>Because there are very few regulations that can effectively capture the intent of the rules instead of "tick boxes" that might or might not mean very much.

So HIPAA fines a company up to $50,000 per patient when a data leak occurs. They don't have to regulate how to secure the data, they just have to establish a fine with teeth requiring that companies secure their data with punishment when they don't.

Of course if congress would apply HIPAA rules to everyone's data and actually enforce it, data leaks for the most part will stop.

https://www.hipaajournal.com/what-are-the-penalties-for-hipa...