In a sense the name says it all: HIPAA&#x27;s about Portability and Accountability, less about security.<p>I worked on a few security consulting projects in healthcare. The HIPAA security rule is way more vague about actual controls than a rational person would assume; much more than analogous regulations on financial data (e.g. PCI-DSS). The HITECH amendment added a lot of breadth regarding which parties must comply, but did little to proscribe specific controls. Most providers, contractors, etc. use a framework called HITRUST that attempts to identify and map actual security controls to HIPAA, but even that is not super actionable.<p>One of the hardest problems to solve is the immediate criticality of patient data. You absolutely cannot have someone die because a nurse or doctor forgot their password and couldn&#x27;t look up medical history. Makes practitioners resist adoption, and you end up with &quot;break the glass&quot; (emergency security bypass) functionality on a lot of sensitive systems&#x2F;data.