HIPAA. The regulators mean well and the health data security situation is poor but the penalties and overhead it introduces mean you either have an awful locked down system no one wants to use or a "system" that uses fax or paper "tech" so old there are no regulations against it.