance industry. Very few computer security lessons from that industry generalize to other parts of the economy.