I wouldn't call HIPAA inadequate. It's poorly specified. There's a great deal of fire-and-brimstone to the penalties for violating it, while leaving an enormous

I wouldn't call HIPAA inadequate. It's poorly specified. There's a great deal of fire-and-brimstone to the penalties for violating it, while leaving an enormously vague IDE of exactly what is going to garner a penalty. It has the effect of discouraging any kind of innovative movement in the space or requiring a great deal of capital investment to cover ones bases. Totally agree wrt to the global ids, however. That would solve a lot of problems with record location, but relys on patients using them. In general I don't think they're altogether politically tenable. [street cred: I've worked in medical off and on for fifteen years, and built one of the largest biosurveillance networks in the country. If you went to an ER in a city of any size in Texas, your (fully anonymized) data almost certainly passed through that database. I should note that this was for public health purposes, which are exempted from the BAA requirements under HIPAA.]