zlacker

That doesn't really help. HIPAA covers anything personally identifiable while held by a covered entity. Their only cover is the LE exception.

Just think: If I "only" steal names and address from the psych ward, that's still a breach.