Having worked in a US health tech start-up (and done some compliance work there), and now working with GDPR as a US company, I'm similarly frustrated with how imprecisely the regulations are worded. US health information privacy laws are much easier to interpret and follow. Large, important parts of GDPR compliance hinge on wording like "the processing is not occasional." "Occasional" is not defined in the regulations, and different countries' advisory bodies have completely opposite interpretations about what it means.