Right. Because there's no US law that covers storage of personal data by health providers. And there's no legal penalties for things like this.

(Hint: http://www.ecfr.gov/cgi-bin/text-idx?SID=9e10f619aa05225aef1... Subpart C—Security Standards for the Protection of Electronic Protected Health Information)