Right, the difference is medical records don't have a track record of being bought and sold with zero consequence. We're looking to take businesses that operate from the paradigm of "sell first, deal with the fallout later". Not organization that from day one have had a gun to their head if they so much as give the data a sideways look like those under HIPAA.
Sounds like a big ask porting something like that over to a widely public industry