HIPAA is a cool thing, and it appears to be taken very seriously.

I especially appreciate that they are apparently going to get very specific about the degree of encryption that patient-identifying data must be protected with. I hope they don't bungle it by saying something like "1024 bit or greater" as some proposals I have seen - it is like saying 1024 layers of armor, or 1024 layers of wet toilet paper - they MUST be specific about the algorithm.